<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="31.239.70.213" dst_ip="163.95.224.213" src_port="443" dst_port="51230" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397229"/>
        <to usec="0" sec="1473397994"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="61.67.42.43" dst_ip="163.95.11.218" src_port="38740" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473398088"/>
        <to usec="0" sec="1473398091"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.212.23.218"/>
        </slice>
        <from usec="0" sec="1473397860"/>
        <to usec="0" sec="1473397863"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.196.197.13" dst_ip="54.80.20.94" src_port="42069" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397815"/>
        <to usec="0" sec="1473397819"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="31.239.74.238" dst_ip="163.95.156.78" src_port="443" dst_port="60124" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397749"/>
        <to usec="0" sec="1473397751"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.95.148.32" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397358"/>
        <to usec="0" sec="1473398083"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.95.230.55" dst_ip="195.86.101.68" src_port="59059" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397242"/>
        <to usec="0" sec="1473397911"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="157.178.249.204"/>
        </slice>
        <from usec="0" sec="1473397379"/>
        <to usec="0" sec="1473397382"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.95.225.52" dst_ip="108.30.175.38" src_port="49953" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397667"/>
        <to usec="0" sec="1473398089"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.212.58.58" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397240"/>
        <to usec="0" sec="1473397962"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.95.135.194" dst_ip="210.188.236.38" dst_port="995" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397246"/>
        <to usec="0" sec="1473397849"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.196.134.35"/>
        </slice>
        <from usec="0" sec="1473398034"/>
        <to usec="0" sec="1473398037"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.226.34" dst_ip="173.14.185.117" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397226"/>
        <to usec="0" sec="1473397616"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="202.9.117.18"/>
        </slice>
        <from usec="0" sec="1473397222"/>
        <to usec="0" sec="1473397241"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.9.119.238" dst_ip="31.239.70.220" src_port="49678" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397675"/>
        <to usec="0" sec="1473397677"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="192.4.63.15" dst_ip="151.153.24.190" src_port="50459" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397822"/>
        <to usec="0" sec="1473398049"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.95.127.205"/>
        </slice>
        <from usec="0" sec="1473398092"/>
        <to usec="0" sec="1473398095"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.150.12" dst_ip="192.220.49.73" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397463"/>
        <to usec="0" sec="1473397470"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.5.155.251" dst_ip="104.230.207.58" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397202"/>
        <to usec="0" sec="1473397805"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.151.253"/>
        </slice>
        <from usec="0" sec="1473398001"/>
        <to usec="0" sec="1473398004"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.225.89" dst_ip="205.72.47.174" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397377"/>
        <to usec="0" sec="1473397457"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.10.13.82" dst_ip="163.95.171.103" src_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473398068"/>
        <to usec="0" sec="1473398095"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="157.178.214.85" dst_ip="65.18.25.161" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397366"/>
        <to usec="0" sec="1473397369"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="192.185.231.163"/>
        </slice>
        <from usec="0" sec="1473397210"/>
        <to usec="0" sec="1473398100"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.225.86"/>
        </slice>
        <from usec="0" sec="1473397237"/>
        <to usec="0" sec="1473397383"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.95.127.175" dst_ip="154.241.224.250" src_port="25585" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397236"/>
        <to usec="0" sec="1473397243"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="133.212.252.85" dst_ip="151.153.11.25" src_port="64580" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473398017"/>
        <to usec="0" sec="1473398060"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.151.170"/>
        </slice>
        <from usec="0" sec="1473397961"/>
        <to usec="0" sec="1473397964"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.212.146.183"/>
        </slice>
        <from usec="0" sec="1473397801"/>
        <to usec="0" sec="1473397804"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="202.9.118.94"/>
        </slice>
        <from usec="0" sec="1473397990"/>
        <to usec="0" sec="1473398081"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="133.196.84.102" dst_port="80"/>
