<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="187.161.91.213" dst_ip="75.68.227.116" src_port="19784" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218013"/>
        <to usec="0" sec="1447218059"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="143.4.132.182"/>
        </slice>
        <from usec="0" sec="1447218726"/>
        <to usec="0" sec="1447218729"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="4.56.111.49" dst_ip="221.80.186.187" src_port="443" dst_port="52103" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218058"/>
        <to usec="0" sec="1447218059"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.35.44.235"/>
        </slice>
        <from usec="0" sec="1447218405"/>
        <to usec="0" sec="1447218506"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="25.145.110.57" dst_ip="161.56.69.234" src_port="36278" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218839"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="100.106.200.222" dst_ip="158.153.143.131" src_port="30611" dst_port="40862" proto="udp"/>
        </slice>
        <from usec="0" sec="1447218763"/>
        <to usec="0" sec="1447218765"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="206.199.248.73" dst_ip="169.46.93.82" src_port="80" dst_port="57350" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218859"/>
        <to usec="0" sec="1447218860"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="191.49.112.35"/>
        </slice>
        <from usec="0" sec="1447218012"/>
        <to usec="0" sec="1447218014"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.125.171" dst_ip="142.172.186.169" src_port="58375" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218290"/>
        <to usec="0" sec="1447218292"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="92.203.19.69" dst_ip="169.46.196.78" src_port="80" dst_port="60730" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218418"/>
        <to usec="0" sec="1447218419"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="191.49.105.180"/>
        </slice>
        <from usec="0" sec="1447218200"/>
        <to usec="0" sec="1447218208"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="191.49.118.59" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218507"/>
        <to usec="0" sec="1447218864"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="4.204.234.242" dst_ip="169.46.93.91" src_port="80" dst_port="52792" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218834"/>
        <to usec="0" sec="1447218838"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="202.67.163.78" dst_ip="221.80.177.2" src_port="1935" dst_port="50747" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218183"/>
        <to usec="0" sec="1447218185"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="79.121.31.177" dst_ip="221.80.172.254" src_port="53411" dst_port="37389" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218856"/>
        <to usec="0" sec="1447218866"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="191.49.110.129"/>
        </slice>
        <from usec="0" sec="1447218206"/>
        <to usec="0" sec="1447218323"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="193.216.206.109" dst_ip="158.153.115.227" src_port="80" dst_port="35272" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218079"/>
        <to usec="0" sec="1447218080"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="191.49.118.12" dst_ip="13.104.162.175" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218828"/>
        <to usec="0" sec="1447218834"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="191.49.114.179" dst_ip="137.34.164.216" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218112"/>
        <to usec="0" sec="1447218813"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="220.240.69.76"/>
        </slice>
        <from usec="0" sec="1447218886"/>
        <to usec="0" sec="1447218900"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="201.17.0.231" dst_ip="221.80.70.43" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218724"/>
        <to usec="0" sec="1447218726"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.77.123" dst_ip="78.51.233.33" src_port="57188" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218655"/>
        <to usec="0" sec="1447218802"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="36.44.166.41"/>
        </slice>
        <from usec="0" sec="1447218858"/>
        <to usec="0" sec="1447218865"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="42.245.115.111" dst_ip="191.49.122.17" src_port="80" dst_port="49317" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218834"/>
        <to usec="0" sec="1447218835"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="158.153.142.58" dst_ip="199.146.44.228"/>
        </slice>
        <from usec="0" sec="1447218566"/>
        <to usec="0" sec="1447218664"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="158.153.143.24" dst_ip="34.45.175.25" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218234"/>
        <to usec="0" sec="1447218237"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="154.88.175.192" dst_ip="158.153.38.106" src_port="80" dst_port="55851" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218422"/>
        <to usec="0" sec="1447218882"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="70.46.83.207" dst_ip="186.255.65.146" src_port="443" dst_port="52638" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218745"/>
        <to usec="0" sec="1447218833"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="221.80.67.223" dst_ip="112.231.129.157" src_port="52515" dst_port="47101" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218684"/>
        <to usec="0" sec="1447218747"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="57.93.229.141" dst_ip="221.80.168.127" src_port="443" dst_port="49912" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218274"/>
        <to usec="0" sec="1447218802"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="169.46.11.61" dst_ip="202.124.100.66" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218723"/>
        <to usec="0" sec="1447218870"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.219.223.166" dst_ip="161.56.33.139" src_port="80" dst_port="35542" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218052"/>
        <to usec="0" sec="1447218900"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="34.32.179.221" dst_ip="169.46.54.91" src_port="443" dst_port="53894" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218695"/>
        <to usec="0" sec="1447218697"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="96.192.60.177" dst_ip="221.80.168.255" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218770"/>
        <to usec="0" sec="1447218771"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="42.216.159.21" dst_ip="220.240.74.61" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218787"/>
        <to usec="0" sec="1447218789"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="191.49.31.63" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218751"/>
        <to usec="0" sec="1447218756"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="143.103.172.136" dst_ip="158.153.115.215" src_port="443" dst_port="56801" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218023"/>
        <to usec="0" sec="1447218701"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="189.1.97.236"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218897"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="220.195.12.233" dst_ip="161.56.164.176" src_port="80" dst_port="52784" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218626"/>
        <to usec="0" sec="1447218627"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="154.88.175.167" dst_ip="158.153.113.226" src_port="80" dst_port="49299" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218799"/>
        <to usec="0" sec="1447218871"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="131.81.8.50" dst_ip="161.56.32.231" src_port="443" dst_port="49371" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218695"/>
        <to usec="0" sec="1447218707"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="158.153.140.133" dst_ip="103.10.197.140" src_port="52703" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218356"/>
        <to usec="0" sec="1447218358"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="221.80.172.126" dst_ip="114.129.126.52" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218594"/>
        <to usec="0" sec="1447218655"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="191.49.60.207"/>
        </slice>
        <from usec="0" sec="1447218722"/>
        <to usec="0" sec="1447218724"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="210.163.84.39" dst_ip="221.80.65.14" src_port="443" dst_port="58262" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218094"/>
        <to usec="0" sec="1447218095"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="220.195.12.193" dst_ip="161.56.33.156" src_port="80" dst_port="55061" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218833"/>
        <to usec="0" sec="1447218900"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="154.88.175.143" dst_ip="161.56.114.231" src_port="80" dst_port="1135" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218133"/>
        <to usec="0" sec="1447218895"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="220.195.12.195" dst_ip="161.56.165.134" src_port="80" dst_port="65159" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218057"/>
        <to usec="0" sec="1447218666"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="158.153.141.183"/>
        </slice>
        <from usec="0" sec="1447218034"/>
        <to usec="0" sec="1447218036"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="191.49.111.4"/>
        </slice>
        <from usec="0" sec="1447218605"/>
        <to usec="0" sec="1447218706"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="154.88.175.134" dst_ip="186.255.110.34" src_port="80" dst_port="5373" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218271"/>
        <to usec="0" sec="1447218278"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="186.255.146.22" dst_ip="13.218.248.4" src_port="52661" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218856"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="4.58.175.242" dst_ip="161.56.223.24" src_port="8777" dst_port="61110" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218785"/>
        <to usec="0" sec="1447218786"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.124.71" dst_ip="142.172.186.179" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218191"/>
        <to usec="0" sec="1447218436"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="191.49.107.93" dst_ip="13.140.188.12" src_port="54138" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218754"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="183.104.83.82" dst_ip="158.153.90.7" src_port="80" dst_port="55798" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218878"/>
        <to usec="0" sec="1447218880"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="158.153.115.219"/>
        </slice>
        <from usec="0" sec="1447218769"/>
        <to usec="0" sec="1447218865"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="186.255.120.237" dst_ip="110.114.45.134" src_port="65033" dst_port="6851" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218786"/>
        <to usec="0" sec="1447218797"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="158.153.26.164" dst_ip="112.10.217.121" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218229"/>
        <to usec="0" sec="1447218334"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="128.201.31.211" dst_ip="221.80.160.208" src_port="80" dst_port="51420" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218487"/>
        <to usec="0" sec="1447218894"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="169.46.54.112" dst_ip="4.56.101.14" src_port="37248" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218754"/>
        <to usec="0" sec="1447218756"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.128.83" dst_ip="212.102.29.144" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218401"/>
        <to usec="0" sec="1447218406"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="34.55.25.33"/>
        </slice>
        <from usec="0" sec="1447218050"/>
        <to usec="0" sec="1447218052"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="221.80.168.56" dst_ip="142.172.186.169" src_port="52577" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218223"/>
        <to usec="0" sec="1447218225"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="158.153.109.156"/>
        </slice>
        <from usec="0" sec="1447218775"/>
        <to usec="0" sec="1447218777"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="158.153.143.131" dst_ip="100.106.200.222" src_port="40862" dst_port="30611" proto="udp"/>
        </slice>
        <from usec="0" sec="1447218227"/>
        <to usec="0" sec="1447218791"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="89.21.96.244" dst_ip="169.46.93.5" src_port="80" dst_port="38752" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218836"/>
        <to usec="0" sec="1447218840"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="221.80.174.228"/>
        </slice>
        <from usec="0" sec="1447218334"/>
        <to usec="0" sec="1447218336"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="42.245.79.146" dst_ip="221.80.168.85" src_port="80" dst_port="49438" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218893"/>
        <to usec="0" sec="1447218895"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="94.241.113.7" dst_ip="169.46.93.4" src_port="80" dst_port="44130" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218762"/>
        <to usec="0" sec="1447218763"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.128.69" dst_ip="57.94.106.24" src_port="54419" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218648"/>
        <to usec="0" sec="1447218649"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="191.35.137.17" dst_ip="71.203.70.37" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218170"/>
        <to usec="0" sec="1447218179"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="221.80.175.253" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218512"/>
        <to usec="0" sec="1447218514"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="186.255.194.237"/>
        </slice>
        <from usec="0" sec="1447218121"/>
        <to usec="0" sec="1447218134"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.255.5.77" dst_ip="13.104.162.170" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218404"/>
        <to usec="0" sec="1447218589"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="186.255.193.52"/>
        </slice>
        <from usec="0" sec="1447218293"/>
        <to usec="0" sec="1447218295"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="220.240.79.165" dst_ip="103.10.197.140" src_port="51568" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218547"/>
        <to usec="0" sec="1447218549"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="13.104.162.174" dst_ip="169.46.54.113" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218215"/>
        <to usec="0" sec="1447218217"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="186.255.139.21" dst_ip="34.32.135.122" src_port="52311" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218841"/>
        <to usec="0" sec="1447218843"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.75.228" dst_ip="154.88.175.240" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218362"/>
        <to usec="0" sec="1447218368"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.111.188" dst_ip="144.40.237.151" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218614"/>
        <to usec="0" sec="1447218864"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="220.240.75.239" dst_ip="189.1.97.236" src_port="80" dst_port="39236" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218447"/>
        <to usec="0" sec="1447218449"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="220.240.79.233"/>
        </slice>
        <from usec="0" sec="1447218332"/>
        <to usec="0" sec="1447218334"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="158.153.106.119" dst_ip="71.88.92.155" src_port="4813" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218358"/>
        <to usec="0" sec="1447218459"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="117.19.213.121" dst_ip="221.91.175.229" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218039"/>
        <to usec="0" sec="1447218264"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="220.240.79.242" dst_ip="219.121.96.72" src_port="55368" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218897"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="186.255.56.201"/>
        </slice>
        <from usec="0" sec="1447218845"/>
        <to usec="0" sec="1447218887"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="169.46.127.94" dst_ip="71.203.70.24" src_port="54406" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218082"/>
        <to usec="0" sec="1447218090"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="191.49.109.115"/>
        </slice>
        <from usec="0" sec="1447218609"/>
        <to usec="0" sec="1447218611"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="158.153.98.80" dst_ip="221.90.241.191" src_port="56520" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218479"/>
        <to usec="0" sec="1447218567"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="191.152.8.20" dst_ip="161.56.229.125" src_port="80" dst_port="63691" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218157"/>
        <to usec="0" sec="1447218158"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="158.153.112.78" dst_ip="104.47.64.244" src_port="40909" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218400"/>
        <to usec="0" sec="1447218401"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.240.75.202" src_port="33705"/>
        </slice>
        <from usec="0" sec="1447218530"/>
        <to usec="0" sec="1447218532"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="221.80.177.35" dst_ip="34.4.100.222" src_port="61411" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218526"/>
        <to usec="0" sec="1447218601"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="4.56.99.19" dst_ip="4.56.99.19" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="4.56.108.133" dst_ip="4.56.108.133" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218005"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="81.60.33.168"/>
        </slice>
        <from usec="0" sec="1447218701"/>
