<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="4.50.13.217"/>
        </slice>
        <from usec="0" sec="1439010861"/>
        <to usec="0" sec="1439010864"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="181.190.138.202" dst_ip="75.156.57.227" src_port="42833" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010227"/>
        <to usec="0" sec="1439010237"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="169.102.237.68" dst_ip="203.118.241.30" src_port="36676" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010826"/>
        <to usec="0" sec="1439010830"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="80.69.17.23" dst_ip="160.111.184.238" src_port="5938" dst_port="50108" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010655"/>
        <to usec="0" sec="1439010690"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="62.27.143.182" dst_ip="169.102.122.146" src_port="80" dst_port="49309" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010879"/>
        <to usec="0" sec="1439010880"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="58.15.19.95" dst_ip="160.111.203.127" src_port="182" dst_port="61093" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010582"/>
        <to usec="0" sec="1439010604"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="214.234.226.64" dst_ip="159.28.98.161" src_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010582"/>
        <to usec="0" sec="1439010583"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="214.16.226.112" dst_ip="176.149.45.138" src_port="80" dst_port="49700" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010841"/>
        <to usec="0" sec="1439010842"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="176.134.20.114" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010182"/>
        <to usec="0" sec="1439010722"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="26.38.100.214" dst_ip="169.102.122.146" src_port="80" dst_port="40669" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010656"/>
        <to usec="0" sec="1439010659"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="214.143.206.182"/>
        </slice>
        <from usec="0" sec="1439010617"/>
        <to usec="0" sec="1439010619"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.149.207.73" dst_ip="203.118.241.52" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010898"/>
        <to usec="0" sec="1439010901"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.149.240.36" dst_ip="36.190.76.238" src_port="52175" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010086"/>
        <to usec="0" sec="1439010088"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="196.74.99.54" dst_ip="220.249.20.124" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010031"/>
        <to usec="0" sec="1439010034"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="181.190.191.154"/>
        </slice>
        <from usec="0" sec="1439010500"/>
        <to usec="0" sec="1439010503"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="53.66.34.18" dst_ip="159.28.122.197" src_port="80" dst_port="44428" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010368"/>
        <to usec="0" sec="1439010370"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="181.190.207.214" dst_ip="140.47.85.231" dst_port="443"/>
            <filter src_ip="181.190.207.214" dst_ip="140.47.80.58" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010008"/>
        <to usec="0" sec="1439010845"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="159.28.211.95" dst_ip="221.7.78.190" src_port="80" dst_port="45408" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010330"/>
        <to usec="0" sec="1439010332"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="215.19.121.216" dst_ip="160.111.152.160" src_port="25159" dst_port="25" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010078"/>
        <to usec="0" sec="1439010081"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.96.12" dst_ip="214.237.191.142" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010007"/>
        <to usec="0" sec="1439010537"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="215.58.169.82" dst_ip="180.4.10.77" src_port="80" dst_port="10417" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010617"/>
        <to usec="0" sec="1439010619"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="209.84.162.64" dst_ip="159.28.96.186" src_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010690"/>
        <to usec="0" sec="1439010692"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.149.105.76" dst_ip="203.118.241.128" src_port="52755" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010324"/>
        <to usec="0" sec="1439010396"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="89.120.139.0" dst_ip="159.28.98.243" src_port="80" dst_port="53112" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010523"/>
        <to usec="0" sec="1439010524"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="159.28.146.149" dst_ip="75.40.138.224" src_port="50351" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010176"/>
        <to usec="0" sec="1439010544"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="181.190.109.142" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010131"/>
        <to usec="0" sec="1439010459"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="220.239.179.109" dst_ip="160.111.200.189" src_port="1935" dst_port="57479" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010318"/>
        <to usec="0" sec="1439010320"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="176.134.215.155"/>
        </slice>
        <from usec="0" sec="1439010005"/>
        <to usec="0" sec="1439010857"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="201.254.191.99" dst_ip="159.28.211.113" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010033"/>
        <to usec="0" sec="1439010335"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="181.190.191.173" dst_ip="75.150.112.144" src_port="58885" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010770"/>
        <to usec="0" sec="1439010773"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="220.249.17.186" dst_ip="39.76.134.143" src_port="63195" dst_port="25" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010301"/>
        <to usec="0" sec="1439010607"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="40.41.46.189" dst_ip="220.249.21.221" src_port="80" dst_port="47977" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010304"/>
        <to usec="0" sec="1439010306"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="176.134.24.158" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010556"/>
        <to usec="0" sec="1439010871"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="162.27.254.13" dst_ip="176.149.237.26" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010157"/>
        <to usec="0" sec="1439010446"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="14.10.172.142" dst_ip="160.111.118.28" src_port="80" dst_port="51933" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010317"/>
        <to usec="0" sec="1439010319"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="159.28.145.236" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010419"/>
        <to usec="0" sec="1439010727"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.98.185" dst_ip="75.150.112.120" src_port="52022" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010095"/>
        <to usec="0" sec="1439010130"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,901,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="181.190.109.147" dst_ip="25.191.5.17" src_port="49562" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010162"/>
        <to usec="0" sec="1439010578"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.149.199.73" dst_ip="203.118.234.120" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010422"/>
        <to usec="0" sec="1439010430"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="159.28.15.209"/>
        </slice>
        <from usec="0" sec="1439010479"/>
        <to usec="0" sec="1439010482"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="14.10.172.211" dst_ip="160.111.118.28" src_port="80" dst_port="51924" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010040"/>
        <to usec="0" sec="1439010142"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="4.31.84.208" dst_ip="221.15.236.123" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010387"/>
        <to usec="0" sec="1439010452"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="181.190.140.77" dst_ip="96.217.164.204" src_port="51608" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010361"/>
        <to usec="0" sec="1439010782"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="221.15.15.183"/>
        </slice>
        <from usec="0" sec="1439010805"/>
        <to usec="0" sec="1439010808"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="158.145.38.224" dst_ip="160.111.201.90" src_port="27050" dst_port="55069" proto="udp"/>
        </slice>
        <from usec="0" sec="1439010307"/>
        <to usec="0" sec="1439010725"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="203.118.241.78"/>
        </slice>
        <from usec="0" sec="1439010423"/>
        <to usec="0" sec="1439010431"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="193.131.246.58"/>
        </slice>
        <from usec="0" sec="1439010858"/>
        <to usec="0" sec="1439010860"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="50.244.140.161" dst_ip="176.149.7.252" src_port="80" dst_port="54516" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010102"/>
        <to usec="0" sec="1439010104"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="159.28.4.247" dst_ip="203.118.235.245" src_port="62647" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010449"/>
        <to usec="0" sec="1439010464"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.18.81" dst_ip="209.144.170.75" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010846"/>
        <to usec="0" sec="1439010874"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.147.19" dst_ip="148.74.151.33" src_port="54408" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010612"/>
        <to usec="0" sec="1439010665"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="143.224.238.194"/>
        </slice>
        <from usec="0" sec="1439010246"/>
        <to usec="0" sec="1439010252"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="181.190.113.231" dst_ip="132.56.179.186" src_port="61131" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010691"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="176.134.107.159"/>
        </slice>
        <from usec="0" sec="1439010548"/>
        <to usec="0" sec="1439010725"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="147.206.182.90" dst_ip="160.111.184.84" src_port="80" dst_port="49913" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010069"/>
        <to usec="0" sec="1439010071"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="159.28.98.243"/>
        </slice>
        <from usec="0" sec="1439010324"/>
        <to usec="0" sec="1439010850"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.149.47.54" dst_ip="106.225.202.229" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010382"/>
        <to usec="0" sec="1439010555"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="159.28.145.190" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010005"/>
        <to usec="0" sec="1439010881"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.134.244.25" dst_ip="75.46.4.104" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010700"/>
        <to usec="0" sec="1439010706"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="169.102.51.128" dst_ip="203.118.233.148" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010010"/>
        <to usec="0" sec="1439010288"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="176.134.238.23" dst_ip="31.95.144.27" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010012"/>
        <to usec="0" sec="1439010018"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="169.102.224.37"/>
        </slice>
        <from usec="0" sec="1439010666"/>
        <to usec="0" sec="1439010669"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.144.43" dst_ip="209.236.158.193" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010519"/>
        <to usec="0" sec="1439010656"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.112.163" dst_ip="202.20.96.126" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010115"/>
        <to usec="0" sec="1439010819"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="4.206.147.14"/>
        </slice>
        <from usec="0" sec="1439010118"/>
        <to usec="0" sec="1439010120"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="160.104.33.153" dst_ip="180.4.140.178" src_port="51095" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010324"/>
        <to usec="0" sec="1439010327"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="136.119.47.233"/>
        </slice>
        <from usec="0" sec="1439010131"/>
        <to usec="0" sec="1439010142"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="221.15.13.208"/>
        </slice>
        <from usec="0" sec="1439010621"/>
        <to usec="0" sec="1439010624"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="39.64.1.56" dst_ip="169.102.122.150" src_port="80" dst_port="55148" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010289"/>
        <to usec="0" sec="1439010291"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.149.159.184" dst_ip="203.118.246.47" src_port="58338" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010158"/>
        <to usec="0" sec="1439010894"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="159.28.145.139" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010176"/>
        <to usec="0" sec="1439010178"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="159.28.119.56" dst_ip="155.194.126.37" src_port="54223" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010566"/>
        <to usec="0" sec="1439010569"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="75.150.118.27" dst_ip="220.249.25.184" src_port="80" dst_port="23387" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010620"/>
        <to usec="0" sec="1439010621"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.134.252.108" dst_ip="25.189.79.63" src_port="57199" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010842"/>
        <to usec="0" sec="1439010857"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="160.104.33.137"/>
        </slice>
        <from usec="0" sec="1439010370"/>
        <to usec="0" sec="1439010373"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="39.230.234.90" dst_ip="221.15.9.131" src_port="33117" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010886"/>
        <to usec="0" sec="1439010889"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="207.67.26.190" dst_ip="169.102.122.206" src_port="80" dst_port="33979" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010584"/>
        <to usec="0" sec="1439010587"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="169.102.155.1"/>
        </slice>
        <from usec="0" sec="1439010221"/>
        <to usec="0" sec="1439010231"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="160.104.33.143" dst_ip="180.4.140.176" src_port="61643" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010265"/>
        <to usec="0" sec="1439010267"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="12.181.108.28" dst_ip="160.111.91.42" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010081"/>
        <to usec="0" sec="1439010092"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.149.157.156" dst_ip="8.186.54.80" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010059"/>
        <to usec="0" sec="1439010094"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="159.28.122.23"/>
        </slice>
        <from usec="0" sec="1439010661"/>
        <to usec="0" sec="1439010663"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="159.28.98.196" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010381"/>
        <to usec="0" sec="1439010721"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="33.120.96.95" dst_ip="160.111.201.214" src_port="443" dst_port="57017" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010442"/>
        <to usec="0" sec="1439010792"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.102.122.192"/>
        </slice>
        <from usec="0" sec="1439010550"/>
        <to usec="0" sec="1439010801"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.149.41.201" dst_ip="203.118.241.147" src_port="50879" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010194"/>
        <to usec="0" sec="1439010448"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.109.77.226" dst_ip="159.28.146.142" src_port="80" dst_port="49492" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010653"/>
        <to usec="0" sec="1439010655"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="176.134.25.119" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010027"/>
        <to usec="0" sec="1439010848"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.149.182.124"/>
        </slice>
        <from usec="0" sec="1439010130"/>
        <to usec="0" sec="1439010812"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="199.118.214.71" dst_ip="221.6.165.133" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010010"/>