            <filter src_ip="133.196.84.102" dst_port="443"/>
        </slice>
        <from usec="0" sec="1473397225"/>
        <to usec="0" sec="1473397828"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.9.115.101" dst_ip="104.230.219.58" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397345"/>
        <to usec="0" sec="1473397356"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="202.9.223.159" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397214"/>
        <to usec="0" sec="1473398100"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="49.106.177.136" dst_ip="202.9.223.84" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397815"/>
        <to usec="0" sec="1473397829"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.95.124.126"/>
        </slice>
        <from usec="0" sec="1473397531"/>
        <to usec="0" sec="1473397534"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="157.178.210.233"/>
        </slice>
        <from usec="0" sec="1473397240"/>
        <to usec="0" sec="1473397268"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.142.41" dst_ip="5.23.18.171" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397721"/>
        <to usec="0" sec="1473397821"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="157.178.254.25"/>
        </slice>
        <from usec="0" sec="1473397232"/>
        <to usec="0" sec="1473397312"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="202.9.116.229" dst_ip="202.7.140.41" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473398038"/>
        <to usec="0" sec="1473398041"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="23.29.247.42" dst_ip="202.6.214.147" src_port="80" dst_port="53533" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397265"/>
        <to usec="0" sec="1473397266"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.240.173"/>
        </slice>
        <from usec="0" sec="1473397208"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.196.208.237"/>
        </slice>
        <from usec="0" sec="1473397870"/>
        <to usec="0" sec="1473397872"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.225.233" dst_ip="203.177.131.127" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397702"/>
        <to usec="0" sec="1473398100"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="150.89.127.38"/>
        </slice>
        <from usec="0" sec="1473397875"/>
        <to usec="0" sec="1473397877"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="157.178.62.165" dst_ip="151.153.24.190" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397479"/>
        <to usec="0" sec="1473398023"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.95.240.145" dst_ip="111.119.5.135" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397607"/>
        <to usec="0" sec="1473397867"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="203.5.156.201"/>
        </slice>
        <from usec="0" sec="1473398021"/>
        <to usec="0" sec="1473398083"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.9.112.182"/>
        </slice>
        <from usec="0" sec="1473397991"/>
        <to usec="0" sec="1473397994"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="218.211.247.15" dst_ip="163.95.11.224" src_port="21162" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397836"/>
        <to usec="0" sec="1473397839"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.95.125.15" dst_ip="199.236.38.65" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397536"/>
        <to usec="0" sec="1473397885"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.9.117.134" dst_ip="183.187.86.55" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397240"/>
        <to usec="0" sec="1473398048"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.196.208.251"/>
        </slice>
        <from usec="0" sec="1473397246"/>
        <to usec="0" sec="1473397249"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="202.9.118.255"/>
        </slice>
        <from usec="0" sec="1473397799"/>
        <to usec="0" sec="1473397802"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.126.184"/>
        </slice>
        <from usec="0" sec="1473397705"/>
        <to usec="0" sec="1473398002"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.196.104.174"/>
        </slice>
        <from usec="0" sec="1473397214"/>
        <to usec="0" sec="1473397493"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.196.85.90"/>
        </slice>
        <from usec="0" sec="1473397874"/>
        <to usec="0" sec="1473398029"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.33.193.85"/>
        </slice>
        <from usec="0" sec="1473397238"/>
        <to usec="0" sec="1473397269"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.9.115.177"/>
        </slice>
        <from usec="0" sec="1473397864"/>
        <to usec="0" sec="1473397867"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.140.209" dst_ip="192.56.187.126" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397564"/>
        <to usec="0" sec="1473397879"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.196.165.76"/>
        </slice>
        <from usec="0" sec="1473398027"/>
        <to usec="0" sec="1473398029"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.126.164"/>
        </slice>
        <from usec="0" sec="1473397214"/>
        <to usec="0" sec="1473397219"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="202.9.116.187"/>
        </slice>
        <from usec="0" sec="1473397375"/>
        <to usec="0" sec="1473397378"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="203.5.143.188" dst_ip="195.88.66.166" src_port="56445" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397250"/>