        <to usec="0" sec="1447218706"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,999,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="221.91.183.124" dst_port="19"/>
            <filter src_ip="223.223.145.211" dst_ip="161.56.71.196" dst_port="19"/>
        </slice>
        <from usec="0" sec="1447218161"/>
        <to usec="0" sec="1447218548"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="191.49.128.71" dst_ip="154.88.175.135" dst_port="80"/>
            <filter src_ip="191.49.128.71" dst_ip="154.88.175.166" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218009"/>
        <to usec="0" sec="1447218493"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="43.97.231.35" dst_ip="186.255.231.226" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218467"/>
        <to usec="0" sec="1447218878"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="154.88.175.231" dst_ip="154.88.175.231" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218360"/>
        <to usec="0" sec="1447218490"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="123.176.171.31" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218004"/>
        <to usec="0" sec="1447218894"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="51.195.141.108"/>
        </slice>
        <from usec="0" sec="1447218762"/>
        <to usec="0" sec="1447218764"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="158.153.113.2" src_port="39888"/>
            <filter src_ip="158.153.113.2" dst_port="80"/>
            <filter src_ip="158.153.113.2" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218364"/>
        <to usec="0" sec="1447218680"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="117.180.234.114" dst_ip="221.91.175.183" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218374"/>
        <to usec="0" sec="1447218376"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="4.56.100.189" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218020"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="4.56.108.178" dst_ip="4.56.108.178" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218066"/>
        <to usec="0" sec="1447218894"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.255.189.205" dst_ip="154.88.175.192" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218022"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="123.176.171.41" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218004"/>
        <to usec="0" sec="1447218895"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="68.18.210.32" dst_ip="68.18.210.32" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218002"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_port="80"/>
            <filter dst_ip="144.19.164.164" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218004"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="158.153.113.226" src_port="21891"/>
            <filter src_ip="158.153.113.226" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218057"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="18.99.192.64" dst_ip="221.91.175.231" dst_port="80"/>
            <filter src_ip="18.99.193.135" dst_ip="221.91.175.231" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218833"/>
        <to usec="0" sec="1447218867"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="144.19.167.214"/>
        </slice>
        <from usec="0" sec="1447218018"/>
        <to usec="0" sec="1447218129"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="13.140.188.12" dst_ip="191.49.107.93" src_port="443" dst_port="54138"/>
        </slice>
        <from usec="0" sec="1447218742"/>
        <to usec="0" sec="1447218881"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="191.49.125.228" dst_port="443"/>
            <filter src_ip="191.49.188.94" dst_ip="4.56.102.47"/>
            <filter src_ip="191.49.188.94" dst_port="443"/>
            <filter src_ip="191.49.188.94" dst_port="80"/>
            <filter dst_ip="4.56.102.29" dst_port="443"/>
            <filter src_ip="191.49.125.228" dst_ip="4.56.102.47" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218038"/>
        <to usec="0" sec="1447218887"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="137.30.172.201" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218054"/>
        <to usec="0" sec="1447218056"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="220.240.75.239" dst_ip="220.240.75.239" src_port="39236" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218156"/>
        <to usec="0" sec="1447218900"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="34.4.255.235" dst_ip="34.4.255.235" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218359"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="144.40.237.148" dst_ip="144.40.237.148" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218009"/>
        <to usec="0" sec="1447218797"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="41.76.79.212" dst_ip="191.49.132.236" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218547"/>
        <to usec="0" sec="1447218660"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="142.172.187.57"/>
        </slice>
        <from usec="0" sec="1447218284"/>
        <to usec="0" sec="1447218305"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="154.88.175.178" dst_ip="186.255.104.188" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218082"/>
        <to usec="0" sec="1447218794"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.114.43.70"/>
        </slice>
        <from usec="0" sec="1447218391"/>
        <to usec="0" sec="1447218402"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,hostout">
        <slice>
            <filter src_ip="220.240.89.109"/>
        </slice>
        <from usec="0" sec="1447218013"/>
        <to usec="0" sec="1447218826"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="191.49.115.133" dst_ip="131.83.194.206" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218148"/>
        <to usec="0" sec="1447218150"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="117.168.98.95"/>
        </slice>
        <from usec="0" sec="1447218208"/>
        <to usec="0" sec="1447218213"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="34.55.25.147"/>
        </slice>
        <from usec="0" sec="1447218054"/>
        <to usec="0" sec="1447218056"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.255.120.175" dst_ip="143.9.58.253" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218163"/>
        <to usec="0" sec="1447218213"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="158.153.63.231" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218126"/>
        <to usec="0" sec="1447218741"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="158.153.113.203"/>
        </slice>
        <from usec="0" sec="1447218019"/>
        <to usec="0" sec="1447218021"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="67.73.93.228"/>
        </slice>
        <from usec="0" sec="1447218444"/>
        <to usec="0" sec="1447218447"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="158.153.62.73"/>
        </slice>
        <from usec="0" sec="1447218426"/>
        <to usec="0" sec="1447218427"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="158.153.140.130"/>
        </slice>
        <from usec="0" sec="1447218603"/>
        <to usec="0" sec="1447218605"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="158.153.39.238" dst_ip="75.147.140.64" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218075"/>
        <to usec="0" sec="1447218077"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.23.173.73"/>
        </slice>
        <from usec="0" sec="1447218369"/>
        <to usec="0" sec="1447218374"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="18.99.236.142"/>
        </slice>
        <from usec="0" sec="1447218878"/>
        <to usec="0" sec="1447218880"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="158.153.141.168"/>
        </slice>
        <from usec="0" sec="1447218022"/>
        <to usec="0" sec="1447218024"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="158.153.142.140" dst_port="443"/>
            <filter src_ip="158.153.142.140" dst_ip="221.90.134.123" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218199"/>
        <to usec="0" sec="1447218764"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="191.49.109.26" dst_ip="59.146.209.212" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218182"/>
        <to usec="0" sec="1447218185"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="158.153.141.29"/>
        </slice>
        <from usec="0" sec="1447218668"/>
        <to usec="0" sec="1447218670"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="191.49.111.178"/>
        </slice>
        <from usec="0" sec="1447218066"/>
        <to usec="0" sec="1447218068"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.2.71.125"/>
        </slice>
        <from usec="0" sec="1447218154"/>
        <to usec="0" sec="1447218162"/>
    </anomaly>
    <anomaly type="notice" value="0.803430,1.405700,999,1 1 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="98.232.163.208" dst_ip="220.240.77.15" dst_port="123"/>
        </slice>
        <from usec="0" sec="1447218009"/>
        <to usec="0" sec="1447218892"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="191.49.113.161"/>
        </slice>
        <from usec="0" sec="1447218763"/>
        <to usec="0" sec="1447218771"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="221.77.176.19"/>
        </slice>
        <from usec="0" sec="1447218426"/>
        <to usec="0" sec="1447218428"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="18.99.239.196"/>
        </slice>
        <from usec="0" sec="1447218022"/>
        <to usec="0" sec="1447218024"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="158.153.142.234"/>
        </slice>
        <from usec="0" sec="1447218521"/>
        <to usec="0" sec="1447218523"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="4.56.96.67" dst_ip="4.56.96.67" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218348"/>
        <to usec="0" sec="1447218804"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="4.56.108.142" dst_ip="4.56.108.142" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218893"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="221.91.175.179" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218111"/>
        <to usec="0" sec="1447218878"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="4.56.111.24" dst_ip="4.56.111.24" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218004"/>
        <to usec="0" sec="1447218893"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="144.19.191.250" dst_ip="144.19.191.250" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="210.163.84.39" dst_ip="210.163.84.39" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218009"/>
        <to usec="0" sec="1447218894"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="221.80.70.61"/>
        </slice>
        <from usec="0" sec="1447218704"/>
        <to usec="0" sec="1447218706"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="158.153.140.111" dst_port="443"/>
            <filter src_ip="158.153.72.161" dst_port="443"/>
            <filter dst_ip="190.249.112.250" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218584"/>
        <to usec="0" sec="1447218835"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="222.75.253.182" dst_ip="222.75.253.182" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218896"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="201.0.234.12" dst_ip="201.0.234.12" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218745"/>
        <to usec="0" sec="1447218747"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="34.55.25.132"/>
        </slice>
        <from usec="0" sec="1447218698"/>
        <to usec="0" sec="1447218700"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="221.233.129.84" src_port="5363" dst_port="2425" proto="udp"/>
        </slice>
        <from usec="0" sec="1447218529"/>
        <to usec="0" sec="1447218531"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="161.97.177.21" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218448"/>
        <to usec="0" sec="1447218725"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.206.184.178" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218420"/>
        <to usec="0" sec="1447218439"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.249.191.199" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218112"/>
        <to usec="0" sec="1447218114"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="134.83.234.135"/>
        </slice>
        <from usec="0" sec="1447218332"/>
        <to usec="0" sec="1447218333"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.83.139.78"/>
        </slice>
        <from usec="0" sec="1447218071"/>
        <to usec="0" sec="1447218096"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="177.23.113.47"/>
        </slice>
        <from usec="0" sec="1447218536"/>
        <to usec="0" sec="1447218546"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="42.108.75.214" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218363"/>
        <to usec="0" sec="1447218365"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="88.2.105.96" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218247"/>
        <to usec="0" sec="1447218255"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.80.121.77"/>
        </slice>
        <from usec="0" sec="1447218647"/>
        <to usec="0" sec="1447218656"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="58.202.60.47" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218023"/>
        <to usec="0" sec="1447218028"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.23.232.134" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218256"/>
        <to usec="0" sec="1447218265"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.67.114.232" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218567"/>
        <to usec="0" sec="1447218569"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.67.53.202" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218656"/>
        <to usec="0" sec="1447218659"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="223.161.44.181" dst_port="445" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218069"/>
        <to usec="0" sec="1447218071"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="197.190.153.248" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218779"/>
        <to usec="0" sec="1447218789"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.105.98.210" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218693"/>
        <to usec="0" sec="1447218703"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.83.102.32" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218403"/>
        <to usec="0" sec="1447218414"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.76.162.11" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218060"/>
        <to usec="0" sec="1447218069"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="125.184.245.150" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218548"/>
        <to usec="0" sec="1447218556"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.62.254.56" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218207"/>
        <to usec="0" sec="1447218208"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="129.212.166.244"/>
        </slice>
        <from usec="0" sec="1447218023"/>
        <to usec="0" sec="1447218036"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.94.111.104" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218336"/>
        <to usec="0" sec="1447218338"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="126.140.204.178"/>
        </slice>
        <from usec="0" sec="1447218836"/>
        <to usec="0" sec="1447218863"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.157.61.212"/>
        </slice>
        <from usec="0" sec="1447218776"/>
        <to usec="0" sec="1447218780"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="137.47.169.240"/>
        </slice>
        <from usec="0" sec="1447218198"/>
        <to usec="0" sec="1447218209"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.16.190.11" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218734"/>
        <to usec="0" sec="1447218744"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="125.102.3.183" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218057"/>
        <to usec="0" sec="1447218059"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="215.78.10.200" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218786"/>
        <to usec="0" sec="1447218790"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="84.100.236.82" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218324"/>
        <to usec="0" sec="1447218330"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="192.169.154.161" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218274"/>
        <to usec="0" sec="1447218284"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.111.80.32" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218645"/>
        <to usec="0" sec="1447218656"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="177.70.14.55"/>
        </slice>
        <from usec="0" sec="1447218399"/>
        <to usec="0" sec="1447218410"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="101.223.212.4"/>
        </slice>
        <from usec="0" sec="1447218361"/>
        <to usec="0" sec="1447218372"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.254.89.52" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218204"/>
        <to usec="0" sec="1447218214"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="190.247.203.71" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218002"/>
        <to usec="0" sec="1447218011"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="192.30.77.211"/>
        </slice>
        <from usec="0" sec="1447218353"/>
        <to usec="0" sec="1447218364"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="40.187.203.213"/>
        </slice>
        <from usec="0" sec="1447218333"/>
        <to usec="0" sec="1447218356"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.185.245.90" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218350"/>
        <to usec="0" sec="1447218351"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.192.174.138" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218092"/>
        <to usec="0" sec="1447218094"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.248.185.35" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218240"/>
        <to usec="0" sec="1447218253"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="73.146.231.155"/>
        </slice>
        <from usec="0" sec="1447218625"/>
        <to usec="0" sec="1447218643"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.84.122.231" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218599"/>
        <to usec="0" sec="1447218601"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="23.190.65.48"/>