        <to usec="0" sec="1439010651"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="181.190.158.131" dst_ip="133.99.190.69" src_port="53382" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010043"/>
        <to usec="0" sec="1439010556"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.96.151" dst_ip="215.82.231.76" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010008"/>
        <to usec="0" sec="1439010085"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="32.205.165.247"/>
        </slice>
        <from usec="0" sec="1439010361"/>
        <to usec="0" sec="1439010363"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.146.35" dst_ip="215.58.169.109" src_port="53216" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010535"/>
        <to usec="0" sec="1439010885"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="169.102.242.210" dst_ip="106.225.203.233" src_port="49551" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010841"/>
        <to usec="0" sec="1439010874"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.134.234.66" dst_ip="147.197.73.190" src_port="49719" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010777"/>
        <to usec="0" sec="1439010815"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.134.106.210" dst_ip="106.225.200.131" src_port="50130" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010276"/>
        <to usec="0" sec="1439010282"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="159.28.144.242" dst_ip="0.155.153.123" dst_port="993" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010877"/>
        <to usec="0" sec="1439010880"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="201.204.178.233" dst_ip="43.37.82.198" src_port="49168" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010047"/>
        <to usec="0" sec="1439010379"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="159.28.96.180" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010583"/>
        <to usec="0" sec="1439010887"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="29.52.248.210" dst_ip="160.111.201.150" src_port="80" dst_port="60167" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010173"/>
        <to usec="0" sec="1439010175"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.134.214.42" dst_ip="106.225.200.189" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010190"/>
        <to usec="0" sec="1439010397"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.97.233" dst_ip="83.48.153.253" src_port="49395" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010009"/>
        <to usec="0" sec="1439010894"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.97.232" dst_ip="202.124.146.46" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010233"/>
        <to usec="0" sec="1439010396"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.149.169.226" dst_ip="138.127.32.70" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010273"/>
        <to usec="0" sec="1439010447"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="96.155.144.159"/>
        </slice>
        <from usec="0" sec="1439010648"/>
        <to usec="0" sec="1439010671"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.97.238" dst_ip="221.7.148.213" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010010"/>
        <to usec="0" sec="1439010730"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="159.28.97.159" dst_ip="173.211.105.89" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010110"/>
        <to usec="0" sec="1439010785"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,502,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="208.66.175.0" dst_port="22" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010106"/>
        <to usec="0" sec="1439010323"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,502,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="170.221.67.148" dst_ip="176.149.102.151" src_port="50357" dst_port="22" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010427"/>
        <to usec="0" sec="1439010436"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="159.28.227.203" dst_ip="203.118.244.238" src_port="37049" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010114"/>
        <to usec="0" sec="1439010197"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.149.239.102" dst_ip="36.190.76.155" src_port="62551" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010770"/>
        <to usec="0" sec="1439010773"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="220.249.20.176" dst_ip="185.137.28.14" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010249"/>
        <to usec="0" sec="1439010853"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="4.2.127.12"/>
        </slice>
        <from usec="0" sec="1439010891"/>
        <to usec="0" sec="1439010894"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="181.190.137.60" dst_ip="133.98.84.217" src_port="49167" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010256"/>
        <to usec="0" sec="1439010261"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="159.28.97.137" dst_ip="37.237.16.179" src_port="60548" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010677"/>
        <to usec="0" sec="1439010734"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="159.28.144.174" dst_ip="75.150.126.41" src_port="59968" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010495"/>
        <to usec="0" sec="1439010498"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="32.205.165.168" dst_ip="220.249.16.87" src_port="35176" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010244"/>
        <to usec="0" sec="1439010247"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="159.28.113.118" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010411"/>
        <to usec="0" sec="1439010767"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="150.55.221.39"/>
        </slice>
        <from usec="0" sec="1439010831"/>
        <to usec="0" sec="1439010833"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="159.28.65.152"/>
        </slice>
        <from usec="0" sec="1439010058"/>
        <to usec="0" sec="1439010061"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="181.190.36.87" dst_ip="214.160.48.242" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010536"/>
        <to usec="0" sec="1439010551"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="221.15.252.181" dst_ip="203.118.245.85" src_port="55738" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010826"/>
        <to usec="0" sec="1439010853"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="221.15.248.209" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010537"/>
        <to usec="0" sec="1439010849"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="96.186.170.101" dst_ip="159.28.65.79" src_port="443" dst_port="53328" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010583"/>
        <to usec="0" sec="1439010584"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="101.127.108.97"/>
        </slice>
        <from usec="0" sec="1439010746"/>
        <to usec="0" sec="1439010748"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="159.28.22.241" dst_ip="203.118.234.87" src_port="50832" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010003"/>
        <to usec="0" sec="1439010390"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.149.233.199" dst_ip="203.118.241.195" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010681"/>
        <to usec="0" sec="1439010701"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="169.102.122.154" dst_ip="196.249.23.138" src_port="52271" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010546"/>
        <to usec="0" sec="1439010549"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="221.15.231.127"/>
        </slice>
        <from usec="0" sec="1439010194"/>
        <to usec="0" sec="1439010797"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="176.149.255.173" dst_port="443"/>
            <filter dst_ip="106.225.202.196" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010046"/>
        <to usec="0" sec="1439010813"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="220.249.22.5"/>
        </slice>
        <from usec="0" sec="1439010058"/>
        <to usec="0" sec="1439010106"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="106.225.203.229"/>
        </slice>
        <from usec="0" sec="1439010548"/>
        <to usec="0" sec="1439010609"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.134.245.195" dst_ip="23.145.155.93" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010082"/>
        <to usec="0" sec="1439010370"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="180.4.142.248"/>
        </slice>
        <from usec="0" sec="1439010265"/>
        <to usec="0" sec="1439010297"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="75.150.154.33" dst_ip="75.150.154.33" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010770"/>
        <to usec="0" sec="1439010789"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="220.249.16.153"/>
        </slice>
        <from usec="0" sec="1439010016"/>
        <to usec="0" sec="1439010126"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="159.28.184.201" dst_port="993"/>
        </slice>
        <from usec="0" sec="1439010066"/>
        <to usec="0" sec="1439010763"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.102.50.100" dst_ip="106.225.207.233" src_port="53929" dst_port="80"/>
            <filter src_ip="169.102.50.100" dst_ip="39.230.235.98" src_port="61910" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010742"/>
        <to usec="0" sec="1439010747"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="159.28.80.136" dst_ip="131.22.249.181" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010022"/>
        <to usec="0" sec="1439010864"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.149.115.97" dst_ip="36.190.76.209" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010372"/>
        <to usec="0" sec="1439010394"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="1.248.35.112" dst_ip="159.28.48.202" src_port="19331" dst_port="80"/>
            <filter src_ip="1.248.35.112" dst_ip="159.28.48.202" src_port="19330" dst_port="80"/>
            <filter src_ip="1.248.35.112" dst_ip="159.28.48.202" src_port="19329" dst_port="80"/>
            <filter src_ip="1.248.35.112" dst_ip="159.28.48.202" src_port="19328" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010722"/>
        <to usec="0" sec="1439010738"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,999,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="176.149.159.59" dst_port="25"/>
            <filter src_ip="75.241.2.137" dst_ip="176.149.159.59" dst_port="993"/>
        </slice>
        <from usec="0" sec="1439010004"/>
        <to usec="0" sec="1439010815"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="80.186.238.111" dst_ip="80.186.238.111" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010515"/>
        <to usec="0" sec="1439010525"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="72.43.185.110" dst_ip="220.249.21.214" src_port="40145" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010753"/>
        <to usec="0" sec="1439010901"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="160.111.135.39" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010064"/>
        <to usec="0" sec="1439010773"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="203.118.244.126"/>
        </slice>
        <from usec="0" sec="1439010179"/>
        <to usec="0" sec="1439010185"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="29.174.213.70"/>
        </slice>
        <from usec="0" sec="1439010157"/>
        <to usec="0" sec="1439010159"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="106.225.221.128" dst_ip="159.28.21.19" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010618"/>
        <to usec="0" sec="1439010688"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="194.191.34.14"/>
        </slice>
        <from usec="0" sec="1439010004"/>
        <to usec="0" sec="1439010587"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="195.175.76.147"/>
        </slice>
        <from usec="0" sec="1439010080"/>
        <to usec="0" sec="1439010083"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,054,1 0 0 0 0 0 0 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="159.28.96.58" dst_ip="101.88.116.186" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010790"/>
        <to usec="0" sec="1439010793"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="159.28.97.60"/>
        </slice>
        <from usec="0" sec="1439010363"/>
        <to usec="0" sec="1439010888"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,502,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="194.51.139.167" dst_ip="220.249.26.93" dst_port="22" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010003"/>
        <to usec="0" sec="1439010853"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="159.28.96.85"/>
        </slice>
        <from usec="0" sec="1439010151"/>
        <to usec="0" sec="1439010154"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="159.28.65.87" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010151"/>
        <to usec="0" sec="1439010154"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="159.28.144.201"/>
        </slice>
        <from usec="0" sec="1439010805"/>
        <to usec="0" sec="1439010808"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="159.28.30.10" dst_ip="157.233.246.172" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010006"/>
        <to usec="0" sec="1439010009"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.155.215.41"/>
        </slice>
        <from usec="0" sec="1439010119"/>
        <to usec="0" sec="1439010140"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="53.153.21.127"/>
        </slice>
        <from usec="0" sec="1439010738"/>
        <to usec="0" sec="1439010754"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,502,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="8.124.127.82" dst_ip="159.28.211.125" dst_port="22" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010024"/>
        <to usec="0" sec="1439010565"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="221.15.255.24"/>
        </slice>
        <from usec="0" sec="1439010770"/>
        <to usec="0" sec="1439010773"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="181.190.100.162"/>
        </slice>
        <from usec="0" sec="1439010718"/>
        <to usec="0" sec="1439010780"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="181.190.65.30" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010289"/>
        <to usec="0" sec="1439010669"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.102.77.248"/>
        </slice>
        <from usec="0" sec="1439010048"/>
        <to usec="0" sec="1439010051"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="181.190.100.236"/>
        </slice>
        <from usec="0" sec="1439010483"/>
        <to usec="0" sec="1439010486"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="159.28.96.236"/>
        </slice>
        <from usec="0" sec="1439010350"/>
        <to usec="0" sec="1439010353"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="159.28.211.95"/>
        </slice>
        <from usec="0" sec="1439010729"/>
        <to usec="0" sec="1439010732"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="219.192.157.218" dst_ip="176.149.222.176" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010222"/>
        <to usec="0" sec="1439010540"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="75.130.32.77"/>
        </slice>
        <from usec="0" sec="1439010548"/>
        <to usec="0" sec="1439010607"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="221.7.148.233" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010054"/>
        <to usec="0" sec="1439010781"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="223.147.86.0" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010724"/>
        <to usec="0" sec="1439010759"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="220.249.31.14" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010244"/>
        <to usec="0" sec="1439010299"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="117.152.167.243"/>
        </slice>
        <from usec="0" sec="1439010800"/>
        <to usec="0" sec="1439010815"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.185.229.41" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010145"/>
        <to usec="0" sec="1439010158"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.49.237.139" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010472"/>
        <to usec="0" sec="1439010485"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.154.159.149" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010867"/>
        <to usec="0" sec="1439010879"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="144.79.202.43" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010544"/>
        <to usec="0" sec="1439010555"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.9.73.207"/>
        </slice>
        <from usec="0" sec="1439010641"/>
        <to usec="0" sec="1439010653"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="37.93.112.80" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010839"/>
        <to usec="0" sec="1439010842"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.83.101.129" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010739"/>
        <to usec="0" sec="1439010750"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.186.217.15" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010868"/>