        <to usec="0" sec="1473397256"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="110.165.204.221"/>
        </slice>
        <from usec="0" sec="1473397274"/>
        <to usec="0" sec="1473397292"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.223.111" dst_ip="50.136.172.153" src_port="58846" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473397607"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.250.30" dst_ip="184.154.245.21" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397734"/>
        <to usec="0" sec="1473397738"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.95.44.234" dst_ip="91.12.187.251" src_port="38005" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397244"/>
        <to usec="0" sec="1473397250"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.95.220.146"/>
        </slice>
        <from usec="0" sec="1473397983"/>
        <to usec="0" sec="1473397986"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.95.184.136" dst_ip="54.103.233.255" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473398045"/>
        <to usec="0" sec="1473398083"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.212.237.118" dst_ip="151.153.24.190" src_port="41321" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397265"/>
        <to usec="0" sec="1473397726"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.39.11" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397531"/>
        <to usec="0" sec="1473397596"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.126.135" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397915"/>
        <to usec="0" sec="1473398090"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="157.178.188.135"/>
        </slice>
        <from usec="0" sec="1473397374"/>
        <to usec="0" sec="1473397383"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="157.178.177.122" dst_ip="151.153.24.153" src_port="60198" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473398052"/>
        <to usec="0" sec="1473398054"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="31.239.78.29" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397427"/>
        <to usec="0" sec="1473397944"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="203.5.136.28" dst_ip="203.5.136.28" proto="udp"/>
        </slice>
        <from usec="0" sec="1473397755"/>
        <to usec="0" sec="1473397850"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="91.100.93.205" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397208"/>
        <to usec="0" sec="1473398067"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="133.196.104.183" dst_ip="91.100.93.208" src_port="49177" dst_port="80"/>
            <filter src_ip="133.196.104.221" dst_ip="91.100.93.208" src_port="49385" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397384"/>
        <to usec="0" sec="1473397487"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.212.61.118" dst_ip="17.248.57.228" src_port="50874" dst_port="443" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397661"/>
        <to usec="0" sec="1473397663"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="134.42.110.39"/>
        </slice>
        <from usec="0" sec="1473397210"/>
        <to usec="0" sec="1473397235"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,901,1 0 0 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="17.248.57.101" dst_ip="17.248.57.101" src_port="50960" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397226"/>
        <to usec="0" sec="1473398016"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.5.137.143" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397206"/>
        <to usec="0" sec="1473398096"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.164.24" dst_ip="8.203.226.130" src_port="60029" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397604"/>
        <to usec="0" sec="1473398017"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="219.152.96.28"/>
        </slice>
        <from usec="0" sec="1473397936"/>
        <to usec="0" sec="1473397939"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.212.99.232"/>
        </slice>
        <from usec="0" sec="1473398017"/>
        <to usec="0" sec="1473398023"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.212.161.204"/>
        </slice>
        <from usec="0" sec="1473397202"/>
        <to usec="0" sec="1473397209"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.95.241.246"/>
        </slice>
        <from usec="0" sec="1473397978"/>
        <to usec="0" sec="1473397980"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.212.245.241"/>
        </slice>
        <from usec="0" sec="1473397705"/>
        <to usec="0" sec="1473397960"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="52.59.105.23"/>
        </slice>
        <from usec="0" sec="1473397921"/>
        <to usec="0" sec="1473398026"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="208.171.49.219"/>
        </slice>
        <from usec="0" sec="1473397538"/>
        <to usec="0" sec="1473397541"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="157.178.214.38" dst_ip="17.248.57.13" dst_port="443"/>
        </slice>
        <from usec="0" sec="1473397390"/>
        <to usec="0" sec="1473397393"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.212.122.34"/>
        </slice>
        <from usec="0" sec="1473398034"/>
        <to usec="0" sec="1473398037"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.196.134.54"/>
        </slice>
        <from usec="0" sec="1473397834"/>