        </slice>
        <from usec="0" sec="1447218335"/>
        <to usec="0" sec="1447218337"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="40.23.69.41"/>
        </slice>
        <from usec="0" sec="1447218419"/>
        <to usec="0" sec="1447218430"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.112.91.250" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218507"/>
        <to usec="0" sec="1447218521"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="120.64.150.164" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218825"/>
        <to usec="0" sec="1447218837"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.122.73.82" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218074"/>
        <to usec="0" sec="1447218075"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="132.63.102.250"/>
        </slice>
        <from usec="0" sec="1447218857"/>
        <to usec="0" sec="1447218867"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.146.116.90"/>
        </slice>
        <from usec="0" sec="1447218758"/>
        <to usec="0" sec="1447218760"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="115.62.58.161" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218880"/>
        <to usec="0" sec="1447218882"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.251.169.157"/>
        </slice>
        <from usec="0" sec="1447218605"/>
        <to usec="0" sec="1447218620"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.83.116.223" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218532"/>
        <to usec="0" sec="1447218544"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="133.85.18.22" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218759"/>
        <to usec="0" sec="1447218780"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="48.179.60.131" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218083"/>
        <to usec="0" sec="1447218085"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.229.176.20" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218066"/>
        <to usec="0" sec="1447218080"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="146.71.134.35" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218592"/>
        <to usec="0" sec="1447218615"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="186.236.84.247"/>
        </slice>
        <from usec="0" sec="1447218261"/>
        <to usec="0" sec="1447218267"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.33.239.57" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218761"/>
        <to usec="0" sec="1447218766"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="132.187.19.99" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218711"/>
        <to usec="0" sec="1447218724"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="18.228.47.17"/>
        </slice>
        <from usec="0" sec="1447218328"/>
        <to usec="0" sec="1447218352"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="81.13.96.250" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218230"/>
        <to usec="0" sec="1447218232"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.127.202.216"/>
        </slice>
        <from usec="0" sec="1447218093"/>
        <to usec="0" sec="1447218114"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="25.70.221.100"/>
        </slice>
        <from usec="0" sec="1447218568"/>
        <to usec="0" sec="1447218580"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="17.115.152.87" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218597"/>
        <to usec="0" sec="1447218608"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.89.183.57" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218052"/>
        <to usec="0" sec="1447218063"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="72.218.137.195" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218434"/>
        <to usec="0" sec="1447218436"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="40.27.167.215" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218061"/>
        <to usec="0" sec="1447218063"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.193.121.115" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218474"/>
        <to usec="0" sec="1447218482"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.251.212.120" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218723"/>
        <to usec="0" sec="1447218739"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.227.189.6"/>
        </slice>
        <from usec="0" sec="1447218017"/>
        <to usec="0" sec="1447218028"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.190.226.96"/>
        </slice>
        <from usec="0" sec="1447218626"/>
        <to usec="0" sec="1447218636"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="42.138.139.17" dst_port="8080" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218576"/>
        <to usec="0" sec="1447218578"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.253.124.7" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218265"/>
        <to usec="0" sec="1447218276"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="131.214.96.200" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218183"/>
        <to usec="0" sec="1447218185"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="82.38.237.60"/>
        </slice>
        <from usec="0" sec="1447218674"/>
        <to usec="0" sec="1447218680"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.80.6.161"/>
        </slice>
        <from usec="0" sec="1447218607"/>
        <to usec="0" sec="1447218620"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="129.183.41.86" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218003"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="18.53.45.236" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218432"/>
        <to usec="0" sec="1447218435"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="23.54.206.120" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218189"/>
        <to usec="0" sec="1447218193"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="75.52.107.75"/>
        </slice>
        <from usec="0" sec="1447218328"/>
        <to usec="0" sec="1447218346"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="131.13.166.254" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218131"/>
        <to usec="0" sec="1447218138"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="120.236.87.168" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218695"/>
        <to usec="0" sec="1447218706"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.135.50.153" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218258"/>
        <to usec="0" sec="1447218265"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.134.187.152" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218149"/>
        <to usec="0" sec="1447218171"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.233.95.148" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218007"/>
        <to usec="0" sec="1447218012"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="195.128.233.52"/>
        </slice>
        <from usec="0" sec="1447218260"/>
        <to usec="0" sec="1447218282"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.87.133.133" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218535"/>
        <to usec="0" sec="1447218546"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="36.44.104.186"/>
        </slice>
        <from usec="0" sec="1447218467"/>
        <to usec="0" sec="1447218469"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="120.238.118.122" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218271"/>
        <to usec="0" sec="1447218291"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="110.147.193.253" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218567"/>
        <to usec="0" sec="1447218572"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.105.104.200"/>
        </slice>
        <from usec="0" sec="1447218653"/>
        <to usec="0" sec="1447218665"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.70.190.144" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218058"/>
        <to usec="0" sec="1447218060"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.167.190.9"/>
        </slice>
        <from usec="0" sec="1447218465"/>
        <to usec="0" sec="1447218472"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.51.238.56" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218224"/>
        <to usec="0" sec="1447218235"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.202.118.93" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218255"/>
        <to usec="0" sec="1447218262"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.248.124.219"/>
        </slice>
        <from usec="0" sec="1447218112"/>
        <to usec="0" sec="1447218114"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.105.70.139" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218479"/>
        <to usec="0" sec="1447218490"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="85.205.70.162"/>
        </slice>
        <from usec="0" sec="1447218610"/>
        <to usec="0" sec="1447218620"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.194.231.94" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218258"/>
        <to usec="0" sec="1447218270"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="115.61.98.43"/>
        </slice>
        <from usec="0" sec="1447218296"/>
        <to usec="0" sec="1447218319"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.236.67.76" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218222"/>
        <to usec="0" sec="1447218234"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.249.127.64" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218253"/>
        <to usec="0" sec="1447218259"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="125.102.157.118" dst_port="1433" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218539"/>
        <to usec="0" sec="1447218543"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.240.154.4" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218129"/>
        <to usec="0" sec="1447218130"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.254.118.164" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218187"/>
        <to usec="0" sec="1447218198"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="69.75.146.171" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218434"/>
        <to usec="0" sec="1447218444"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.74.116.71" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218433"/>
        <to usec="0" sec="1447218435"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.75.58.180" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218427"/>
        <to usec="0" sec="1447218430"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="217.197.55.146"/>
        </slice>
        <from usec="0" sec="1447218835"/>
        <to usec="0" sec="1447218841"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.253.97.111" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218522"/>
        <to usec="0" sec="1447218533"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="132.63.230.107"/>
        </slice>
        <from usec="0" sec="1447218839"/>
        <to usec="0" sec="1447218841"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.248.234.146" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218805"/>
        <to usec="0" sec="1447218807"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="125.172.227.55" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218380"/>
        <to usec="0" sec="1447218382"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="127.125.162.2" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218727"/>
        <to usec="0" sec="1447218738"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.49.37.100" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218850"/>
        <to usec="0" sec="1447218853"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="147.250.171.40" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218589"/>
        <to usec="0" sec="1447218593"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.242.246.214" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218655"/>
        <to usec="0" sec="1447218658"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="136.154.140.248"/>
        </slice>
        <from usec="0" sec="1447218586"/>
        <to usec="0" sec="1447218594"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="107.130.221.250"/>
        </slice>
        <from usec="0" sec="1447218659"/>
        <to usec="0" sec="1447218661"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.202.118.251" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218260"/>
        <to usec="0" sec="1447218264"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.80.182.193" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218751"/>
        <to usec="0" sec="1447218769"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="36.251.217.255" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218083"/>
        <to usec="0" sec="1447218085"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="115.144.65.115" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218726"/>
        <to usec="0" sec="1447218737"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.183.191.66"/>
        </slice>
        <from usec="0" sec="1447218514"/>
        <to usec="0" sec="1447218515"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.41.210.100" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218219"/>
        <to usec="0" sec="1447218220"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="114.143.187.137" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218723"/>
        <to usec="0" sec="1447218725"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="114.155.65.198"/>
        </slice>
        <from usec="0" sec="1447218201"/>
        <to usec="0" sec="1447218203"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.219.22.229" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218296"/>
        <to usec="0" sec="1447218298"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.248.65.75"/>
        </slice>
        <from usec="0" sec="1447218454"/>
        <to usec="0" sec="1447218464"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="25.188.133.49" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218122"/>
        <to usec="0" sec="1447218133"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.238.107.60" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218440"/>
        <to usec="0" sec="1447218454"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.126.115.220" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218565"/>
        <to usec="0" sec="1447218569"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.26.39.62" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218543"/>
        <to usec="0" sec="1447218554"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="53.253.125.30" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218275"/>
        <to usec="0" sec="1447218277"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.127.200.151" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218759"/>
        <to usec="0" sec="1447218766"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.57.136.109"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218005"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.85.127.91" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218182"/>
        <to usec="0" sec="1447218183"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="115.63.195.189" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218081"/>
        <to usec="0" sec="1447218083"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="23.79.202.67" dst_port="445" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218533"/>
        <to usec="0" sec="1447218534"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="120.228.8.203" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218748"/>
        <to usec="0" sec="1447218750"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="42.110.36.43" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218850"/>
        <to usec="0" sec="1447218854"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.115.68.43"/>
        </slice>
        <from usec="0" sec="1447218440"/>
        <to usec="0" sec="1447218451"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="127.249.133.82"/>
        </slice>
        <from usec="0" sec="1447218500"/>
        <to usec="0" sec="1447218502"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.183.72.167"/>
        </slice>
        <from usec="0" sec="1447218812"/>
        <to usec="0" sec="1447218814"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.71.217.25"/>
        </slice>
        <from usec="0" sec="1447218103"/>
        <to usec="0" sec="1447218114"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="144.187.2.222"/>
        </slice>
        <from usec="0" sec="1447218504"/>
        <to usec="0" sec="1447218528"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.77.170.43" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218549"/>
        <to usec="0" sec="1447218554"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="4.177.48.96"/>
        </slice>
        <from usec="0" sec="1447218710"/>
        <to usec="0" sec="1447218721"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.159.53.24" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218334"/>
        <to usec="0" sec="1447218336"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="144.46.65.228" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218703"/>
        <to usec="0" sec="1447218713"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="132.7.209.177" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218038"/>
        <to usec="0" sec="1447218039"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.80.64.147" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218545"/>
        <to usec="0" sec="1447218556"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="76.249.45.230" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218349"/>
        <to usec="0" sec="1447218894"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="137.30.172.201"/>
        </slice>
        <from usec="0" sec="1447218054"/>
        <to usec="0" sec="1447218056"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="114.97.246.186"/>
        </slice>
        <from usec="0" sec="1447218343"/>
        <to usec="0" sec="1447218345"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="137.163.239.11" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218502"/>
        <to usec="0" sec="1447218506"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.214.140.121" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218844"/>