        <to usec="0" sec="1439010871"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.152.26.94" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010510"/>
        <to usec="0" sec="1439010513"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.48.97.248" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010443"/>
        <to usec="0" sec="1439010454"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.191.123.0" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010821"/>
        <to usec="0" sec="1439010832"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.47.53.151" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010445"/>
        <to usec="0" sec="1439010456"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.213.44.125" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010861"/>
        <to usec="0" sec="1439010866"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.206.3.125" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010644"/>
        <to usec="0" sec="1439010667"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.19.158.10" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010414"/>
        <to usec="0" sec="1439010431"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.127.167.27" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010388"/>
        <to usec="0" sec="1439010399"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="118.167.125.107" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010010"/>
        <to usec="0" sec="1439010032"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.4.154.13" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010641"/>
        <to usec="0" sec="1439010658"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.179.121.209" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010150"/>
        <to usec="0" sec="1439010163"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="118.119.137.43" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010513"/>
        <to usec="0" sec="1439010530"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.159.195.51"/>
        </slice>
        <from usec="0" sec="1439010770"/>
        <to usec="0" sec="1439010782"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="207.19.120.63" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010700"/>
        <to usec="0" sec="1439010711"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.91.198.3" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010434"/>
        <to usec="0" sec="1439010444"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="8.144.75.194" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010654"/>
        <to usec="0" sec="1439010656"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.13.227.104" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010206"/>
        <to usec="0" sec="1439010212"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.129.189.217" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010194"/>
        <to usec="0" sec="1439010201"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.44.91.28" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010442"/>
        <to usec="0" sec="1439010453"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="24.30.41.159" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010490"/>
        <to usec="0" sec="1439010501"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.214.191.112" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010173"/>
        <to usec="0" sec="1439010194"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.83.5.220" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010856"/>
        <to usec="0" sec="1439010869"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.46.189.60"/>
        </slice>
        <from usec="0" sec="1439010103"/>
        <to usec="0" sec="1439010126"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="94.63.240.68" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010211"/>
        <to usec="0" sec="1439010223"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="31.129.79.89" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010476"/>
        <to usec="0" sec="1439010491"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.32.11.24" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010730"/>
        <to usec="0" sec="1439010734"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.190.222.59" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010705"/>
        <to usec="0" sec="1439010717"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="63.3.110.72" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010500"/>
        <to usec="0" sec="1439010517"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.4.1.157" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010887"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.71.229.54" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010582"/>
        <to usec="0" sec="1439010594"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.73.77.49" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010180"/>
        <to usec="0" sec="1439010193"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.137.159.95" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010495"/>
        <to usec="0" sec="1439010507"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.185.99.178" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010147"/>
        <to usec="0" sec="1439010166"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="49.255.179.167" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010694"/>
        <to usec="0" sec="1439010707"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.91.78.159" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010374"/>
        <to usec="0" sec="1439010389"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="163.63.103.233" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010718"/>
        <to usec="0" sec="1439010739"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.175.223.252" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010563"/>
        <to usec="0" sec="1439010576"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.0.134.14" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010368"/>
        <to usec="0" sec="1439010381"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.157.139.17" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010406"/>
        <to usec="0" sec="1439010418"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.183.99.103" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010820"/>
        <to usec="0" sec="1439010823"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.178.119.96" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010595"/>
        <to usec="0" sec="1439010621"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.89.132.116" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010131"/>
        <to usec="0" sec="1439010147"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="28.103.168.143" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010849"/>
        <to usec="0" sec="1439010860"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="198.227.150.219" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010024"/>
        <to usec="0" sec="1439010042"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.46.163.200"/>
        </slice>
        <from usec="0" sec="1439010016"/>
        <to usec="0" sec="1439010032"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.153.96.136" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010546"/>
        <to usec="0" sec="1439010557"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.175.220.168" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010469"/>
        <to usec="0" sec="1439010482"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.22.113.201" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010048"/>
        <to usec="0" sec="1439010059"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.154.212.96" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010707"/>
        <to usec="0" sec="1439010722"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.1.103.137"/>
        </slice>
        <from usec="0" sec="1439010454"/>
        <to usec="0" sec="1439010462"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.4.222.110" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010460"/>
        <to usec="0" sec="1439010471"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="61.49.208.93" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010158"/>
        <to usec="0" sec="1439010169"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.117.55.20" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010521"/>
        <to usec="0" sec="1439010532"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.139.249.208" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010109"/>
        <to usec="0" sec="1439010117"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.1.64.103"/>
        </slice>
        <from usec="0" sec="1439010103"/>
        <to usec="0" sec="1439010126"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="199.7.221.109" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010202"/>
        <to usec="0" sec="1439010205"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="131.130.39.237" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010441"/>
        <to usec="0" sec="1439010445"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.112.3.6" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010787"/>
        <to usec="0" sec="1439010789"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="28.80.17.11"/>
        </slice>
        <from usec="0" sec="1439010776"/>
        <to usec="0" sec="1439010787"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.124.88.227" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010240"/>
        <to usec="0" sec="1439010251"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.134.110.2"/>
        </slice>
        <from usec="0" sec="1439010530"/>
        <to usec="0" sec="1439010540"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="33.127.40.200" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010709"/>
        <to usec="0" sec="1439010720"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.132.156.254" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010537"/>
        <to usec="0" sec="1439010549"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="2.161.113.184"/>
        </slice>
        <from usec="0" sec="1439010154"/>
        <to usec="0" sec="1439010164"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="12.172.218.130" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010492"/>
        <to usec="0" sec="1439010505"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="179.103.42.253" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010503"/>
        <to usec="0" sec="1439010507"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,502,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="21.214.186.250" dst_port="22" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010842"/>
        <to usec="0" sec="1439010853"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.139.152.70" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010658"/>
        <to usec="0" sec="1439010669"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.23.237.158" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010875"/>
        <to usec="0" sec="1439010897"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="12.160.159.188" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010383"/>
        <to usec="0" sec="1439010394"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="65.218.182.181"/>
        </slice>
        <from usec="0" sec="1439010542"/>
        <to usec="0" sec="1439010548"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="159.28.97.117"/>
        </slice>
        <from usec="0" sec="1439010097"/>
        <to usec="0" sec="1439010100"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.136.87.26" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010514"/>
        <to usec="0" sec="1439010516"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="131.248.8.126" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010762"/>
        <to usec="0" sec="1439010787"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.42.212.93" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010612"/>
        <to usec="0" sec="1439010620"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,502,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="194.69.84.108" dst_port="22"/>
        </slice>
        <from usec="0" sec="1439010716"/>
        <to usec="0" sec="1439010727"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.74.162.9" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010050"/>
        <to usec="0" sec="1439010067"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.234.106.193" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010119"/>
        <to usec="0" sec="1439010142"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.30.187.98" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010444"/>
        <to usec="0" sec="1439010459"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.72.80.25" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010399"/>
        <to usec="0" sec="1439010408"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="51.13.165.113" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010501"/>
        <to usec="0" sec="1439010510"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.101.96.155" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010101"/>
        <to usec="0" sec="1439010111"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.135.229.27" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010142"/>
        <to usec="0" sec="1439010144"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="137.158.85.183" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010063"/>
        <to usec="0" sec="1439010592"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.98.50.251"/>
        </slice>
        <from usec="0" sec="1439010052"/>
        <to usec="0" sec="1439010069"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.45.243.230" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010606"/>
        <to usec="0" sec="1439010616"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.177.79.64" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010557"/>
        <to usec="0" sec="1439010570"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="53.19.77.112" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010884"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.250.120.194" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010076"/>
        <to usec="0" sec="1439010088"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.36.61.117"/>
        </slice>
        <from usec="0" sec="1439010071"/>
        <to usec="0" sec="1439010092"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="7.62.118.55" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010711"/>
        <to usec="0" sec="1439010725"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="199.1.74.251" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010077"/>
        <to usec="0" sec="1439010085"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.186.36.89"/>
        </slice>
        <from usec="0" sec="1439010644"/>
        <to usec="0" sec="1439010655"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.25.172.85" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010598"/>
        <to usec="0" sec="1439010607"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="211.83.248.215" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010076"/>
        <to usec="0" sec="1439010080"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="170.95.14.173" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010606"/>
        <to usec="0" sec="1439010609"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.197.221.62" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010408"/>
        <to usec="0" sec="1439010418"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="9.2.105.114" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010878"/>
        <to usec="0" sec="1439010880"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.41.165.201" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010265"/>
        <to usec="0" sec="1439010267"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="136.103.180.247" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010547"/>
        <to usec="0" sec="1439010549"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="48.216.214.158" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010548"/>
        <to usec="0" sec="1439010550"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="69.232.135.99" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010886"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.12.138.49"/>
        </slice>
        <from usec="0" sec="1439010603"/>
        <to usec="0" sec="1439010614"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="81.39.60.97" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010006"/>
        <to usec="0" sec="1439010021"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="221.15.231.14"/>
        </slice>
        <from usec="0" sec="1439010515"/>
        <to usec="0" sec="1439010518"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.114.224.83"/>
        </slice>
        <from usec="0" sec="1439010807"/>
        <to usec="0" sec="1439010810"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.146.171.125"/>