        <to usec="0" sec="1473397836"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.212.162.249"/>
        </slice>
        <from usec="0" sec="1473397467"/>
        <to usec="0" sec="1473397491"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.79.250"/>
        </slice>
        <from usec="0" sec="1473397746"/>
        <to usec="0" sec="1473398058"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="61.83.81.172"/>
        </slice>
        <from usec="0" sec="1473397761"/>
        <to usec="0" sec="1473397913"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.154.76"/>
        </slice>
        <from usec="0" sec="1473397522"/>
        <to usec="0" sec="1473397525"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.95.125.165"/>
        </slice>
        <from usec="0" sec="1473397294"/>
        <to usec="0" sec="1473397296"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="133.196.134.89"/>
        </slice>
        <from usec="0" sec="1473397993"/>
        <to usec="0" sec="1473397997"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="186.187.52.19" dst_ip="203.5.129.74" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397217"/>
        <to usec="0" sec="1473398089"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.212.206.156"/>
        </slice>
        <from usec="0" sec="1473397771"/>
        <to usec="0" sec="1473397773"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="136.204.11.145"/>
        </slice>
        <from usec="0" sec="1473397956"/>
        <to usec="0" sec="1473397958"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.212.201.108"/>
        </slice>
        <from usec="0" sec="1473397255"/>
        <to usec="0" sec="1473397258"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.212.104.117"/>
        </slice>
        <from usec="0" sec="1473397202"/>
        <to usec="0" sec="1473397615"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.159.40"/>
        </slice>
        <from usec="0" sec="1473397607"/>
        <to usec="0" sec="1473397610"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="157.178.250.108"/>
        </slice>
        <from usec="0" sec="1473397333"/>
        <to usec="0" sec="1473397336"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.156.239"/>
        </slice>
        <from usec="0" sec="1473397368"/>
        <to usec="0" sec="1473397952"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="126.15.189.64"/>
        </slice>
        <from usec="0" sec="1473397835"/>
        <to usec="0" sec="1473397840"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="157.178.58.168"/>
        </slice>
        <from usec="0" sec="1473397983"/>
        <to usec="0" sec="1473397986"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="220.69.221.108"/>
        </slice>
        <from usec="0" sec="1473397757"/>
        <to usec="0" sec="1473397972"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="192.4.63.171"/>
        </slice>
        <from usec="0" sec="1473397617"/>
        <to usec="0" sec="1473397620"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.67.108"/>
        </slice>
        <from usec="0" sec="1473397254"/>
        <to usec="0" sec="1473398044"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="157.178.54.150"/>
        </slice>
        <from usec="0" sec="1473397224"/>
        <to usec="0" sec="1473397227"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.196.84.156"/>
        </slice>
        <from usec="0" sec="1473397975"/>
        <to usec="0" sec="1473398035"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.243.119"/>
        </slice>
        <from usec="0" sec="1473397373"/>
        <to usec="0" sec="1473397761"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="131.129.197.3"/>
        </slice>
        <from usec="0" sec="1473397366"/>
        <to usec="0" sec="1473397369"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="17.167.206.47"/>
        </slice>
        <from usec="0" sec="1473397947"/>
        <to usec="0" sec="1473397950"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,011,1 0 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="203.5.142.182" dst_ip="198.196.178.192"/>
            <filter src_ip="203.5.142.182" dst_port="443"/>
            <filter src_ip="133.196.196.223" dst_ip="198.196.178.192" dst_port="443"/>
            <filter src_ip="133.196.196.223" dst_ip="172.109.83.224" dst_port="443"/>
        </slice>
        <from usec="0" sec="1473397204"/>
        <to usec="0" sec="1473398100"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.95.79.245" dst_port="993"/>
            <filter dst_ip="163.95.79.245" dst_port="443"/>
        </slice>
        <from usec="0" sec="1473397313"/>
        <to usec="0" sec="1473398033"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,503,1 1 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="202.9.118.200" dst_ip="31.239.70.244"/>
            <filter src_ip="202.9.118.200" dst_port="80"/>
            <filter src_ip="202.9.116.232" dst_ip="31.239.70.244" dst_port="80"/>
            <filter src_ip="202.9.116.232" dst_ip="173.2.120.81" dst_port="443"/>
        </slice>
        <from usec="0" sec="1473397563"/>
        <to usec="0" sec="1473397828"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="52.78.127.158"/>
        </slice>
        <from usec="0" sec="1473397265"/>
        <to usec="0" sec="1473397268"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.212.246.182" dst_ip="151.153.24.190" dst_port="443"/>
        </slice>
        <from usec="0" sec="1473397817"/>
        <to usec="0" sec="1473398096"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="157.178.11.11"/>