        <to usec="0" sec="1447218863"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.99.209.8" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218513"/>
        <to usec="0" sec="1447218524"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="138.14.0.217" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218634"/>
        <to usec="0" sec="1447218645"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.250.141.156" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218532"/>
        <to usec="0" sec="1447218534"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.151.173.164"/>
        </slice>
        <from usec="0" sec="1447218202"/>
        <to usec="0" sec="1447218224"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.177.246.32"/>
        </slice>
        <from usec="0" sec="1447218657"/>
        <to usec="0" sec="1447218683"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.249.161.111" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218447"/>
        <to usec="0" sec="1447218458"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.126.128.116"/>
        </slice>
        <from usec="0" sec="1447218667"/>
        <to usec="0" sec="1447218699"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="192.181.44.244" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218551"/>
        <to usec="0" sec="1447218556"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.4.152.253"/>
        </slice>
        <from usec="0" sec="1447218138"/>
        <to usec="0" sec="1447218145"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.218.232.75" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218581"/>
        <to usec="0" sec="1447218590"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.54.54.155" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218564"/>
        <to usec="0" sec="1447218586"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.214.14.78"/>
        </slice>
        <from usec="0" sec="1447218197"/>
        <to usec="0" sec="1447218204"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.111.82.132" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218115"/>
        <to usec="0" sec="1447218119"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.78.206.206" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218741"/>
        <to usec="0" sec="1447218770"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="129.125.59.166" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218645"/>
        <to usec="0" sec="1447218649"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.86.33.117" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218233"/>
        <to usec="0" sec="1447218247"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.181.228.97"/>
        </slice>
        <from usec="0" sec="1447218614"/>
        <to usec="0" sec="1447218616"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="53.250.179.206" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218447"/>
        <to usec="0" sec="1447218448"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="131.230.117.192" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218727"/>
        <to usec="0" sec="1447218737"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="23.79.206.140" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218603"/>
        <to usec="0" sec="1447218614"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.249.135.73" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218174"/>
        <to usec="0" sec="1447218177"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="65.127.132.94" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218531"/>
        <to usec="0" sec="1447218536"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="129.214.194.219"/>
        </slice>
        <from usec="0" sec="1447218428"/>
        <to usec="0" sec="1447218438"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="123.125.212.53"/>
        </slice>
        <from usec="0" sec="1447218732"/>
        <to usec="0" sec="1447218741"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.80.201.187"/>
        </slice>
        <from usec="0" sec="1447218714"/>
        <to usec="0" sec="1447218725"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.28.183.59" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218149"/>
        <to usec="0" sec="1447218150"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="121.130.30.236"/>
        </slice>
        <from usec="0" sec="1447218010"/>
        <to usec="0" sec="1447218018"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="40.27.56.128" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218019"/>
        <to usec="0" sec="1447218022"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="94.109.55.137" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218106"/>
        <to usec="0" sec="1447218133"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="121.99.154.142" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218645"/>
        <to usec="0" sec="1447218661"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="79.74.242.237" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218675"/>
        <to usec="0" sec="1447218676"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="82.99.249.3"/>
        </slice>
        <from usec="0" sec="1447218293"/>
        <to usec="0" sec="1447218301"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.178.236.110" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218657"/>
        <to usec="0" sec="1447218658"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="134.192.200.16"/>
        </slice>
        <from usec="0" sec="1447218701"/>
        <to usec="0" sec="1447218725"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="129.211.104.121" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218668"/>
        <to usec="0" sec="1447218670"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="221.80.180.4"/>
        </slice>
        <from usec="0" sec="1447218898"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter dst_ip="158.153.185.43"/>
        </slice>
        <from usec="0" sec="1447218434"/>
        <to usec="0" sec="1447218436"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="221.80.65.197"/>
        </slice>
        <from usec="0" sec="1447218726"/>
        <to usec="0" sec="1447218728"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="56.45.255.119"/>
        </slice>
        <from usec="0" sec="1447218666"/>
        <to usec="0" sec="1447218667"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="139.11.73.67" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218175"/>
        <to usec="0" sec="1447218177"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="59.122.73.82" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218074"/>
        <to usec="0" sec="1447218075"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="76.249.127.64" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218254"/>
        <to usec="0" sec="1447218256"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="139.242.246.214" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218656"/>
        <to usec="0" sec="1447218658"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="114.143.187.137" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218723"/>
        <to usec="0" sec="1447218725"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="131.230.117.192" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218727"/>
        <to usec="0" sec="1447218737"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="127.107.90.90" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218282"/>
        <to usec="0" sec="1447218284"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,011,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="17.182.64.135" src_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218757"/>
        <to usec="0" sec="1447218759"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="191.35.210.124"/>
        </slice>
        <from usec="0" sec="1447218762"/>
        <to usec="0" sec="1447218764"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="191.49.112.15"/>
        </slice>
        <from usec="0" sec="1447218530"/>
        <to usec="0" sec="1447218532"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="42.158.217.250"/>
        </slice>
        <from usec="0" sec="1447218584"/>
        <to usec="0" sec="1447218607"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="191.49.114.206"/>
        </slice>
        <from usec="0" sec="1447218695"/>
        <to usec="0" sec="1447218697"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="187.161.214.103"/>
        </slice>
        <from usec="0" sec="1447218214"/>
        <to usec="0" sec="1447218658"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="140.36.25.70" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218563"/>
        <to usec="0" sec="1447218564"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="193.248.124.219"/>
        </slice>
        <from usec="0" sec="1447218113"/>
        <to usec="0" sec="1447218115"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="106.25.129.146" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218883"/>
        <to usec="0" sec="1447218897"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="46.51.77.14" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218096"/>
        <to usec="0" sec="1447218097"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="0.157.61.212" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218778"/>
        <to usec="0" sec="1447218779"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="49.206.164.50" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218542"/>
        <to usec="0" sec="1447218544"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="210.192.39.234" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218768"/>
        <to usec="0" sec="1447218770"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="120.64.150.164" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218826"/>
        <to usec="0" sec="1447218831"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="222.135.142.148" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218114"/>
        <to usec="0" sec="1447218116"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="128.253.46.230" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218447"/>
        <to usec="0" sec="1447218448"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="87.240.154.4" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218128"/>
        <to usec="0" sec="1447218130"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="76.255.31.72" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218352"/>
        <to usec="0" sec="1447218354"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="146.50.146.213" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218166"/>
        <to usec="0" sec="1447218169"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="120.228.8.203" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218748"/>
        <to usec="0" sec="1447218750"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="132.7.209.177" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218038"/>
        <to usec="0" sec="1447218040"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="43.214.130.237" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218796"/>
        <to usec="0" sec="1447218802"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="89.250.141.156" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218531"/>
        <to usec="0" sec="1447218533"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="93.181.228.97" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218614"/>
        <to usec="0" sec="1447218615"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="76.249.135.73" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218174"/>
        <to usec="0" sec="1447218175"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,020,1 0 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="4.201.163.42" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218665"/>
        <to usec="0" sec="1447218666"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="220.240.69.118"/>
        </slice>
        <from usec="0" sec="1447218272"/>
        <to usec="0" sec="1447218274"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.81.68.142"/>
        </slice>
        <from usec="0" sec="1447218822"/>
        <to usec="0" sec="1447218824"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.79.209.96"/>
        </slice>
        <from usec="0" sec="1447218858"/>
        <to usec="0" sec="1447218862"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="191.49.30.227"/>
        </slice>
        <from usec="0" sec="1447218131"/>
        <to usec="0" sec="1447218133"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.152.121.39"/>
        </slice>
        <from usec="0" sec="1447218577"/>
        <to usec="0" sec="1447218579"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="191.49.31.87"/>
        </slice>
        <from usec="0" sec="1447218896"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.25.213.148"/>
        </slice>
        <from usec="0" sec="1447218789"/>
        <to usec="0" sec="1447218812"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.112.118.192"/>
        </slice>
        <from usec="0" sec="1447218593"/>
        <to usec="0" sec="1447218599"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="136.45.122.51"/>
        </slice>
        <from usec="0" sec="1447218363"/>
        <to usec="0" sec="1447218365"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.237.61.242"/>
        </slice>
        <from usec="0" sec="1447218377"/>
        <to usec="0" sec="1447218379"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="191.49.184.245"/>
        </slice>
        <from usec="0" sec="1447218852"/>
        <to usec="0" sec="1447218854"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="191.49.106.215"/>
        </slice>
        <from usec="0" sec="1447218647"/>
        <to usec="0" sec="1447218659"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="169.46.31.121"/>
        </slice>
        <from usec="0" sec="1447218118"/>
        <to usec="0" sec="1447218120"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="169.46.200.43"/>
        </slice>
        <from usec="0" sec="1447218700"/>
        <to usec="0" sec="1447218702"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="191.49.228.114"/>
        </slice>
        <from usec="0" sec="1447218078"/>
        <to usec="0" sec="1447218079"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="36.44.64.81"/>
        </slice>
        <from usec="0" sec="1447218892"/>
        <to usec="0" sec="1447218893"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.90.210.229"/>
        </slice>
        <from usec="0" sec="1447218368"/>
        <to usec="0" sec="1447218375"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="158.153.140.2"/>
        </slice>
        <from usec="0" sec="1447218306"/>
        <to usec="0" sec="1447218308"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.226.54.186"/>
        </slice>
        <from usec="0" sec="1447218107"/>
        <to usec="0" sec="1447218110"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="186.255.149.206"/>
        </slice>
        <from usec="0" sec="1447218828"/>
        <to usec="0" sec="1447218830"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="158.153.142.179"/>
        </slice>
        <from usec="0" sec="1447218832"/>
        <to usec="0" sec="1447218834"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="186.255.136.190"/>
        </slice>
        <from usec="0" sec="1447218290"/>
        <to usec="0" sec="1447218292"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="186.255.237.3"/>
        </slice>
        <from usec="0" sec="1447218615"/>
        <to usec="0" sec="1447218617"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="23.43.60.3"/>
        </slice>
        <from usec="0" sec="1447218786"/>
        <to usec="0" sec="1447218788"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.255.194.88" dst_ip="211.230.212.193" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218009"/>
        <to usec="0" sec="1447218509"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="220.82.32.248" dst_ip="211.181.190.39" src_port="31420" dst_port="53"/>
        </slice>
        <from usec="0" sec="1447218866"/>
        <to usec="0" sec="1447218867"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,999,1 1 1 0 0 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="220.240.76.239" dst_ip="216.23.56.9"/>
        </slice>
        <from usec="0" sec="1447218007"/>
        <to usec="0" sec="1447218895"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="53.72.146.60" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218221"/>
        <to usec="0" sec="1447218253"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="186.255.169.205" dst_ip="34.32.13.51" src_port="56938" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218455"/>
        <to usec="0" sec="1447218463"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="211.39.53.16" dst_ip="220.240.69.118" src_port="63763" dst_port="25"/>
        </slice>
        <from usec="0" sec="1447218268"/>
        <to usec="0" sec="1447218277"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="4.204.77.215" dst_ip="191.35.63.53" src_port="8080" dst_port="62850"/>
            <filter src_ip="4.204.77.215" dst_ip="191.35.63.53" src_port="8080" dst_port="62383"/>
            <filter src_ip="4.204.77.215" dst_ip="191.35.63.53" src_port="8080" dst_port="60711"/>
            <filter src_ip="4.204.77.215" dst_ip="191.35.63.53" src_port="8080" dst_port="60061"/>
        </slice>
        <from usec="0" sec="1447218032"/>
        <to usec="0" sec="1447218778"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="186.255.205.85" dst_ip="34.4.99.155" src_port="52297" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218802"/>
        <to usec="0" sec="1447218807"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,503,0 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="154.88.175.192" dst_ip="191.49.25.215" src_port="80" dst_port="62756" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218880"/>
        <to usec="0" sec="1447218882"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="221.80.173.35" src_port="22148"/>
        </slice>
        <from usec="0" sec="1447218458"/>
        <to usec="0" sec="1447218900"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="220.112.189.195" src_port="60000"/>
        </slice>
        <from usec="0" sec="1447218619"/>
        <to usec="0" sec="1447218884"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.59.173" dst_ip="22.225.58.50" src_port="52055" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218313"/>
        <to usec="0" sec="1447218887"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.228.239" dst_ip="42.131.181.154" src_port="59736" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218075"/>