        </slice>
        <from usec="0" sec="1439010024"/>
        <to usec="0" sec="1439010030"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.159.2.12" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010698"/>
        <to usec="0" sec="1439010710"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="38.195.121.114" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010132"/>
        <to usec="0" sec="1439010142"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.67.29.161" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010620"/>
        <to usec="0" sec="1439010634"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.56.146.103" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010532"/>
        <to usec="0" sec="1439010533"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="66.228.254.111" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010582"/>
        <to usec="0" sec="1439010593"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.74.199.89" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010796"/>
        <to usec="0" sec="1439010804"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.80.246.118" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010573"/>
        <to usec="0" sec="1439010578"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.134.122.244" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010872"/>
        <to usec="0" sec="1439010881"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="134.68.53.196" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010441"/>
        <to usec="0" sec="1439010442"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="198.95.217.61"/>
        </slice>
        <from usec="0" sec="1439010090"/>
        <to usec="0" sec="1439010097"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.38.49.235" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010244"/>
        <to usec="0" sec="1439010261"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="6.110.4.239"/>
        </slice>
        <from usec="0" sec="1439010808"/>
        <to usec="0" sec="1439010827"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.178.186.105" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010549"/>
        <to usec="0" sec="1439010569"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.52.186.14" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010875"/>
        <to usec="0" sec="1439010887"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.58.65.239" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010807"/>
        <to usec="0" sec="1439010813"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="61.183.98.122" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010256"/>
        <to usec="0" sec="1439010260"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.217.93.49" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010138"/>
        <to usec="0" sec="1439010140"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.152.155.7" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010646"/>
        <to usec="0" sec="1439010660"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="136.19.153.59" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010433"/>
        <to usec="0" sec="1439010444"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.191.144.15" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010636"/>
        <to usec="0" sec="1439010645"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.255.101.220" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010435"/>
        <to usec="0" sec="1439010454"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.136.77.24"/>
        </slice>
        <from usec="0" sec="1439010501"/>
        <to usec="0" sec="1439010507"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.185.158.74" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010676"/>
        <to usec="0" sec="1439010688"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.152.160.156" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010243"/>
        <to usec="0" sec="1439010259"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.137.1.36" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010035"/>
        <to usec="0" sec="1439010053"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.214.18.157" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010427"/>
        <to usec="0" sec="1439010438"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="161.124.150.73" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010039"/>
        <to usec="0" sec="1439010055"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.207.159.239" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010242"/>
        <to usec="0" sec="1439010243"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="161.124.221.110" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010824"/>
        <to usec="0" sec="1439010843"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.36.118.230"/>
        </slice>
        <from usec="0" sec="1439010889"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="7.84.108.53" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010821"/>
        <to usec="0" sec="1439010838"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.176.168.53" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010152"/>
        <to usec="0" sec="1439010165"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.117.97.194" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010632"/>
        <to usec="0" sec="1439010652"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="63.228.116.118" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010855"/>
        <to usec="0" sec="1439010875"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.32.109.40" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010543"/>
        <to usec="0" sec="1439010558"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.143.125.141" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010385"/>
        <to usec="0" sec="1439010395"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.44.37.25" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010806"/>
        <to usec="0" sec="1439010815"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.151.131.248" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010543"/>
        <to usec="0" sec="1439010552"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.154.106.141" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010253"/>
        <to usec="0" sec="1439010267"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.1.194.112" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010106"/>
        <to usec="0" sec="1439010127"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="136.178.50.33" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010231"/>
        <to usec="0" sec="1439010232"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.128.157.164" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010663"/>
        <to usec="0" sec="1439010674"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.138.213.231" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010179"/>
        <to usec="0" sec="1439010183"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.153.101.55" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010853"/>
        <to usec="0" sec="1439010864"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="202.121.145.171" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010874"/>
        <to usec="0" sec="1439010880"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="118.238.176.157" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010607"/>
        <to usec="0" sec="1439010616"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,999,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="221.6.165.164"/>
        </slice>
        <from usec="0" sec="1439010784"/>
        <to usec="0" sec="1439010787"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="25.191.34.191"/>
        </slice>
        <from usec="0" sec="1439010068"/>
        <to usec="0" sec="1439010071"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="65.82.197.115" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010174"/>
        <to usec="0" sec="1439010175"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="44.5.114.123" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010194"/>
        <to usec="0" sec="1439010196"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="14.176.163.2" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010581"/>
        <to usec="0" sec="1439010582"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="14.190.197.132" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010896"/>
        <to usec="0" sec="1439010898"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="206.73.22.49" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010563"/>
        <to usec="0" sec="1439010565"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="3.241.82.23" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010863"/>
        <to usec="0" sec="1439010865"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="55.101.96.155" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010101"/>
        <to usec="0" sec="1439010111"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="42.223.183.187" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010154"/>
        <to usec="0" sec="1439010155"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="163.166.72.132" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010397"/>
        <to usec="0" sec="1439010400"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="9.2.105.114" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010878"/>
        <to usec="0" sec="1439010880"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="50.41.165.201"/>
        </slice>
        <from usec="0" sec="1439010265"/>
        <to usec="0" sec="1439010267"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="222.11.2.49" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010257"/>
        <to usec="0" sec="1439010258"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="80.146.171.125" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010026"/>
        <to usec="0" sec="1439010028"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="136.178.50.33" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010231"/>
        <to usec="0" sec="1439010232"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="37.93.112.80" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010840"/>
        <to usec="0" sec="1439010842"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,011,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="128.138.213.231" src_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010180"/>
        <to usec="0" sec="1439010182"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="24.92.132.84" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010835"/>
        <to usec="0" sec="1439010839"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="50.79.232.66" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010861"/>
        <to usec="0" sec="1439010868"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="198.227.150.219" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010040"/>
        <to usec="0" sec="1439010042"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="14.173.56.66" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010364"/>
        <to usec="0" sec="1439010366"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="123.130.221.199" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010237"/>
        <to usec="0" sec="1439010238"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="222.129.189.217" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010194"/>
        <to usec="0" sec="1439010196"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="140.32.11.24" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010730"/>
        <to usec="0" sec="1439010733"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="211.83.248.215" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010075"/>
        <to usec="0" sec="1439010080"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="80.202.102.186" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010549"/>
        <to usec="0" sec="1439010556"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="130.99.0.202" proto="icmp"/>
        </slice>
        <from usec="0" sec="1439010568"/>
        <to usec="0" sec="1439010569"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="159.28.98.241"/>
        </slice>
        <from usec="0" sec="1439010084"/>
        <to usec="0" sec="1439010086"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.254.114.51"/>
        </slice>
        <from usec="0" sec="1439010116"/>
        <to usec="0" sec="1439010119"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="68.200.129.187"/>
        </slice>
        <from usec="0" sec="1439010125"/>
        <to usec="0" sec="1439010128"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="220.249.23.162" dst_ip="160.104.226.149" src_port="53628" dst_port="25"/>
        </slice>
        <from usec="0" sec="1439010088"/>
        <to usec="0" sec="1439010591"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,999,1 1 1 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="220.249.16.182" dst_ip="216.40.149.184"/>
            <filter src_ip="220.249.16.182" dst_ip="219.240.62.245"/>
        </slice>
        <from usec="0" sec="1439010014"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.64.191.24" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010036"/>
        <to usec="0" sec="1439010075"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="159.28.97.20" dst_ip="209.237.70.153" src_port="54899" dst_port="5110"/>
        </slice>
        <from usec="0" sec="1439010318"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="207.29.88.23" dst_ip="169.102.127.153" src_port="8080" dst_port="53599"/>
        </slice>
        <from usec="0" sec="1439010068"/>
        <to usec="0" sec="1439010086"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,503,1 1 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="221.6.143.200" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010041"/>
        <to usec="0" sec="1439010897"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="194.15.154.228" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1439010516"/>
        <to usec="0" sec="1439010524"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="60.172.221.236" dst_ip="160.111.201.101" src_port="80" dst_port="55237"/>
        </slice>
        <from usec="0" sec="1439010243"/>
        <to usec="0" sec="1439010245"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="43.178.206.238" dst_ip="176.149.67.174" src_port="443" dst_port="36168"/>
        </slice>
        <from usec="0" sec="1439010040"/>
        <to usec="0" sec="1439010041"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.21.89" dst_ip="83.15.176.74" src_port="52237" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010664"/>
        <to usec="0" sec="1439010734"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="159.28.97.51" dst_ip="44.40.213.229" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010003"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.157.9.17" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010068"/>
        <to usec="0" sec="1439010081"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.5.249" dst_ip="53.19.252.245" src_port="53301" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010668"/>
        <to usec="0" sec="1439010712"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="6.7.27.252" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010693"/>
        <to usec="0" sec="1439010704"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.4.255" dst_ip="218.190.240.131" src_port="55461" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010003"/>
        <to usec="0" sec="1439010378"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.98.246" dst_ip="46.254.211.222" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010635"/>
        <to usec="0" sec="1439010725"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.213.158.115" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010035"/>
        <to usec="0" sec="1439010047"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="211.188.222.138" dst_ip="169.102.120.54" src_port="80" dst_port="3117"/>
        </slice>
        <from usec="0" sec="1439010795"/>
        <to usec="0" sec="1439010796"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="176.134.239.196" dst_ip="214.159.101.195" src_port="39686" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010006"/>
        <to usec="0" sec="1439010009"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="40.41.44.209" dst_ip="221.15.10.199" src_port="80" dst_port="41128"/>
        </slice>
        <from usec="0" sec="1439010605"/>
        <to usec="0" sec="1439010606"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.98.209" dst_ip="155.194.169.19" src_port="50140" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010583"/>
        <to usec="0" sec="1439010633"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="176.149.66.76" dst_ip="203.118.241.252" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010148"/>
        <to usec="0" sec="1439010889"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="220.249.25.184" dst_port="80"/>
            <filter src_ip="220.249.25.184" dst_port="443"/>
            <filter src_ip="220.249.25.184" dst_port="53"/>
        </slice>