        </slice>
        <from usec="0" sec="1473397648"/>
        <to usec="0" sec="1473397651"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="218.21.231.165" src_port="50675" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397732"/>
        <to usec="0" sec="1473397922"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.5.138.54" dst_port="53" proto="udp"/>
        </slice>
        <from usec="0" sec="1473397571"/>
        <to usec="0" sec="1473397573"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="41.112.202.45"/>
        </slice>
        <from usec="0" sec="1473397347"/>
        <to usec="0" sec="1473397359"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.2.232.54"/>
        </slice>
        <from usec="0" sec="1473397652"/>
        <to usec="0" sec="1473397663"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.2.18.236"/>
        </slice>
        <from usec="0" sec="1473397575"/>
        <to usec="0" sec="1473397583"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="124.187.6.35" dst_port="23" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397258"/>
        <to usec="0" sec="1473397260"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="203.5.159.196"/>
        </slice>
        <from usec="0" sec="1473397746"/>
        <to usec="0" sec="1473397749"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="31.10.24.75"/>
        </slice>
        <from usec="0" sec="1473397881"/>
        <to usec="0" sec="1473397893"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="124.187.116.169"/>
        </slice>
        <from usec="0" sec="1473397898"/>
        <to usec="0" sec="1473397908"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="122.2.94.15"/>
        </slice>
        <from usec="0" sec="1473397755"/>
        <to usec="0" sec="1473397764"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="8.227.233.62"/>
        </slice>
        <from usec="0" sec="1473398064"/>
        <to usec="0" sec="1473398067"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.219.250.86" dst_port="53413" proto="udp"/>
        </slice>
        <from usec="0" sec="1473397523"/>
        <to usec="0" sec="1473397526"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="107.59.107.219"/>
        </slice>
        <from usec="0" sec="1473397584"/>
        <to usec="0" sec="1473397602"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="133.196.131.67" dst_port="80"/>
            <filter src_ip="133.196.131.67" dst_port="443"/>
        </slice>
        <from usec="0" sec="1473397645"/>
        <to usec="0" sec="1473397795"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="82.218.185.206"/>
        </slice>
        <from usec="0" sec="1473397681"/>
        <to usec="0" sec="1473397701"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.218.167.9" dst_port="53413" proto="udp"/>
        </slice>
        <from usec="0" sec="1473397431"/>
        <to usec="0" sec="1473397433"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="167.55.57.252" dst_port="53413" proto="udp"/>
        </slice>
        <from usec="0" sec="1473397483"/>
        <to usec="0" sec="1473397485"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,mptpla">
        <slice>
            <filter dst_ip="204.24.250.106"/>
        </slice>
        <from usec="0" sec="1473397801"/>
        <to usec="0" sec="1473397803"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.6.202.120"/>
        </slice>
        <from usec="0" sec="1473398038"/>
        <to usec="0" sec="1473398041"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="157.178.214.92"/>
        </slice>
        <from usec="0" sec="1473398095"/>
        <to usec="0" sec="1473398098"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.196.135.84"/>
        </slice>
        <from usec="0" sec="1473397506"/>
        <to usec="0" sec="1473397509"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.240.189"/>
        </slice>
        <from usec="0" sec="1473397497"/>
        <to usec="0" sec="1473397500"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.126.224"/>
        </slice>
        <from usec="0" sec="1473397792"/>
        <to usec="0" sec="1473397794"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.95.226.51" dst_ip="17.178.155.240" dst_port="443"/>
        </slice>
        <from usec="0" sec="1473397222"/>
        <to usec="0" sec="1473398079"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="49.98.26.20"/>
        </slice>
        <from usec="0" sec="1473397224"/>
        <to usec="0" sec="1473397227"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.212.237.237"/>
        </slice>
        <from usec="0" sec="1473397567"/>
        <to usec="0" sec="1473397572"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.150.57"/>
        </slice>
        <from usec="0" sec="1473397762"/>
        <to usec="0" sec="1473397765"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="109.98.125.237"/>
        </slice>
        <from usec="0" sec="1473398047"/>
        <to usec="0" sec="1473398050"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="157.178.20.24"/>
        </slice>
        <from usec="0" sec="1473398040"/>
        <to usec="0" sec="1473398043"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="133.196.170.67"/>
        </slice>
        <from usec="0" sec="1473397641"/>
        <to usec="0" sec="1473397644"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="157.178.233.70"/>
        </slice>
        <from usec="0" sec="1473397265"/>
        <to usec="0" sec="1473397268"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.2.118.178"/>
        </slice>