        <to usec="0" sec="1447218879"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.255.201.158" dst_ip="154.88.175.240" src_port="61243" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218727"/>
        <to usec="0" sec="1447218729"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="220.240.70.252" dst_ip="32.37.55.188" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218018"/>
        <to usec="0" sec="1447218179"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="158.153.72.180" dst_ip="211.158.174.241" src_port="62685" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218525"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="221.99.75.68" dst_ip="221.80.65.45" src_port="30793" dst_port="53"/>
            <filter src_ip="221.99.75.68" dst_ip="221.80.65.45" src_port="23007" dst_port="53"/>
            <filter src_ip="221.99.75.68" dst_ip="221.80.65.45" src_port="18709" dst_port="53"/>
            <filter src_ip="221.99.75.68" dst_ip="221.80.70.55" src_port="1340" dst_port="25"/>
        </slice>
        <from usec="0" sec="1447218186"/>
        <to usec="0" sec="1447218188"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="221.80.174.45" dst_ip="118.17.71.79" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218112"/>
        <to usec="0" sec="1447218866"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="158.110.189.202" dst_ip="158.153.113.217" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218399"/>
        <to usec="0" sec="1447218406"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="199.29.56.107" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218393"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,504,0 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="221.91.138.211" dst_port="53"/>
            <filter src_ip="221.91.138.211" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218083"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="158.153.40.163" dst_ip="107.201.66.63" src_port="50948" dst_port="443"/>
            <filter src_ip="158.153.40.163" dst_ip="107.201.66.16" src_port="50987" dst_port="443"/>
            <filter src_ip="158.153.40.163" dst_ip="34.33.59.240" src_port="50985" dst_port="443"/>
            <filter src_ip="158.153.40.163" dst_ip="107.201.68.6" src_port="50815" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218606"/>
        <to usec="0" sec="1447218614"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="34.8.209.13" dst_ip="191.35.26.103" src_port="80" dst_port="65480"/>
        </slice>
        <from usec="0" sec="1447218770"/>
        <to usec="0" sec="1447218894"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="191.49.229.17" dst_ip="39.16.46.176" dst_port="443"/>
            <filter src_ip="191.49.229.17" dst_ip="39.16.35.80" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218428"/>
        <to usec="0" sec="1447218569"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,999,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="221.100.185.16" dst_ip="220.240.69.118" src_port="12827" dst_port="25"/>
        </slice>
        <from usec="0" sec="1447218843"/>
        <to usec="0" sec="1447218846"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.49.189.123" dst_ip="202.124.126.22" src_port="53990" dst_port="80"/>
            <filter src_ip="191.49.189.123" dst_ip="202.124.126.22" src_port="53989" dst_port="80"/>
            <filter src_ip="191.49.189.123" dst_ip="202.124.126.22" src_port="53988" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218507"/>
        <to usec="0" sec="1447218581"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="221.80.168.19" dst_ip="159.22.190.102" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218651"/>
        <to usec="0" sec="1447218895"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="158.153.29.248" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218265"/>
        <to usec="0" sec="1447218271"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="221.80.172.146" dst_ip="158.247.29.161" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218344"/>
        <to usec="0" sec="1447218775"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="221.80.175.232" dst_ip="70.171.243.154" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218005"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="221.80.173.250" dst_ip="144.40.237.147" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218468"/>
        <to usec="0" sec="1447218892"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="158.153.90.7" dst_ip="211.158.174.211" src_port="55487" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="221.80.168.127" dst_ip="57.93.229.141" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218210"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="191.35.164.243" dst_ip="202.124.125.155" src_port="61548" dst_port="443"/>
            <filter src_ip="191.35.164.243" dst_ip="202.124.125.155" src_port="61547" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218010"/>
        <to usec="0" sec="1447218015"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.35.57.93" dst_ip="71.203.70.17" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218049"/>
        <to usec="0" sec="1447218853"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.255.185.132" dst_ip="154.88.175.233" src_port="50093" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218461"/>
        <to usec="0" sec="1447218464"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="186.255.120.57" dst_ip="34.82.230.140" dst_port="443"/>
            <filter src_ip="186.255.120.57" dst_ip="32.35.133.184" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218008"/>
        <to usec="0" sec="1447218130"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="158.153.140.101" dst_ip="13.240.54.44" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218851"/>
        <to usec="0" sec="1447218859"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="191.49.53.110" dst_port="443"/>
            <filter src_ip="191.49.53.110" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218881"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="186.255.148.166" dst_ip="154.88.175.241" src_port="52215" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218508"/>
        <to usec="0" sec="1447218726"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="4.56.111.59" dst_ip="4.56.111.59" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218067"/>
        <to usec="0" sec="1447218853"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="191.49.173.214" dst_ip="81.60.33.188" src_port="49335" dst_port="80"/>
            <filter src_ip="158.153.90.48" dst_ip="81.60.33.188" src_port="20857" dst_port="80"/>
            <filter src_ip="158.153.108.124" dst_ip="81.60.33.188" src_port="54883" dst_port="80"/>
            <filter src_ip="158.153.103.8" dst_ip="81.60.33.188" src_port="61238" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218581"/>
        <to usec="0" sec="1447218600"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="154.88.175.231" dst_ip="154.88.175.231" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218365"/>
        <to usec="0" sec="1447218490"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="42.245.115.94" dst_ip="191.49.108.155" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218778"/>
        <to usec="0" sec="1447218779"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="154.88.175.202" dst_ip="154.88.175.202" src_port="49379" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218462"/>
        <to usec="0" sec="1447218774"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="221.80.65.230" dst_port="443"/>
            <filter src_ip="158.153.113.208" dst_port="80"/>
            <filter dst_ip="4.56.108.178" dst_port="443"/>
            <filter src_ip="221.80.65.230" dst_ip="4.56.108.178" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218037"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,999,1 1 0 0 0 0 0 0 0 0 0 0,point_to_point">
        <slice>
            <filter src_ip="210.155.66.168" dst_ip="158.153.188.236" dst_port="25"/>
        </slice>
        <from usec="0" sec="1447218325"/>
        <to usec="0" sec="1447218459"/>
    </anomaly>
    <anomaly type="notice" value="0.803430,1.405700,503,1 1 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="220.240.70.219" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218011"/>
        <to usec="0" sec="1447218891"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="42.78.117.194" dst_ip="158.153.62.89" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218729"/>
        <to usec="0" sec="1447218731"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="191.35.82.245" dst_ip="71.203.70.37" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218031"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,999,1 1 1 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="220.240.71.253" dst_ip="211.180.161.45" dst_port="53"/>
            <filter src_ip="220.240.71.11" dst_ip="211.180.161.45" dst_port="53"/>
            <filter src_ip="220.240.71.7" dst_ip="211.180.161.45" dst_port="53"/>
            <filter src_ip="220.240.71.2" dst_ip="211.180.161.45" dst_port="53"/>
        </slice>
        <from usec="0" sec="1447218520"/>
        <to usec="0" sec="1447218698"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,999,1 1 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="212.214.59.20" dst_ip="220.240.71.253" src_port="63122" dst_port="53"/>
            <filter src_ip="212.214.59.21" dst_ip="220.240.71.253" src_port="63121" dst_port="53"/>
        </slice>
        <from usec="0" sec="1447218524"/>
        <to usec="0" sec="1447218527"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,010,0 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.233.43.147" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218049"/>
        <to usec="0" sec="1447218060"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="49.79.172.115" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218247"/>
        <to usec="0" sec="1447218258"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="138.110.8.187" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218346"/>
        <to usec="0" sec="1447218353"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.99.101.26" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218753"/>
        <to usec="0" sec="1447218764"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.166.172.248" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218187"/>
        <to usec="0" sec="1447218198"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="3.251.19.216" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218175"/>
        <to usec="0" sec="1447218185"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="74.59.245.217" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218262"/>
        <to usec="0" sec="1447218272"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="170.169.142.109" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218431"/>
        <to usec="0" sec="1447218441"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.91.247.164" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218418"/>
        <to usec="0" sec="1447218429"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="191.49.111.12" dst_ip="211.216.42.178" dst_port="80"/>
            <filter src_ip="191.49.111.12" dst_ip="39.30.64.112" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218897"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="95.234.136.80" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218412"/>
        <to usec="0" sec="1447218423"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.230.147.124" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218307"/>
        <to usec="0" sec="1447218332"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="39.203.180.103" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218358"/>
        <to usec="0" sec="1447218369"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="49.79.89.106" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218287"/>
        <to usec="0" sec="1447218297"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="195.147.2.114" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218123"/>
        <to usec="0" sec="1447218133"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="100.221.138.75" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218388"/>
        <to usec="0" sec="1447218401"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="158.153.102.100" dst_ip="221.90.39.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218197"/>
        <to usec="0" sec="1447218855"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="191.49.76.30" dst_ip="39.2.228.52" dst_port="80"/>
            <filter src_ip="191.49.76.30" dst_ip="39.2.228.223" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218702"/>
        <to usec="0" sec="1447218705"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.107.69.51" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218146"/>
        <to usec="0" sec="1447218151"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.253.132.170" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218010"/>
        <to usec="0" sec="1447218104"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.89.133.31" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218029"/>
        <to usec="0" sec="1447218040"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.224.140.167" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218041"/>
        <to usec="0" sec="1447218052"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.33.158.14" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218458"/>
        <to usec="0" sec="1447218481"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.216.16.164" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218357"/>
        <to usec="0" sec="1447218364"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.51.131.92" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218173"/>
        <to usec="0" sec="1447218184"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.79.82.76" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218333"/>
        <to usec="0" sec="1447218350"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="186.255.110.34" dst_port="80"/>
            <filter src_ip="186.255.110.34" dst_ip="34.55.202.79" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218009"/>
        <to usec="0" sec="1447218881"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,999,0 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="98.232.163.208" dst_ip="220.240.75.160" dst_port="123"/>
        </slice>
        <from usec="0" sec="1447218655"/>
        <to usec="0" sec="1447218893"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,901,0 1 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="222.75.253.182" dst_ip="222.75.253.182" proto="icmp"/>
        </slice>
        <from usec="0" sec="1447218896"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="94.108.10.71" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218833"/>
        <to usec="0" sec="1447218844"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.107.187.232" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218777"/>
        <to usec="0" sec="1447218790"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,010,0 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="42.218.80.81" src_port="12200" dst_port="10080" proto="tcp"/>
        </slice>
        <from usec="0" sec="1447218032"/>
        <to usec="0" sec="1447218104"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="23.185.137.194" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218876"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,icmp_error">
        <slice>
            <filter src_ip="161.97.176.92"/>
        </slice>
        <from usec="0" sec="1447218826"/>
        <to usec="0" sec="1447218837"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.224.224.247" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218768"/>
        <to usec="0" sec="1447218780"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="56.97.239.116" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218677"/>
        <to usec="0" sec="1447218682"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="108.244.98.86" src_port="6000" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1447218134"/>
        <to usec="0" sec="1447218143"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="118.209.9.199" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218759"/>
        <to usec="0" sec="1447218770"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="114.91.178.101" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218844"/>
        <to usec="0" sec="1447218854"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.221.169.186" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218742"/>
        <to usec="0" sec="1447218765"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.169.161.189" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218885"/>
        <to usec="0" sec="1447218897"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="137.136.53.116" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218891"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.243.58.156" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218345"/>
        <to usec="0" sec="1447218356"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.255.181.119" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218255"/>
        <to usec="0" sec="1447218266"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="84.164.114.81" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218162"/>
        <to usec="0" sec="1447218173"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="115.61.177.246" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218604"/>
        <to usec="0" sec="1447218613"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="79.16.48.109" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218657"/>
        <to usec="0" sec="1447218668"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.178.89.242" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218087"/>
        <to usec="0" sec="1447218098"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.75.253.182" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218897"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.104.27.41" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218158"/>
        <to usec="0" sec="1447218168"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.91.17.153" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218020"/>
        <to usec="0" sec="1447218029"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="96.201.208.52" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218722"/>
        <to usec="0" sec="1447218724"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.65.30.228" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218739"/>