        <from usec="0" sec="1439010427"/>
        <to usec="0" sec="1439010889"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="181.190.130.3" dst_ip="75.128.40.170" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010027"/>
        <to usec="0" sec="1439010267"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="221.15.233.57" dst_ip="15.225.61.101" src_port="5041" dst_port="48760"/>
        </slice>
        <from usec="0" sec="1439010831"/>
        <to usec="0" sec="1439010886"/>
    </anomaly>
    <anomaly type="notice" value="1.008160,1.622080,504,1 1 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="221.15.248.126" dst_ip="101.127.85.179" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="1.180.153.237" dst_ip="221.15.13.208" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010358"/>
        <to usec="0" sec="1439010665"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.96.127" dst_ip="163.103.45.34" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010011"/>
        <to usec="0" sec="1439010795"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="42.224.59.40" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010080"/>
        <to usec="0" sec="1439010092"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.4.47.159" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010431"/>
        <to usec="0" sec="1439010442"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.62.12.126" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010435"/>
        <to usec="0" sec="1439010447"/>
    </anomaly>
    <anomaly type="notice" value="1.008160,1.622080,504,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="106.225.207.217" dst_port="443"/>
            <filter dst_ip="106.225.207.209" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="159.28.146.27" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010352"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.102.5.77" dst_ip="0.252.18.240" src_port="62527" dst_port="80"/>
            <filter src_ip="169.102.5.77" dst_ip="0.252.18.240" src_port="60880" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010230"/>
        <to usec="0" sec="1439010616"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="176.134.106.255" dst_ip="60.172.221.222" src_port="56586" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010018"/>
        <to usec="0" sec="1439010875"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="159.28.145.48" dst_port="80"/>
            <filter src_ip="159.28.145.48" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010309"/>
        <to usec="0" sec="1439010678"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.97.194" dst_ip="132.56.179.177" src_port="49544" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010190"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,504,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="39.230.234.0" dst_port="443"/>
            <filter dst_ip="39.230.234.0" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010082"/>
        <to usec="0" sec="1439010901"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="58.196.56.113" src_port="5062" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1439010827"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="207.57.213.141" dst_ip="159.28.70.228" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010022"/>
        <to usec="0" sec="1439010100"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.83.50.80" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010534"/>
        <to usec="0" sec="1439010551"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="81.215.63.58" src_port="12200" dst_port="8080"/>
            <filter src_ip="81.215.63.58" src_port="12200" dst_port="3128"/>
            <filter src_ip="81.215.63.58" src_port="12200" dst_port="21320"/>
        </slice>
        <from usec="0" sec="1439010677"/>
        <to usec="0" sec="1439010759"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="159.28.227.208" dst_ip="31.95.159.99" src_port="51248" dst_port="443"/>
            <filter src_ip="159.28.227.208" dst_ip="132.11.208.185" src_port="50721" dst_port="80"/>
            <filter src_ip="159.28.227.208" dst_ip="60.172.205.162" src_port="50751" dst_port="80"/>
            <filter src_ip="159.28.227.208" dst_ip="215.224.247.172" src_port="61339" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010006"/>
        <to usec="0" sec="1439010165"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="29.142.61.159" src_port="12200" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010449"/>
        <to usec="0" sec="1439010451"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.102.249.100" dst_ip="144.160.89.105" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010014"/>
        <to usec="0" sec="1439010580"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="159.28.211.84" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010004"/>
        <to usec="0" sec="1439010752"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="29.51.214.74" dst_ip="169.102.122.195" src_port="80" dst_port="43831"/>
        </slice>
        <from usec="0" sec="1439010154"/>
        <to usec="0" sec="1439010156"/>
    </anomaly>
    <anomaly type="notice" value="1.008160,1.622080,504,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="159.28.2.117" dst_port="443"/>
            <filter dst_ip="75.128.42.12" dst_port="443"/>
            <filter src_ip="159.28.2.117" dst_ip="75.128.42.12" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="132.74.59.104"/>
        </slice>
        <from usec="0" sec="1439010558"/>
        <to usec="0" sec="1439010562"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="160.111.203.166" src_port="80"/>
        </slice>
        <from usec="0" sec="1439010109"/>
        <to usec="0" sec="1439010110"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,504,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="42.87.119.193" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010035"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.705079,1.673060,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="220.249.16.42" dst_ip="220.249.16.42" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1439010001"/>
        <to usec="0" sec="1439010680"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.184.68.30" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010084"/>
        <to usec="0" sec="1439010100"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="52.204.16.113" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010054"/>
        <to usec="0" sec="1439010068"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,502,1 1 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="89.122.108.192" dst_port="22"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010887"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="132.25.191.21" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010068"/>
        <to usec="0" sec="1439010086"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.88.61.175" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010073"/>
        <to usec="0" sec="1439010086"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="142.5.62.169" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010009"/>
        <to usec="0" sec="1439010025"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="9.72.64.140" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010508"/>
        <to usec="0" sec="1439010515"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="12.28.179.63" dst_ip="221.15.13.208" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010046"/>
        <to usec="0" sec="1439010135"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.248.255.209" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010032"/>
        <to usec="0" sec="1439010044"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="148.196.255.41" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010039"/>
        <to usec="0" sec="1439010057"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,504,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="169.102.125.228" dst_port="443"/>
            <filter src_ip="169.102.125.228" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010139"/>
        <to usec="0" sec="1439010150"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="198.209.18.177" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010724"/>
        <to usec="0" sec="1439010745"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.94.3.246" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010003"/>
        <to usec="0" sec="1439010013"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.22.121.159" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010020"/>
        <to usec="0" sec="1439010030"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.99.160.170" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010024"/>
        <to usec="0" sec="1439010038"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.255.131.139" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="159.28.188.155" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010078"/>
        <to usec="0" sec="1439010877"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.185.83.150" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010083"/>
        <to usec="0" sec="1439010101"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="132.54.24.198" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010768"/>
        <to usec="0" sec="1439010793"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.164.138.185" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010780"/>
        <to usec="0" sec="1439010797"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,999,1 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="221.6.151.39" dst_ip="217.248.196.55"/>
        </slice>
        <from usec="0" sec="1439010377"/>
        <to usec="0" sec="1439010378"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="198.39.163.17" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="176.134.214.23" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010102"/>
        <to usec="0" sec="1439010708"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.46.41.23" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010043"/>
        <to usec="0" sec="1439010055"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.153.7.29" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010053"/>
        <to usec="0" sec="1439010073"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.125.107.195" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010028"/>
        <to usec="0" sec="1439010041"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="181.164.119.88" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010004"/>
        <to usec="0" sec="1439010015"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="182.69.70.211" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010030"/>
        <to usec="0" sec="1439010042"/>
    </anomaly>
    <anomaly type="notice" value="0.705079,1.673060,504,0 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="220.249.20.176"/>
        </slice>
        <from usec="0" sec="1439010851"/>
        <to usec="0" sec="1439010853"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="6.110.184.252" dst_ip="220.249.29.210" dst_port="53"/>
        </slice>
        <from usec="0" sec="1439010022"/>
        <to usec="0" sec="1439010505"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="123.131.214.39" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010081"/>
        <to usec="0" sec="1439010106"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.14.249.157" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010004"/>
        <to usec="0" sec="1439010017"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.22.247.163" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010023"/>
        <to usec="0" sec="1439010036"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.107.166.52" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010003"/>
        <to usec="0" sec="1439010015"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="129.241.62.221" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010126"/>
        <to usec="0" sec="1439010150"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.116.191.5" src_port="12200" dst_port="37564"/>
        </slice>
        <from usec="0" sec="1439010365"/>
        <to usec="0" sec="1439010898"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.153.231.152" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010716"/>
        <to usec="0" sec="1439010793"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.23.249.45" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010228"/>
        <to usec="0" sec="1439010241"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.183.83.186" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010043"/>
        <to usec="0" sec="1439010059"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="25.82.147.54" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010418"/>
        <to usec="0" sec="1439010430"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.7.231.71" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010652"/>
        <to usec="0" sec="1439010665"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.38.240.28" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010250"/>
        <to usec="0" sec="1439010261"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.79.232.66" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010861"/>
        <to usec="0" sec="1439010868"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.135.114.202" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010204"/>
        <to usec="0" sec="1439010215"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="63.117.76.223" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010267"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="220.196.44.64" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010617"/>
        <to usec="0" sec="1439010645"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.168.172.198" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010665"/>
        <to usec="0" sec="1439010678"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.191.197.200" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010688"/>
        <to usec="0" sec="1439010694"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="26.54.90.80" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010658"/>
        <to usec="0" sec="1439010670"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.179.181.204" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010661"/>
        <to usec="0" sec="1439010673"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="118.50.24.25" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010717"/>
        <to usec="0" sec="1439010730"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.91.64.138" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010744"/>
        <to usec="0" sec="1439010756"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.190.141.92" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010256"/>
        <to usec="0" sec="1439010267"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.46.194.59" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010695"/>
        <to usec="0" sec="1439010699"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="219.105.61.115" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010434"/>
        <to usec="0" sec="1439010463"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="23.168.5.161" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.237.157.42" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010363"/>
        <to usec="0" sec="1439010373"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="217.140.80.44" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010242"/>
        <to usec="0" sec="1439010250"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.37.177.255" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010001"/>
        <to usec="0" sec="1439010011"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.70.189.125" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010165"/>
        <to usec="0" sec="1439010178"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.235.69.238" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010384"/>
        <to usec="0" sec="1439010401"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="130.50.176.78" dst_port="139"/>
            <filter src_ip="130.50.176.78" dst_port="445"/>
        </slice>
        <from usec="0" sec="1439010561"/>
        <to usec="0" sec="1439010593"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.56.103.217" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010765"/>
        <to usec="0" sec="1439010783"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="68.4.177.232" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010432"/>
        <to usec="0" sec="1439010436"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.88.175.72" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010243"/>
        <to usec="0" sec="1439010250"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.197.137.115" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010615"/>
        <to usec="0" sec="1439010622"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.80.105.174" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010697"/>
        <to usec="0" sec="1439010712"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.220.250.12" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010173"/>