        <from usec="0" sec="1473398038"/>
        <to usec="0" sec="1473398041"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.140.109"/>
        </slice>
        <from usec="0" sec="1473397384"/>
        <to usec="0" sec="1473397387"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.196.212.113"/>
        </slice>
        <from usec="0" sec="1473397295"/>
        <to usec="0" sec="1473397746"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="124.150.186.130"/>
        </slice>
        <from usec="0" sec="1473397373"/>
        <to usec="0" sec="1473397376"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.143.3"/>
        </slice>
        <from usec="0" sec="1473398032"/>
        <to usec="0" sec="1473398035"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="124.150.218.139"/>
        </slice>
        <from usec="0" sec="1473397551"/>
        <to usec="0" sec="1473397554"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.196.190.36"/>
        </slice>
        <from usec="0" sec="1473397947"/>
        <to usec="0" sec="1473397950"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.142.54"/>
        </slice>
        <from usec="0" sec="1473397545"/>
        <to usec="0" sec="1473397967"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.2.250.235"/>
        </slice>
        <from usec="0" sec="1473398023"/>
        <to usec="0" sec="1473398026"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="75.205.11.101"/>
        </slice>
        <from usec="0" sec="1473397795"/>
        <to usec="0" sec="1473397798"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="218.24.104.225"/>
        </slice>
        <from usec="0" sec="1473397933"/>
        <to usec="0" sec="1473397936"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="133.196.191.65"/>
        </slice>
        <from usec="0" sec="1473397989"/>
        <to usec="0" sec="1473397992"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.95.169.53"/>
        </slice>
        <from usec="0" sec="1473397417"/>
        <to usec="0" sec="1473397420"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.127.37"/>
        </slice>
        <from usec="0" sec="1473397318"/>
        <to usec="0" sec="1473397328"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="202.9.119.92"/>
        </slice>
        <from usec="0" sec="1473397301"/>
        <to usec="0" sec="1473397304"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="163.95.153.144"/>
        </slice>
        <from usec="0" sec="1473397897"/>
        <to usec="0" sec="1473397899"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.2.124.156"/>
        </slice>
        <from usec="0" sec="1473397419"/>
        <to usec="0" sec="1473397422"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.196.185.30"/>
        </slice>
        <from usec="0" sec="1473398036"/>
        <to usec="0" sec="1473398039"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="202.17.84.118"/>
        </slice>
        <from usec="0" sec="1473397467"/>
        <to usec="0" sec="1473397470"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ptmplaHTTP">
        <slice>
            <filter src_ip="163.95.136.243"/>
        </slice>
        <from usec="0" sec="1473397521"/>
        <to usec="0" sec="1473397523"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,sptpDoSSYN">
        <slice>
            <filter dst_ip="163.95.170.13"/>
        </slice>
        <from usec="0" sec="1473397974"/>
        <to usec="0" sec="1473397977"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,ntscACK">
        <slice>
            <filter src_ip="202.6.235.140" dst_port="80"/>
            <filter src_ip="202.9.118.195" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397787"/>
        <to usec="0" sec="1473398093"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="17.167.168.239"/>
        </slice>
        <from usec="0" sec="1473397993"/>
        <to usec="0" sec="1473397995"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,010,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.95.86.69"/>
        </slice>
        <from usec="0" sec="1473397214"/>
        <to usec="0" sec="1473397217"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="203.5.142.177"/>
        </slice>
        <from usec="0" sec="1473398089"/>
        <to usec="0" sec="1473398091"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,999,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="203.5.142.178"/>
        </slice>
        <from usec="0" sec="1473397278"/>
        <to usec="0" sec="1473397281"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,503,1 0 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="163.95.126.190" dst_ip="202.7.156.184"/>
            <filter dst_ip="202.7.156.184" dst_port="80"/>
            <filter src_ip="163.95.126.190" dst_ip="202.7.127.77" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473398062"/>
        <to usec="0" sec="1473398067"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,503,1 1 0 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.225.213" dst_ip="202.7.156.196" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397222"/>
        <to usec="0" sec="1473398098"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="163.95.149.158" dst_port="443"/>
            <filter src_ip="163.95.149.158" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397214"/>
        <to usec="0" sec="1473397527"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter dst_ip="104.50.44.141" dst_port="443"/>
            <filter src_ip="163.95.243.78" dst_ip="209.51.118.194" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397531"/>