        <to usec="0" sec="1447218762"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.248.138.107" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218187"/>
        <to usec="0" sec="1447218198"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="86.20.100.223" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218083"/>
        <to usec="0" sec="1447218096"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,010,0 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="43.249.104.83" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218740"/>
        <to usec="0" sec="1447218745"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="134.35.32.200" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218716"/>
        <to usec="0" sec="1447218719"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.249.205.10" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218850"/>
        <to usec="0" sec="1447218861"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="123.15.131.131" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218474"/>
        <to usec="0" sec="1447218476"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="118.90.208.9" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218084"/>
        <to usec="0" sec="1447218095"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.95.4.139" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218638"/>
        <to usec="0" sec="1447218649"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="138.14.207.147" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218460"/>
        <to usec="0" sec="1447218471"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="125.181.135.188" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218659"/>
        <to usec="0" sec="1447218689"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="95.197.248.222" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218122"/>
        <to usec="0" sec="1447218133"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.122.80.10" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218766"/>
        <to usec="0" sec="1447218785"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="84.113.130.222" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218231"/>
        <to usec="0" sec="1447218235"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="86.231.126.206" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218833"/>
        <to usec="0" sec="1447218845"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.99.248.105" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218505"/>
        <to usec="0" sec="1447218516"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="199.51.98.66" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218335"/>
        <to usec="0" sec="1447218337"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="195.135.24.32" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218695"/>
        <to usec="0" sec="1447218699"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="85.17.11.13" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218266"/>
        <to usec="0" sec="1447218268"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.157.34.138" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218799"/>
        <to usec="0" sec="1447218805"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="55.243.123.88" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218769"/>
        <to usec="0" sec="1447218778"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.202.91.88" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218109"/>
        <to usec="0" sec="1447218113"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="132.209.9.33" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218683"/>
        <to usec="0" sec="1447218688"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.239.139.158" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218322"/>
        <to usec="0" sec="1447218324"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.194.190.231" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218013"/>
        <to usec="0" sec="1447218020"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="79.16.34.137" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218469"/>
        <to usec="0" sec="1447218470"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.155.30.195" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218811"/>
        <to usec="0" sec="1447218823"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="127.2.198.248" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218040"/>
        <to usec="0" sec="1447218063"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="137.46.53.84" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218789"/>
        <to usec="0" sec="1447218801"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="138.205.5.23" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218348"/>
        <to usec="0" sec="1447218354"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="40.234.120.165" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218895"/>
        <to usec="0" sec="1447218900"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="109.156.64.185" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218800"/>
        <to usec="0" sec="1447218811"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="98.207.63.67" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218017"/>
        <to usec="0" sec="1447218024"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.73.36.16" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218793"/>
        <to usec="0" sec="1447218804"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.83.245.6" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218885"/>
        <to usec="0" sec="1447218892"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.72.232.253" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218701"/>
        <to usec="0" sec="1447218712"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.0.234.12" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218745"/>
        <to usec="0" sec="1447218748"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="103.42.250.127" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218734"/>
        <to usec="0" sec="1447218746"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="96.242.103.234" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218640"/>
        <to usec="0" sec="1447218648"/>
    </anomaly>
    <anomaly type="notice" value="0.719782,1.339190,010,0 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.97.202.134" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218762"/>
        <to usec="0" sec="1447218782"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.254.5.2" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218355"/>
        <to usec="0" sec="1447218360"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="43.99.250.113" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218863"/>
        <to usec="0" sec="1447218867"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.249.196.74" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218007"/>
        <to usec="0" sec="1447218009"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.61.63.30" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218612"/>
        <to usec="0" sec="1447218622"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="143.31.9.168" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218609"/>
        <to usec="0" sec="1447218620"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.50.163.17" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218563"/>
        <to usec="0" sec="1447218574"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="114.198.11.125" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218754"/>
        <to usec="0" sec="1447218766"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="192.173.61.220" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218624"/>
        <to usec="0" sec="1447218629"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="146.71.11.48" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218627"/>
        <to usec="0" sec="1447218629"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.15.115.138" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218859"/>
        <to usec="0" sec="1447218870"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.249.24.25" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218894"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.194.138.24" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218799"/>
        <to usec="0" sec="1447218809"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="40.27.71.177" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218695"/>
        <to usec="0" sec="1447218707"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="96.205.48.191" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218117"/>
        <to usec="0" sec="1447218120"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="136.132.72.165" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218772"/>
        <to usec="0" sec="1447218797"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="81.56.99.62" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218022"/>
        <to usec="0" sec="1447218025"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="133.192.156.115" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218283"/>
        <to usec="0" sec="1447218285"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.72.240.207" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218736"/>
        <to usec="0" sec="1447218748"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.166.222.41" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218704"/>
        <to usec="0" sec="1447218709"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.134.81.54" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218891"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.82.56.18" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218854"/>
        <to usec="0" sec="1447218881"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="126.41.220.33" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1447218864"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.158.185.159" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218012"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="131.47.111.44" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218661"/>
        <to usec="0" sec="1447218673"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.252.161.177" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218033"/>
        <to usec="0" sec="1447218044"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.255.78.200" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218323"/>
        <to usec="0" sec="1447218361"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="125.187.139.71" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218599"/>
        <to usec="0" sec="1447218618"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="80.224.177.225" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218057"/>
        <to usec="0" sec="1447218065"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.172.253.44" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218887"/>
        <to usec="0" sec="1447218895"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="151.242.2.176" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218183"/>
        <to usec="0" sec="1447218194"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.132.14.151" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218013"/>
        <to usec="0" sec="1447218024"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.62.30.153" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218083"/>
        <to usec="0" sec="1447218095"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="57.117.49.160" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218568"/>
        <to usec="0" sec="1447218579"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.248.14.75" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218415"/>
        <to usec="0" sec="1447218426"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.251.122.56" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218885"/>
        <to usec="0" sec="1447218894"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.228.250.181" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218744"/>
        <to usec="0" sec="1447218746"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="3.131.194.170" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218880"/>
        <to usec="0" sec="1447218881"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="212.114.6.227" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218754"/>
        <to usec="0" sec="1447218770"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.106.169.96" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218219"/>
        <to usec="0" sec="1447218224"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="123.138.100.30" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218794"/>
        <to usec="0" sec="1447218799"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.99.113.173" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218195"/>
        <to usec="0" sec="1447218214"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="68.196.137.231" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218826"/>
        <to usec="0" sec="1447218838"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="146.103.167.182" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218646"/>
        <to usec="0" sec="1447218657"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.250.168.108" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218074"/>
        <to usec="0" sec="1447218086"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="96.252.112.86" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218074"/>
        <to usec="0" sec="1447218096"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="94.251.179.215" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218126"/>
        <to usec="0" sec="1447218130"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.80.49.104" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218757"/>
        <to usec="0" sec="1447218762"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.69.28.44" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218738"/>
        <to usec="0" sec="1447218745"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.248.108.151" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218281"/>
        <to usec="0" sec="1447218292"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.149.53.249" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218862"/>
        <to usec="0" sec="1447218866"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.202.112.146" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218013"/>
        <to usec="0" sec="1447218020"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.186.4.50" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218092"/>
        <to usec="0" sec="1447218094"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.87.239.54" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218786"/>
        <to usec="0" sec="1447218809"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.249.198.194" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218894"/>
        <to usec="0" sec="1447218900"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="134.83.119.128" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218383"/>
        <to usec="0" sec="1447218389"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="199.91.205.243" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218785"/>
        <to usec="0" sec="1447218790"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.60.97.39" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218535"/>
        <to usec="0" sec="1447218546"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="79.16.17.6" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218202"/>
        <to usec="0" sec="1447218214"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="133.179.151.22" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218870"/>
        <to usec="0" sec="1447218881"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.70.82.215" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218868"/>
        <to usec="0" sec="1447218880"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.244.27.155" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218863"/>
        <to usec="0" sec="1447218868"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="208.65.72.18" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218162"/>
        <to usec="0" sec="1447218172"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.188.98.138" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218247"/>
        <to usec="0" sec="1447218257"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="195.141.224.173" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218548"/>
        <to usec="0" sec="1447218791"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="120.239.42.118" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218556"/>
        <to usec="0" sec="1447218560"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="146.67.84.6" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218300"/>
        <to usec="0" sec="1447218466"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="93.237.154.66" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218854"/>
        <to usec="0" sec="1447218856"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.112.105.148" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218692"/>
        <to usec="0" sec="1447218694"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.50.98.29" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218349"/>
        <to usec="0" sec="1447218362"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.83.51.27" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218049"/>
        <to usec="0" sec="1447218060"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.221.60.20" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218433"/>
        <to usec="0" sec="1447218458"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.176.181.226" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218376"/>
        <to usec="0" sec="1447218389"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="137.132.187.231" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218246"/>
        <to usec="0" sec="1447218249"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="27.165.251.226" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218697"/>
        <to usec="0" sec="1447218709"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="146.102.6.255" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218769"/>
        <to usec="0" sec="1447218780"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="140.45.6.69" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218347"/>