        <to usec="0" sec="1439010190"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.0.2.167" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010142"/>
        <to usec="0" sec="1439010154"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="62.98.220.80" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010009"/>
        <to usec="0" sec="1439010034"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.125.41.193" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010652"/>
        <to usec="0" sec="1439010688"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.54.255.18" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.153.195.19" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.144.250.81" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="144.195.165.76" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010840"/>
        <to usec="0" sec="1439010853"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.159.231.125" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010014"/>
        <to usec="0" sec="1439010027"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="3.76.245.210" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="157.255.196.74" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010495"/>
        <to usec="0" sec="1439010506"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.197.193.103" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010741"/>
        <to usec="0" sec="1439010748"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.101.116.233" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010839"/>
        <to usec="0" sec="1439010857"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.17.146.6" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="151.227.192.79" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010131"/>
        <to usec="0" sec="1439010142"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="144.230.165.150" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010411"/>
        <to usec="0" sec="1439010435"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.77.37.197" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010131"/>
        <to usec="0" sec="1439010138"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.48.1.234" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010867"/>
        <to usec="0" sec="1439010879"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.252.215.228" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010891"/>
        <to usec="0" sec="1439010901"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.153.160.197" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010715"/>
        <to usec="0" sec="1439010726"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.42.99.135" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010786"/>
        <to usec="0" sec="1439010797"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.147.57.121" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010886"/>
        <to usec="0" sec="1439010901"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.245.234.96" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010493"/>
        <to usec="0" sec="1439010509"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.57.220.132" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010860"/>
        <to usec="0" sec="1439010865"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.18.243.237" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010603"/>
        <to usec="0" sec="1439010620"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.5.38.197" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010372"/>
        <to usec="0" sec="1439010384"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.43.24.110" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010547"/>
        <to usec="0" sec="1439010557"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.98.199.106" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010440"/>
        <to usec="0" sec="1439010451"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.129.79.132" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010688"/>
        <to usec="0" sec="1439010690"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="49.145.3.254" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010445"/>
        <to usec="0" sec="1439010456"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.155.204.134" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010457"/>
        <to usec="0" sec="1439010459"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.47.151.149" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010116"/>
        <to usec="0" sec="1439010138"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="62.37.70.31" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010207"/>
        <to usec="0" sec="1439010225"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.160.168.42" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010664"/>
        <to usec="0" sec="1439010686"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="13.203.198.4" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010087"/>
        <to usec="0" sec="1439010102"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.213.75.58" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010886"/>
        <to usec="0" sec="1439010896"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.1.251.79" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010841"/>
        <to usec="0" sec="1439010853"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.5.144.83" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010089"/>
        <to usec="0" sec="1439010107"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.153.115.182" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010841"/>
        <to usec="0" sec="1439010864"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.55.23.213" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010795"/>
        <to usec="0" sec="1439010813"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.241.96.101" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010799"/>
        <to usec="0" sec="1439010813"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.191.39.180" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010603"/>
        <to usec="0" sec="1439010615"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="68.26.75.202" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010656"/>
        <to usec="0" sec="1439010667"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="46.120.37.209" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010769"/>
        <to usec="0" sec="1439010785"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.31.40.131" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010103"/>
        <to usec="0" sec="1439010113"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="63.178.47.137" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010015"/>
        <to usec="0" sec="1439010032"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.179.141.65" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="118.173.102.209" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010224"/>
        <to usec="0" sec="1439010244"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.101.24.205" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010368"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.178.197.204" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010220"/>
        <to usec="0" sec="1439010239"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.82.29.234" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010719"/>
        <to usec="0" sec="1439010731"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.52.34.243" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010398"/>
        <to usec="0" sec="1439010414"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="123.131.97.235" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010438"/>
        <to usec="0" sec="1439010448"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="66.101.222.33" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.155.233.10" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010076"/>
        <to usec="0" sec="1439010092"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.185.253.82" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010065"/>
        <to usec="0" sec="1439010069"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="3.241.82.23" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010863"/>
        <to usec="0" sec="1439010866"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.79.138.239" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010548"/>
        <to usec="0" sec="1439010549"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="49.128.80.2" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010370"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="68.83.214.154" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010705"/>
        <to usec="0" sec="1439010718"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.226.252.139" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010579"/>
        <to usec="0" sec="1439010609"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.68.95.24" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010214"/>
        <to usec="0" sec="1439010216"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.179.137.158" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010191"/>
        <to usec="0" sec="1439010202"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.114.79.195" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010885"/>
        <to usec="0" sec="1439010899"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="190.144.4.166" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010597"/>
        <to usec="0" sec="1439010609"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="40.178.198.96" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010572"/>
        <to usec="0" sec="1439010587"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.181.111.251" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.144.21.142" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010619"/>
        <to usec="0" sec="1439010630"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="48.242.5.242" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010364"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.129.66.180" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.23.70.172" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010845"/>
        <to usec="0" sec="1439010855"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.98.198.184" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.154.113.157" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010191"/>
        <to usec="0" sec="1439010198"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="13.171.127.48" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.63.242.182" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010095"/>
        <to usec="0" sec="1439010108"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="62.105.105.78" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="144.78.130.86" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010657"/>
        <to usec="0" sec="1439010672"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.55.192.165" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="45.37.149.21" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010653"/>
        <to usec="0" sec="1439010662"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.176.44.32" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010552"/>
        <to usec="0" sec="1439010566"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="63.178.130.196" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010796"/>
        <to usec="0" sec="1439010808"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="142.251.180.240" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="2.182.6.76" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010669"/>
        <to usec="0" sec="1439010696"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="208.209.128.82" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010790"/>
        <to usec="0" sec="1439010808"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="48.242.5.15" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="144.87.160.57" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010802"/>
        <to usec="0" sec="1439010813"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.1.101.88" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010113"/>
        <to usec="0" sec="1439010124"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="35.185.99.90" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.138.167.234" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010206"/>
        <to usec="0" sec="1439010448"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="42.223.183.187" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010154"/>
        <to usec="0" sec="1439010156"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.9.6.186" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.38.60.199" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010684"/>
        <to usec="0" sec="1439010706"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.132.173.59" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.177.230.48" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010265"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="36.115.150.243" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010575"/>
        <to usec="0" sec="1439010586"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="57.4.103.137" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010020"/>
        <to usec="0" sec="1439010034"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.153.120.220" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010237"/>
        <to usec="0" sec="1439010245"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.191.11.34" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010376"/>
        <to usec="0" sec="1439010400"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="163.166.72.132" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010398"/>
        <to usec="0" sec="1439010400"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.217.17.140" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="209.86.220.24" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010554"/>
        <to usec="0" sec="1439010680"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="108.213.188.242" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010568"/>
        <to usec="0" sec="1439010571"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.136.144.61" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010660"/>
        <to usec="0" sec="1439010675"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.139.108.114" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010101"/>
        <to usec="0" sec="1439010109"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.87.54.60" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010097"/>
        <to usec="0" sec="1439010113"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="134.93.162.147" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010451"/>
        <to usec="0" sec="1439010463"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="66.228.243.27" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010712"/>
        <to usec="0" sec="1439010724"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.131.19.132" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010665"/>
        <to usec="0" sec="1439010688"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.249.87.60" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="27.147.114.141" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010130"/>
        <to usec="0" sec="1439010146"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.40.37.197" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010832"/>
        <to usec="0" sec="1439010835"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.157.60.205" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010702"/>
        <to usec="0" sec="1439010715"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.29.23.119" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="196.232.211.182" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.68.243.155" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010437"/>
        <to usec="0" sec="1439010448"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="17.167.122.156" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010265"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,502,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="54.76.10.147" dst_port="22"/>
        </slice>
        <from usec="0" sec="1439010516"/>
        <to usec="0" sec="1439010589"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="118.235.196.236" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010789"/>
        <to usec="0" sec="1439010815"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="65.174.131.248" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.117.98.181" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010025"/>
        <to usec="0" sec="1439010045"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.9.43.8" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.40.47.90" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010793"/>
        <to usec="0" sec="1439010808"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.47.38.228" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010154"/>