        <to usec="0" sec="1473397546"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="182.145.23.224" src_port="4073" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397244"/>
        <to usec="0" sec="1473397247"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="130.64.189.215" dst_ip="17.178.145.179" src_port="34006" dst_port="25"/>
            <filter src_ip="130.64.189.215" dst_ip="17.175.211.176" src_port="44150" dst_port="25"/>
            <filter src_ip="130.64.189.215" dst_ip="17.171.37.253" src_port="53" dst_port="58210"/>
            <filter src_ip="130.64.189.215" dst_ip="17.171.37.242" src_port="53" dst_port="65306"/>
        </slice>
        <from usec="0" sec="1473397392"/>
        <to usec="0" sec="1473397416"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="133.196.84.58" dst_port="53"/>
            <filter src_ip="133.196.84.58" dst_port="25"/>
            <filter src_ip="133.196.84.58"/>
        </slice>
        <from usec="0" sec="1473397214"/>
        <to usec="0" sec="1473398090"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="133.212.245.249" dst_ip="17.142.163.223" src_port="47986" dst_port="25"/>
        </slice>
        <from usec="0" sec="1473397957"/>
        <to usec="0" sec="1473397960"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.95.225.59" dst_ip="71.101.171.172" src_port="54627" dst_port="58576"/>
        </slice>
        <from usec="0" sec="1473397600"/>
        <to usec="0" sec="1473397923"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="66.144.195.192" dst_ip="203.5.142.182" src_port="55573" dst_port="25"/>
            <filter src_ip="66.144.195.192" dst_ip="203.5.136.54" src_port="53801" dst_port="25"/>
        </slice>
        <from usec="0" sec="1473397364"/>
        <to usec="0" sec="1473397371"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="115.216.73.243" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397666"/>
        <to usec="0" sec="1473398067"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,999,1 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="223.89.93.252" dst_ip="133.218.233.237" src_port="3219" dst_port="54890"/>
        </slice>
        <from usec="0" sec="1473397839"/>
        <to usec="0" sec="1473397844"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="71.101.171.172" dst_ip="163.95.225.59" src_port="58576" dst_port="54627"/>
        </slice>
        <from usec="0" sec="1473397700"/>
        <to usec="0" sec="1473397745"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.214.141.165" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473398006"/>
        <to usec="0" sec="1473398046"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="121.174.121.86" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397565"/>
        <to usec="0" sec="1473398002"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,999,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="133.196.85.174" dst_ip="46.95.243.112" src_port="3128"/>
        </slice>
        <from usec="0" sec="1473397682"/>
        <to usec="0" sec="1473397841"/>
    </anomaly>
    <anomaly type="notice" value="0.804137,1.246440,503,1 1 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="133.196.84.98" dst_port="80"/>
            <filter src_ip="133.196.84.98" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.750747,1.333880,503,0 1 0 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="163.95.142.41" dst_ip="74.162.68.8" src_port="51718" dst_port="80" proto="tcp"/>
        </slice>
        <from usec="0" sec="1473397731"/>
        <to usec="0" sec="1473397734"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.125.18" dst_ip="64.144.157.150" dst_port="80"/>
        </slice>
        <from usec="0" sec="1473397691"/>
        <to usec="0" sec="1473397869"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,502,1 1 1 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="193.33.193.84" dst_ip="203.5.129.26" src_port="60963" dst_port="22"/>
            <filter src_ip="193.33.193.84" dst_ip="203.5.129.27" src_port="54840" dst_port="22"/>
            <filter src_ip="193.33.193.84" dst_ip="203.5.129.29" src_port="58123" dst_port="22"/>
        </slice>
        <from usec="0" sec="1473397441"/>
        <to usec="0" sec="1473397970"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,999,1 1 0 0 0 0 0 0 0 0 0 0,malphfl">
        <slice>
            <filter src_ip="133.218.228.174" dst_ip="177.55.203.82" src_port="34218" dst_port="8018"/>
        </slice>
        <from usec="0" sec="1473397795"/>
        <to usec="0" sec="1473397796"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,504,1 1 0 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="163.95.115.104" dst_ip="199.236.38.105" src_port="57599" dst_port="443"/>
        </slice>
        <from usec="0" sec="1473397210"/>
        <to usec="0" sec="1473397803"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="61.2.37.11" src_port="44773" dst_port="22"/>
        </slice>
        <from usec="0" sec="1473397922"/>
        <to usec="0" sec="1473397966"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,504,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="163.95.159.164" src_port="443"/>
            <filter dst_ip="163.95.159.164" src_port="80"/>
        </slice>
        <from usec="0" sec="1473397248"/>
        <to usec="0" sec="1473397250"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,999,1 1 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="202.9.216.123" src_port="8889" dst_port="35133"/>
        </slice>
        <from usec="0" sec="1473397565"/>