        <to usec="0" sec="1447218359"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.16.199.169" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218021"/>
        <to usec="0" sec="1447218027"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.103.101.163" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218646"/>
        <to usec="0" sec="1447218669"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.127.33.75" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218508"/>
        <to usec="0" sec="1447218519"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="25.78.73.86" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218070"/>
        <to usec="0" sec="1447218102"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="165.21.133.189" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218080"/>
        <to usec="0" sec="1447218082"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.127.239.32" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218876"/>
        <to usec="0" sec="1447218878"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="195.147.60.156" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218600"/>
        <to usec="0" sec="1447218622"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.107.186.82" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218542"/>
        <to usec="0" sec="1447218550"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.205.167.254" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218455"/>
        <to usec="0" sec="1447218477"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.182.67.123" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218064"/>
        <to usec="0" sec="1447218075"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="43.98.144.54" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218764"/>
        <to usec="0" sec="1447218775"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.0.77.150" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218852"/>
        <to usec="0" sec="1447218854"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.105.46.61" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218761"/>
        <to usec="0" sec="1447218770"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="200.188.60.249" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218022"/>
        <to usec="0" sec="1447218024"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="42.99.188.95" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218208"/>
        <to usec="0" sec="1447218213"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.203.160.83" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218864"/>
        <to usec="0" sec="1447218868"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="53.167.166.63" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218709"/>
        <to usec="0" sec="1447218719"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.100.157.54" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218522"/>
        <to usec="0" sec="1447218532"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.177.167.55" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218264"/>
        <to usec="0" sec="1447218266"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.192.147.193" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218780"/>
        <to usec="0" sec="1447218803"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.166.102.192" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218768"/>
        <to usec="0" sec="1447218780"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.6.48.25" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218305"/>
        <to usec="0" sec="1447218314"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="86.15.249.209" dst_port="25"/>
        </slice>
        <from usec="0" sec="1447218759"/>
        <to usec="0" sec="1447218760"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="23.76.116.54" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218195"/>
        <to usec="0" sec="1447218207"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.96.150.85" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218379"/>
        <to usec="0" sec="1447218391"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.92.30.6" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218022"/>
        <to usec="0" sec="1447218028"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="223.15.99.244" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218799"/>
        <to usec="0" sec="1447218804"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.197.153.59" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218888"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="25.95.115.230" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218631"/>
        <to usec="0" sec="1447218653"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.80.82.70" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218645"/>
        <to usec="0" sec="1447218658"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.32.61.8" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218571"/>
        <to usec="0" sec="1447218583"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="137.157.90.187" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218512"/>
        <to usec="0" sec="1447218522"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.250.181.215" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218871"/>
        <to usec="0" sec="1447218882"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="198.89.68.150" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218851"/>
        <to usec="0" sec="1447218853"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="181.69.75.160" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218569"/>
        <to usec="0" sec="1447218586"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="133.235.192.131" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218113"/>
        <to usec="0" sec="1447218124"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.77.33.243" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218010"/>
        <to usec="0" sec="1447218032"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.209.5.138" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218787"/>
        <to usec="0" sec="1447218797"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="89.22.192.109" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218070"/>
        <to usec="0" sec="1447218071"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="206.157.116.61" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218779"/>
        <to usec="0" sec="1447218789"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.89.123.99" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218068"/>
        <to usec="0" sec="1447218093"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.154.39.28" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218207"/>
        <to usec="0" sec="1447218215"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="127.15.103.237" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218798"/>
        <to usec="0" sec="1447218838"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="3.36.35.49" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218425"/>
        <to usec="0" sec="1447218436"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.83.138.85" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218536"/>
        <to usec="0" sec="1447218546"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.104.10.122" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218031"/>
        <to usec="0" sec="1447218041"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.109.229.32" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218754"/>
        <to usec="0" sec="1447218766"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.202.114.132" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218162"/>
        <to usec="0" sec="1447218166"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.124.47.41" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218147"/>
        <to usec="0" sec="1447218158"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="195.52.61.106" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218827"/>
        <to usec="0" sec="1447218832"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="136.8.19.130" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218703"/>
        <to usec="0" sec="1447218725"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="134.195.94.170" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218737"/>
        <to usec="0" sec="1447218739"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="141.42.78.219" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218222"/>
        <to usec="0" sec="1447218233"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="132.207.145.117" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218129"/>
        <to usec="0" sec="1447218140"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="139.28.148.121" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218682"/>
        <to usec="0" sec="1447218694"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="135.172.160.112" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218225"/>
        <to usec="0" sec="1447218237"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="85.45.183.242" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218825"/>
        <to usec="0" sec="1447218830"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="130.202.113.244" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218859"/>
        <to usec="0" sec="1447218868"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.48.63.151" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218785"/>
        <to usec="0" sec="1447218798"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.103.123.202" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218772"/>
        <to usec="0" sec="1447218782"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="114.203.179.119" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218144"/>
        <to usec="0" sec="1447218173"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.214.95.205" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218849"/>
        <to usec="0" sec="1447218851"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="84.125.122.138" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218726"/>
        <to usec="0" sec="1447218737"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.65.67.65" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218749"/>
        <to usec="0" sec="1447218760"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.232.40.174" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218203"/>
        <to usec="0" sec="1447218214"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="223.154.112.190" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218678"/>
        <to usec="0" sec="1447218681"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="94.250.230.118" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218895"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="134.35.32.200"/>
        </slice>
        <from usec="0" sec="1447218717"/>
        <to usec="0" sec="1447218719"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="106.28.206.18"/>
        </slice>
        <from usec="0" sec="1447218170"/>
        <to usec="0" sec="1447218171"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="85.17.11.13"/>
        </slice>
        <from usec="0" sec="1447218266"/>
        <to usec="0" sec="1447218267"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="215.78.10.200"/>
        </slice>
        <from usec="0" sec="1447218786"/>
        <to usec="0" sec="1447218790"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="141.132.14.151"/>
        </slice>
        <from usec="0" sec="1447218013"/>
        <to usec="0" sec="1447218024"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="76.228.250.181"/>
        </slice>
        <from usec="0" sec="1447218742"/>
        <to usec="0" sec="1447218746"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="212.114.6.227"/>
        </slice>
        <from usec="0" sec="1447218751"/>
        <to usec="0" sec="1447218777"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="42.32.176.110"/>
        </slice>
        <from usec="0" sec="1447218153"/>
        <to usec="0" sec="1447218155"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="87.149.53.249"/>
        </slice>
        <from usec="0" sec="1447218863"/>
        <to usec="0" sec="1447218866"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="129.26.208.168"/>
        </slice>
        <from usec="0" sec="1447218264"/>
        <to usec="0" sec="1447218265"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="195.141.224.173"/>
        </slice>
        <from usec="0" sec="1447218525"/>
        <to usec="0" sec="1447218551"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="90.112.105.148"/>
        </slice>
        <from usec="0" sec="1447218692"/>
        <to usec="0" sec="1447218694"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="200.188.60.249"/>
        </slice>
        <from usec="0" sec="1447218022"/>
        <to usec="0" sec="1447218024"/>
    </anomaly>
    <anomaly type="notice" value="0.803430,1.405700,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="133.60.108.150"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="40.27.56.128"/>
        </slice>
        <from usec="0" sec="1447218019"/>
        <to usec="0" sec="1447218022"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="119.101.123.102"/>
        </slice>
        <from usec="0" sec="1447218196"/>
        <to usec="0" sec="1447218200"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="158.153.68.158" dst_ip="218.114.184.233" dst_port="80"/>
            <filter src_ip="158.153.68.158" dst_ip="186.230.57.170" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218122"/>
        <to usec="0" sec="1447218514"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="75.144.214.4"/>
        </slice>
        <from usec="0" sec="1447218395"/>
        <to usec="0" sec="1447218397"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="135.130.41.169"/>
        </slice>
        <from usec="0" sec="1447218076"/>
        <to usec="0" sec="1447218077"/>
    </anomaly>
    <anomaly type="notice" value="0.803430,1.405700,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="112.199.247.146"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="81.13.96.250"/>
        </slice>
        <from usec="0" sec="1447218230"/>
        <to usec="0" sec="1447218232"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="146.71.11.48"/>
        </slice>
        <from usec="0" sec="1447218627"/>
        <to usec="0" sec="1447218629"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="40.27.167.215"/>
        </slice>
        <from usec="0" sec="1447218062"/>
        <to usec="0" sec="1447218063"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="112.233.95.148"/>
        </slice>
        <from usec="0" sec="1447218007"/>
        <to usec="0" sec="1447218012"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="83.98.91.164"/>
        </slice>
        <from usec="0" sec="1447218891"/>
        <to usec="0" sec="1447218893"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="125.172.227.55"/>
        </slice>
        <from usec="0" sec="1447218380"/>
        <to usec="0" sec="1447218382"/>
    </anomaly>
    <anomaly type="notice" value="0.803430,1.405700,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="140.41.210.100"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.803430,1.405700,020,1 1 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="81.138.250.156"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="138.108.182.165"/>
        </slice>
        <from usec="0" sec="1447218390"/>
        <to usec="0" sec="1447218394"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="201.0.77.150"/>
        </slice>
        <from usec="0" sec="1447218850"/>
        <to usec="0" sec="1447218854"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="110.42.249.188"/>
        </slice>
        <from usec="0" sec="1447218745"/>
        <to usec="0" sec="1447218757"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="135.54.54.155"/>
        </slice>
        <from usec="0" sec="1447218564"/>
        <to usec="0" sec="1447218586"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="104.61.90.135"/>
        </slice>
        <from usec="0" sec="1447218401"/>
        <to usec="0" sec="1447218403"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="46.50.17.81"/>
        </slice>
        <from usec="0" sec="1447218637"/>
        <to usec="0" sec="1447218638"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,020,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="222.48.63.151"/>
        </slice>
        <from usec="0" sec="1447218785"/>
        <to usec="0" sec="1447218786"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="0.214.95.205"/>
        </slice>
        <from usec="0" sec="1447218849"/>
        <to usec="0" sec="1447218851"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="199.29.56.107" src_port="23"/>
        </slice>
        <from usec="0" sec="1447218447"/>
        <to usec="0" sec="1447218452"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="18.53.204.59" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218191"/>
        <to usec="0" sec="1447218203"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,504,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="191.49.118.49" dst_ip="86.94.255.181" dst_port="443"/>
            <filter src_ip="191.49.118.49" dst_ip="34.39.163.68" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218655"/>
        <to usec="0" sec="1447218662"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,502,1 1 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="54.65.215.162" dst_port="22"/>
        </slice>
        <from usec="0" sec="1447218852"/>
        <to usec="0" sec="1447218853"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.90.144.130" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218239"/>
        <to usec="0" sec="1447218246"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="0.236.255.163" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218182"/>
        <to usec="0" sec="1447218189"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="139.11.73.67" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218175"/>
        <to usec="0" sec="1447218381"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="126.189.229.23" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218036"/>
        <to usec="0" sec="1447218047"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="49.206.164.50" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218543"/>
        <to usec="0" sec="1447218545"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="222.78.153.56" dst_ip="161.56.71.196" dst_port="19"/>