        <to usec="0" sec="1439010165"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.54.193.252" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010058"/>
        <to usec="0" sec="1439010081"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.176.188.247" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010134"/>
        <to usec="0" sec="1439010150"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="69.227.220.11" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010368"/>
        <to usec="0" sec="1439010379"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="49.14.242.228" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010005"/>
        <to usec="0" sec="1439010021"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.78.143.49" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010231"/>
        <to usec="0" sec="1439010253"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.27.80.185" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010827"/>
        <to usec="0" sec="1439010854"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="7.84.32.47" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010441"/>
        <to usec="0" sec="1439010452"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="108.180.177.75" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010671"/>
        <to usec="0" sec="1439010675"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="7.84.113.255" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010582"/>
        <to usec="0" sec="1439010598"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="69.148.87.59" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010162"/>
        <to usec="0" sec="1439010175"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.46.173.252" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010714"/>
        <to usec="0" sec="1439010727"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="8.152.57.208" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010765"/>
        <to usec="0" sec="1439010785"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.238.231.136" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010146"/>
        <to usec="0" sec="1439010163"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.44.71.85" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010142"/>
        <to usec="0" sec="1439010145"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="7.84.250.253" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010366"/>
        <to usec="0" sec="1439010377"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.174.131.191" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010214"/>
        <to usec="0" sec="1439010225"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.88.191.78" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010161"/>
        <to usec="0" sec="1439010177"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="51.13.175.53" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010110"/>
        <to usec="0" sec="1439010135"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.108.27.44" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010204"/>
        <to usec="0" sec="1439010214"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.181.73.240" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010617"/>
        <to usec="0" sec="1439010623"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.177.229.200" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010869"/>
        <to usec="0" sec="1439010880"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.81.148.189" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010626"/>
        <to usec="0" sec="1439010627"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.7.220.250" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010842"/>
        <to usec="0" sec="1439010853"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.59.206.90" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010430"/>
        <to usec="0" sec="1439010442"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.221.74.83" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.214.1.157" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010763"/>
        <to usec="0" sec="1439010775"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.5.15.10" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010760"/>
        <to usec="0" sec="1439010772"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="13.171.123.199" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010733"/>
        <to usec="0" sec="1439010745"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.177.225.31" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010318"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="194.76.21.90" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010367"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="30.28.226.33" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010670"/>
        <to usec="0" sec="1439010682"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.73.5.88" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010432"/>
        <to usec="0" sec="1439010447"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="9.72.122.122" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010249"/>
        <to usec="0" sec="1439010260"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.111.133.134" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010054"/>
        <to usec="0" sec="1439010071"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="9.24.31.185" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010235"/>
        <to usec="0" sec="1439010247"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.9.36.180" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010149"/>
        <to usec="0" sec="1439010174"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.111.102.191" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010673"/>
        <to usec="0" sec="1439010686"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.166.19.56" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010434"/>
        <to usec="0" sec="1439010439"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.185.208.254" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010694"/>
        <to usec="0" sec="1439010705"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="6.141.230.107" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010824"/>
        <to usec="0" sec="1439010838"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.249.203.242" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010133"/>
        <to usec="0" sec="1439010145"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.47.44.134" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010749"/>
        <to usec="0" sec="1439010752"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.83.35.4" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010777"/>
        <to usec="0" sec="1439010789"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.228.213.190" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010592"/>
        <to usec="0" sec="1439010614"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.59.72.228" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010034"/>
        <to usec="0" sec="1439010040"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="81.44.104.199" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010246"/>
        <to usec="0" sec="1439010259"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.1.214.150" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010864"/>
        <to usec="0" sec="1439010876"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="11.136.223.76" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010362"/>
        <to usec="0" sec="1439010373"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.83.106.16" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010748"/>
        <to usec="0" sec="1439010765"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="3.99.48.61" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010043"/>
        <to usec="0" sec="1439010059"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.99.0.202" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010568"/>
        <to usec="0" sec="1439010575"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.21.234.223" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010361"/>
        <to usec="0" sec="1439010372"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,020,1 1 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="160.34.229.9"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010557"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.99.0.204" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010794"/>
        <to usec="0" sec="1439010806"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="47.212.91.91" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010014"/>
        <to usec="0" sec="1439010017"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.91.33.117" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010724"/>
        <to usec="0" sec="1439010741"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.179.246.157" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010374"/>
        <to usec="0" sec="1439010387"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="61.115.107.225" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010566"/>
        <to usec="0" sec="1439010589"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="138.126.51.142" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010147"/>
        <to usec="0" sec="1439010164"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.255.151.204" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010688"/>
        <to usec="0" sec="1439010692"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.175.223.17" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010215"/>
        <to usec="0" sec="1439010217"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="62.95.167.132" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010681"/>
        <to usec="0" sec="1439010699"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="27.147.104.112" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010368"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.153.247.17" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.56.84.215" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010572"/>
        <to usec="0" sec="1439010577"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="51.102.21.69" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010581"/>
        <to usec="0" sec="1439010594"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="223.183.188.229" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010362"/>
        <to usec="0" sec="1439010375"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.124.85.98" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010011"/>
        <to usec="0" sec="1439010030"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="54.20.249.77" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010641"/>
        <to usec="0" sec="1439010662"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.175.223.15" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.231.188.229" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010128"/>
        <to usec="0" sec="1439010151"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.49.27.101" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.117.46.186" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010681"/>
        <to usec="0" sec="1439010694"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="9.72.42.208" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.5.198.72" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010126"/>
        <to usec="0" sec="1439010138"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="50.49.237.139"/>
        </slice>
        <from usec="0" sec="1439010473"/>
        <to usec="0" sec="1439010485"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="80.186.217.15"/>
        </slice>
        <from usec="0" sec="1439010868"/>
        <to usec="0" sec="1439010870"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="1.46.194.59"/>
        </slice>
        <from usec="0" sec="1439010695"/>
        <to usec="0" sec="1439010698"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="139.125.41.193"/>
        </slice>
        <from usec="0" sec="1439010652"/>
        <to usec="0" sec="1439010688"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="144.230.165.150"/>
        </slice>
        <from usec="0" sec="1439010404"/>
        <to usec="0" sec="1439010427"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="59.57.220.132"/>
        </slice>
        <from usec="0" sec="1439010860"/>
        <to usec="0" sec="1439010865"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="2.196.252.211"/>
        </slice>
        <from usec="0" sec="1439010748"/>
        <to usec="0" sec="1439010750"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="199.7.221.109"/>
        </slice>
        <from usec="0" sec="1439010202"/>
        <to usec="0" sec="1439010204"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="55.79.138.239"/>
        </slice>
        <from usec="0" sec="1439010546"/>
        <to usec="0" sec="1439010549"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="62.105.105.78"/>
        </slice>
        <from usec="0" sec="1439010283"/>
        <to usec="0" sec="1439010288"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="57.4.103.137"/>
        </slice>
        <from usec="0" sec="1439010020"/>
        <to usec="0" sec="1439010034"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="108.213.188.242"/>
        </slice>
        <from usec="0" sec="1439010569"/>
        <to usec="0" sec="1439010570"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="134.93.162.147"/>
        </slice>
        <from usec="0" sec="1439010452"/>
        <to usec="0" sec="1439010462"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="138.232.70.243"/>
        </slice>
        <from usec="0" sec="1439010476"/>
        <to usec="0" sec="1439010485"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="14.169.181.189"/>
        </slice>
        <from usec="0" sec="1439010887"/>
        <to usec="0" sec="1439010889"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="108.180.177.75"/>
        </slice>
        <from usec="0" sec="1439010671"/>
        <to usec="0" sec="1439010673"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="135.111.102.191"/>
        </slice>
        <from usec="0" sec="1439010673"/>
        <to usec="0" sec="1439010686"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="50.59.72.228"/>
        </slice>
        <from usec="0" sec="1439010038"/>
        <to usec="0" sec="1439010040"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="3.29.173.138"/>
        </slice>
        <from usec="0" sec="1439010514"/>
        <to usec="0" sec="1439010516"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="47.212.91.91"/>
        </slice>
        <from usec="0" sec="1439010014"/>
        <to usec="0" sec="1439010017"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="44.62.165.187"/>
        </slice>
        <from usec="0" sec="1439010396"/>
        <to usec="0" sec="1439010397"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="222.175.223.17"/>
        </slice>
        <from usec="0" sec="1439010215"/>
        <to usec="0" sec="1439010217"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="202.121.145.171"/>
        </slice>
        <from usec="0" sec="1439010875"/>
        <to usec="0" sec="1439010881"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="1.49.27.101"/>
        </slice>
        <from usec="0" sec="1439010324"/>
        <to usec="0" sec="1439010325"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="56.153.231.152"/>
        </slice>
        <from usec="0" sec="1439010717"/>
        <to usec="0" sec="1439010724"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,011,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="194.15.154.228" src_port="3389"/>
        </slice>
        <from usec="0" sec="1439010777"/>
        <to usec="0" sec="1439010778"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="91.112.3.6"/>
        </slice>
        <from usec="0" sec="1439010787"/>
        <to usec="0" sec="1439010789"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="21.243.139.190"/>
        </slice>
        <from usec="0" sec="1439010640"/>
        <to usec="0" sec="1439010642"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="217.140.80.44"/>
        </slice>
        <from usec="0" sec="1439010242"/>
        <to usec="0" sec="1439010249"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="222.197.193.103"/>
        </slice>
        <from usec="0" sec="1439010741"/>
        <to usec="0" sec="1439010748"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="141.99.160.170"/>
        </slice>
        <from usec="0" sec="1439010026"/>
        <to usec="0" sec="1439010037"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="2.193.79.233"/>
        </slice>
        <from usec="0" sec="1439010351"/>
        <to usec="0" sec="1439010353"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="44.81.148.189"/>
        </slice>
        <from usec="0" sec="1439010626"/>
        <to usec="0" sec="1439010627"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="68.4.177.232"/>
        </slice>
        <from usec="0" sec="1439010432"/>
        <to usec="0" sec="1439010436"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="206.155.204.134"/>
        </slice>