            <filter src_ip="222.78.153.56" dst_ip="221.91.183.124" dst_port="19"/>
        </slice>
        <from usec="0" sec="1447218788"/>
        <to usec="0" sec="1447218836"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="90.127.116.94" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218015"/>
        <to usec="0" sec="1447218026"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.224.214.231" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218875"/>
        <to usec="0" sec="1447218888"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="100.247.246.131" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218577"/>
        <to usec="0" sec="1447218596"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="197.98.122.82" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218198"/>
        <to usec="0" sec="1447218203"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="127.249.166.45" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218524"/>
        <to usec="0" sec="1447218549"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="76.226.234.80" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218078"/>
        <to usec="0" sec="1447218083"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="98.69.160.136" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218608"/>
        <to usec="0" sec="1447218619"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="92.96.92.178" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218484"/>
        <to usec="0" sec="1447218492"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="207.93.64.232" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218216"/>
        <to usec="0" sec="1447218218"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="121.61.58.31" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218051"/>
        <to usec="0" sec="1447218062"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.25.129.146" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218895"/>
        <to usec="0" sec="1447218897"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="127.95.178.166" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218544"/>
        <to usec="0" sec="1447218550"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="79.16.126.52" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218002"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="133.108.14.172" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218767"/>
        <to usec="0" sec="1447218778"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="137.167.194.214" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218856"/>
        <to usec="0" sec="1447218878"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="193.246.194.9" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218002"/>
        <to usec="0" sec="1447218140"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="118.17.71.79" dst_ip="221.80.174.45" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218095"/>
        <to usec="0" sec="1447218866"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.214.200.28" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218454"/>
        <to usec="0" sec="1447218477"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="196.104.188.90" src_port="5481" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1447218121"/>
        <to usec="0" sec="1447218391"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="87.219.76.221" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218782"/>
        <to usec="0" sec="1447218793"/>
    </anomaly>
    <anomaly type="notice" value="0.838501,1.399210,010,1 0 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="43.249.104.83" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218740"/>
        <to usec="0" sec="1447218745"/>
    </anomaly>
    <anomaly type="notice" value="0.838501,1.399210,010,1 0 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="112.233.43.147" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218049"/>
        <to usec="0" sec="1447218060"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.80.139.234" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218522"/>
        <to usec="0" sec="1447218534"/>
    </anomaly>
    <anomaly type="notice" value="0.838501,1.399210,010,1 0 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.97.202.134" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218759"/>
        <to usec="0" sec="1447218782"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.196.21.246" dst_ip="161.56.71.196" dst_port="19"/>
            <filter src_ip="163.196.21.246" dst_ip="221.91.183.124" dst_port="19"/>
        </slice>
        <from usec="0" sec="1447218602"/>
        <to usec="0" sec="1447218879"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="120.236.108.253" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218816"/>
        <to usec="0" sec="1447218828"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="46.49.37.100"/>
        </slice>
        <from usec="0" sec="1447218850"/>
        <to usec="0" sec="1447218853"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="77.224.26.254" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218030"/>
        <to usec="0" sec="1447218068"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="211.92.228.74" src_port="5186" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218046"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="186.255.152.147"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="75.122.93.143"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="215.50.117.232"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPICdurp">
        <slice>
            <filter dst_ip="211.92.228.74"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,999,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.240.89.55" dst_port="53"/>
        </slice>
        <from usec="0" sec="1447218023"/>
        <to usec="0" sec="1447218862"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.56.225.225" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.56.7.153" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.92"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.82"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="125.188.218.1"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="114.155.65.198"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="122.85.127.91"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="213.66.255.19"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="220.240.76.82"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,010,1 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="191.40.83.244" dst_port="50356"/>
        </slice>
        <from usec="0" sec="1447218093"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.14"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218226"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,999,1 0 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="220.240.75.246" dst_port="123"/>
            <filter dst_ip="220.240.77.148" dst_port="123"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218867"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,999,1 0 0 0 0 0 1 0 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="191.35.80.142" src_port="53"/>
        </slice>
        <from usec="0" sec="1447218405"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="191.35.7.157" src_port="53"/>
        </slice>
        <from usec="0" sec="1447218405"/>
        <to usec="0" sec="1447218451"/>
    </anomaly>
    <anomaly type="notice" value="0.803430,1.405700,010,1 1 0 0 0 0 1 0 0 0 0 0,DDoSSYN">
        <slice>
            <filter dst_ip="220.240.76.25" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="186.255.84.193" src_port="53"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="191.49.33.69"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.166.52" dst_port="54770"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="72.138.142.172"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,504,1 0 0 0 0 0 1 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="221.91.138.211" dst_port="53"/>
            <filter src_ip="221.91.138.211" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218000"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="4.56.101.14"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.91.132.47"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.56.39.49"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.80.181.235"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="23.99.67.213"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.80.181.239"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.80.177.188"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.91.183.126"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.803430,1.405700,504,1 1 0 0 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="221.91.141.151" dst_port="443"/>
            <filter src_ip="221.91.141.151" dst_port="80"/>
            <filter dst_ip="144.19.191.250" dst_port="443"/>
        </slice>
        <from usec="0" sec="1447218257"/>
        <to usec="0" sec="1447218886"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.97.200.196"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.80.161.181"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="75.122.93.142"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="158.153.253.191" src_port="53"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,999,1 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter src_ip="120.227.91.181" dst_ip="161.56.33.205"/>
            <filter dst_ip="161.56.33.205" dst_port="24184"/>
        </slice>
        <from usec="0" sec="1447218224"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,999,1 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="98.232.163.208" dst_ip="220.240.77.171" dst_port="123"/>
        </slice>
        <from usec="0" sec="1447218163"/>
        <to usec="0" sec="1447218862"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="220.240.73.67"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.250.185"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.803430,1.405700,999,1 1 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="220.240.73.84" dst_port="123"/>
        </slice>
        <from usec="0" sec="1447218043"/>
        <to usec="0" sec="1447218895"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.97.200.213"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="191.40.81.221" dst_port="50348"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.240.77.184"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.240.77.190"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.240.73.91"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.240.77.188"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.250.194"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.240.70.205"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="191.40.81.190"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="142.226.166.80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="197.43.147.105"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.240.76.129"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.56.36.40"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.56.120.125"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="128.26.98.176"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="220.240.70.244"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.97.176.79" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="128.26.48.118"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.166.75" dst_port="54762"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,053,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.56.116.180"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.97.176.92"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="191.35.117.3"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,ptpDoSSYN">
        <slice>
            <filter dst_ip="13.102.110.26"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.80.180.41"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.166.163" dst_port="54770"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.56.64.102"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,rflatDNS">
        <slice>
            <filter dst_ip="191.35.7.157" src_port="53"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.56.64.104"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="169.46.86.70"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.56.221.254"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.97.201.140"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="0.114.4.82"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="220.240.77.83"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.251.120"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,999,1 0 0 0 0 0 1 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="98.232.163.208" dst_ip="220.240.75.160" dst_port="123"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.97.201.146"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="191.40.83.165"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.251.37"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="79.9.75.169"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="220.240.73.208"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="75.133.196.144" dst_ip="220.240.64.177" dst_port="53"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,504,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="158.153.90.31"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.240.75.248"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,020,1 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="129.152.39.6"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,ntscTCPICdurp">
        <slice>
            <filter dst_ip="91.205.6.62"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,020,0 0 0 0 0 0 1 0 0 0 0 0,icmp_error">
        <slice>
            <filter dst_ip="142.226.250.250"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.97.177.21" dst_port="54748"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="161.56.64.31"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.167.176" dst_port="54762"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.240.75.218"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="220.240.75.219"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,010,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.97.177.14"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="221.80.64.50"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="118.19.214.81" dst_ip="220.240.73.70"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="201.21.19.194" dst_ip="221.183.77.56" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="191.35.18.236" src_port="443"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="169.46.13.18" src_port="443"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="191.35.26.99" src_port="443"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="191.35.26.103" src_port="443"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.803430,1.405700,503,1 1 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="158.153.142.194" dst_ip="201.114.27.101" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218002"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,503,1 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="186.255.157.229" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218166"/>
        <to usec="0" sec="1447218829"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="191.35.19.38" src_port="443"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="174.60.211.189" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.343583,1.249260,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="137.34.166.62" dst_ip="221.80.65.14" src_port="80" dst_port="56000"/>
        </slice>
        <from usec="0" sec="1447218793"/>
        <to usec="0" sec="1447218803"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.56.232.248" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.93" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.89" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.91" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.90" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.81" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,503,1 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="221.80.168.137" dst_ip="221.90.134.22" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.56.35.210" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,504,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="191.35.33.15" src_port="443"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.725187,1.384530,053,1 0 0 0 0 0 1 0 0 0 0 0,heavy_hitter">
        <slice>
            <filter src_ip="201.114.27.101" dst_ip="158.153.142.194" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218350"/>
        <to usec="0" sec="1447218868"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="158.153.62.245" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="161.56.164.172" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.14" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.15" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.13" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.5" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="169.46.93.4" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,999,0 0 0 0 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="161.56.64.228" src_port="53"/>
            <filter dst_ip="161.56.64.228"/>
        </slice>
        <from usec="0" sec="1447218180"/>
        <to usec="0" sec="1447218901"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="154.88.175.189" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218022"/>
        <to usec="0" sec="1447218898"/>
    </anomaly>
    <anomaly type="notice" value="0.487496,1.272680,503,1 1 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="221.80.65.230" dst_port="443"/>
            <filter src_ip="221.80.65.230" dst_port="80"/>
        </slice>
        <from usec="0" sec="1447218001"/>
        <to usec="0" sec="1447218899"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,503,0 0 0 0 0 0 1 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="200.42.119.144" dst_ip="158.153.63.166" src_port="80"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
    <anomaly type="notice" value="0.907021,1.420150,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="46.104.39.211" dst_port="23"/>
        </slice>
        <from usec="0" sec="1447218381"/>
        <to usec="0" sec="1447218405"/>
    </anomaly>
    <anomaly type="notice" value="0.897959,1.445910,504,0 0 0 0 0 0 1 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="158.153.15.17" src_port="80"/>
            <filter dst_ip="158.153.15.17" src_port="443"/>
        </slice>
        <from usec="0" sec="1447218450"/>
        <to usec="0" sec="1447218496"/>
    </anomaly>
</admd:annotation>