        <from usec="0" sec="1439010460"/>
        <to usec="0" sec="1439010461"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="13.203.198.4"/>
        </slice>
        <from usec="0" sec="1439010087"/>
        <to usec="0" sec="1439010098"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="143.68.95.24"/>
        </slice>
        <from usec="0" sec="1439010214"/>
        <to usec="0" sec="1439010216"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="65.218.182.181"/>
        </slice>
        <from usec="0" sec="1439010540"/>
        <to usec="0" sec="1439010548"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="1.40.37.197"/>
        </slice>
        <from usec="0" sec="1439010831"/>
        <to usec="0" sec="1439010834"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="50.56.146.103"/>
        </slice>
        <from usec="0" sec="1439010528"/>
        <to usec="0" sec="1439010533"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="112.134.122.244"/>
        </slice>
        <from usec="0" sec="1439010872"/>
        <to usec="0" sec="1439010881"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="50.47.44.134"/>
        </slice>
        <from usec="0" sec="1439010749"/>
        <to usec="0" sec="1439010752"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="44.255.151.204"/>
        </slice>
        <from usec="0" sec="1439010688"/>
        <to usec="0" sec="1439010692"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="59.56.84.215"/>
        </slice>
        <from usec="0" sec="1439010572"/>
        <to usec="0" sec="1439010576"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="222.175.223.15"/>
        </slice>
        <from usec="0" sec="1439010353"/>
        <to usec="0" sec="1439010355"/>
    </anomaly>
    <anomaly type="notice" value="0.489959,1.636270,504,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="181.190.191.135" dst_ip="75.130.125.239" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010796"/>
        <to usec="0" sec="1439010799"/>
    </anomaly>
    <anomaly type="notice" value="1.005670,1.723850,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.142.198.130" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="62.107.62.64"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="62.107.62.65"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,ttl_error">
        <slice>
            <filter src_ip="220.121.177.48"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,504,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="159.28.96.58"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.49.61.79"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="144.62.114.122"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,020,1 1 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="160.34.228.114"/>
        </slice>
        <from usec="0" sec="1439010225"/>
        <to usec="0" sec="1439010494"/>
    </anomaly>
    <anomaly type="notice" value="0.358230,1.633200,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="63.211.56.251" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010210"/>
        <to usec="0" sec="1439010225"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="220.249.16.100"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,504,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="75.128.47.170" src_port="443"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.249.27.156" dst_port="53"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.134.150.210" dst_port="53"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="159.28.229.235" dst_port="53"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,503,1 1 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="159.28.23.90" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010060"/>
        <to usec="0" sec="1439010843"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,503,0 0 0 0 0 0 1 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="96.224.28.81" src_port="80"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.69.200.101" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,011,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="1.91.194.28" src_port="8445"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="148.229.230.92" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="13.220.245.105" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010318"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="28.79.202.187" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,010,1 1 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="117.171.242.127" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="79.12.120.125" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.91.148.17" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,503,1 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="176.134.64.189" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010379"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.177.126.145" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.134.150.165" src_port="53"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="176.134.150.166" src_port="25"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,503,0 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="33.120.96.84" src_port="80"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="44.5.127.224" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.73.187.197" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010263"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="2.181.159.12" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="8.225.253.129" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="207.58.156.43" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.91.38.156" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010317"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,503,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="75.128.42.51"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="176.134.146.247"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.730466,1.663250,503,1 1 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="220.249.24.62" src_port="80"/>
            <filter src_ip="220.249.24.62" dst_port="443"/>
        </slice>
        <from usec="0" sec="1439010151"/>
        <to usec="0" sec="1439010778"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,012,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="220.249.24.63" src_port="80"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="53.27.107.43" dst_port="8080"/>
            <filter src_ip="53.27.107.43" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,503,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="176.134.71.252"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="181.190.198.188"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="197.3.236.166" dst_ip="160.111.178.100" src_port="53"/>
            <filter src_ip="197.3.236.166" dst_ip="160.111.129.109" src_port="53"/>
            <filter src_ip="197.3.236.166" dst_ip="160.111.130.47" src_port="53"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.134.55.233" src_port="15585"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="197.3.236.167" dst_ip="160.111.178.100" src_port="53"/>
            <filter src_ip="197.3.236.167" dst_ip="160.111.129.109" src_port="53"/>
            <filter src_ip="197.3.236.167" dst_ip="160.111.130.47" src_port="53"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.249.13.145"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="221.15.234.22"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="158.155.37.25" dst_port="3128"/>
            <filter src_ip="158.155.37.25" dst_port="21320"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="51.20.106.15"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="220.249.20.93"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="221.6.142.59" src_port="53"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="160.34.151.54"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="77.108.9.13" src_port="34680"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="128.105.133.200" src_port="34680"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.196.26.206"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="128.105.133.201" src_port="53384"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="160.34.151.43"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="58.205.227.175" src_port="3389"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="61.145.254.85" src_port="443"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="48.247.99.199"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="48.75.86.110"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.134.162.30" src_port="27518"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="215.4.165.43" src_port="34680"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.49.61.79"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="26.10.36.19" dst_port="123"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="58.196.98.157"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.249.13.208" src_port="53"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="215.4.165.4" src_port="34680"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="54.76.3.40" src_port="53707" dst_port="1628"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,503,0 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="33.120.96.166"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="215.4.166.134"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="160.34.228.98"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.28.54.157" src_port="37708" dst_port="8880"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="12.181.108.28" dst_ip="160.111.91.42" src_port="80"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.28.54.148" src_port="49782" dst_port="2083"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.28.54.150" src_port="60371" dst_port="2222"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="35.202.136.169" src_port="34680"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="219.234.120.63" src_port="49699" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="77.108.168.49" src_port="80"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="39.207.145.211" src_port="34680"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="35.202.173.46" src_port="34680"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="194.63.163.59"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="160.34.150.73"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="215.8.94.28"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="160.34.150.83"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.134.138.46" src_port="6881"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="51.20.108.153" src_port="54070"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="159.28.146.123" src_port="19498" dst_port="17788"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="35.202.174.42"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="50.244.70.219" src_port="3212"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="220.249.21.206"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="197.76.120.41"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="133.95.105.228" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="210.114.225.171" src_port="9265"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="215.8.111.143" src_port="41147"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.34.228.98" dst_port="54756"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.134.149.47" dst_port="53"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="176.134.149.40" dst_port="53"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="17.101.236.128" src_port="41590" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="159.28.229.193" dst_port="53"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.68.89.55" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="220.249.17.180" dst_ip="200.28.165.144" dst_port="53"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.213.27.10" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.28.54.158" src_port="26600" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.28.54.156" src_port="32951" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.28.54.149" src_port="3714" dst_port="22"/>
        </slice>
        <from usec="0" sec="1439010271"/>
        <to usec="0" sec="1439010587"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.44.250.75" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="27.178.156.203" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="66.212.12.141" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.153.213.2" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.649500,1.660230,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.208.66.1" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="60.213.231.93" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="6.103.88.247" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="2.183.253.122" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="50.41.113.33" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010316"/>
        <to usec="0" sec="1439010362"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,dntscSYN">
        <slice>
            <filter src_port="12200" dst_port="80"/>
        </slice>
        <from usec="0" sec="1439010361"/>
        <to usec="0" sec="1439010407"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="11.238.135.188"/>
        </slice>
        <from usec="0" sec="1439010451"/>
        <to usec="0" sec="1439010497"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="29.142.61.159"/>
        </slice>
        <from usec="0" sec="1439010451"/>
        <to usec="0" sec="1439010497"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="160.111.119.253"/>
        </slice>
        <from usec="0" sec="1439010451"/>
        <to usec="0" sec="1439010497"/>
    </anomaly>
    <anomaly type="notice" value="0.823970,1.696500,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="158.147.156.44" src_port="44733" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1439010631"/>
        <to usec="0" sec="1439010677"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="23.161.138.103"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="26.253.36.93"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,999,0 0 0 0 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="4.246.144.73"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,504,0 0 0 0 0 0 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="181.190.31.13"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.951130,1.618980,503,1 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="181.190.99.251" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,502,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="181.190.62.120" dst_ip="92.190.54.230" src_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="187.85.103.117" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="101.127.103.1"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.951130,1.618980,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="132.56.179.177" dst_ip="159.28.97.194" src_port="80" dst_port="49544"/>
            <filter src_ip="132.56.179.177" dst_ip="159.28.97.194" src_port="80" dst_port="49543"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,999,0 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="220.249.21.139"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="201.192.145.21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="96.237.148.164"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="39.64.17.247"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,503,0 0 0 0 0 0 0 0 0 1 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="125.249.180.28"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,503,0 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="53.19.252.177"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,010,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="176.157.224.187" dst_port="50356"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="160.111.204.29" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="160.111.200.129"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="160.111.242.148" dst_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="160.111.245.139" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.102.122.199"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.951130,1.618980,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="159.28.146.142" dst_ip="159.109.77.226" src_port="49492" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,504,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="159.28.97.112" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,999,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="159.28.96.0" dst_port="61079"/>
            <filter src_ip="0.155.245.55" dst_ip="159.28.96.0" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.249.23.153" src_port="123" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.008160,1.622080,504,1 1 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="159.28.41.34" dst_ip="203.118.244.20" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="1.077830,1.656150,502,0 0 0 0 0 0 0 0 0 1 0 0,mptpla">
        <slice>
            <filter dst_ip="72.47.42.203"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.847259,1.697830,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.5.15.215" dst_port="23"/>
        </slice>
        <from usec="0" sec="1439010154"/>
        <to usec="0" sec="1439010165"/>
    </anomaly>
</admd:annotation>