        <to usec="0" sec="1473397567"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="187.42.86.9" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397866"/>
        <to usec="0" sec="1473397890"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.115.213.196" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397826"/>
        <to usec="0" sec="1473397849"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="210.169.32.248" dst_ip="202.9.216.123" src_port="47972" dst_port="25"/>
            <filter src_ip="210.169.32.248" dst_ip="202.9.216.123" src_port="47971" dst_port="25"/>
        </slice>
        <from usec="0" sec="1473397347"/>
        <to usec="0" sec="1473397350"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="1.6.135.254" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397224"/>
        <to usec="0" sec="1473397247"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="189.193.194.61" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397529"/>
        <to usec="0" sec="1473397541"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="42.50.234.194"/>
        </slice>
        <from usec="0" sec="1473397594"/>
        <to usec="0" sec="1473397595"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="207.29.98.37"/>
        </slice>
        <from usec="0" sec="1473397284"/>
        <to usec="0" sec="1473397285"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="121.154.112.18" src_port="4208" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397686"/>
        <to usec="0" sec="1473397688"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="188.19.95.238" src_port="3106" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397931"/>
        <to usec="0" sec="1473397934"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="115.68.100.16" src_port="3806" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397562"/>
        <to usec="0" sec="1473397564"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.85.63.210" src_port="4472" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397589"/>
        <to usec="0" sec="1473397591"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="185.26.58.49" src_port="48124" dst_port="53"/>
        </slice>
        <from usec="0" sec="1473397586"/>
        <to usec="0" sec="1473397589"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="121.164.115.191" src_port="3964" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397473"/>
        <to usec="0" sec="1473397819"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="112.232.90.127" src_port="3075" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397580"/>
        <to usec="0" sec="1473397661"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="183.212.15.65" src_port="58876" dst_port="2022"/>
        </slice>
        <from usec="0" sec="1473397921"/>
        <to usec="0" sec="1473397923"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="222.100.182.140" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397242"/>
        <to usec="0" sec="1473397252"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="182.225.3.12" src_port="4197" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397880"/>
        <to usec="0" sec="1473397882"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="88.120.204.253" src_port="49052" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397260"/>
        <to usec="0" sec="1473397262"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="49.210.199.81" src_port="3964" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397752"/>
        <to usec="0" sec="1473397755"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="205.54.108.41" src_port="2826" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397731"/>
        <to usec="0" sec="1473397733"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,002,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="218.235.33.62" src_port="56520" dst_port="137"/>
        </slice>
        <from usec="0" sec="1473397794"/>
        <to usec="0" sec="1473397801"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="115.246.189.69" src_port="3072" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397719"/>
        <to usec="0" sec="1473397722"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="222.197.241.242" src_port="6000" dst_port="2202"/>
        </slice>
        <from usec="0" sec="1473397658"/>
        <to usec="0" sec="1473397665"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="95.124.96.12" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397558"/>
        <to usec="0" sec="1473397573"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.241.253.26" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397884"/>
        <to usec="0" sec="1473397898"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="220.216.87.228" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397211"/>
        <to usec="0" sec="1473397250"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="157.178.8.38" dst_ip="17.178.150.161" src_port="56049" dst_port="25"/>
        </slice>
        <from usec="0" sec="1473397575"/>
        <to usec="0" sec="1473397580"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.84.46.38" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473398001"/>
        <to usec="0" sec="1473398012"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="109.220.206.219" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397716"/>
        <to usec="0" sec="1473397731"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="190.196.18.37" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397515"/>
        <to usec="0" sec="1473397539"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="212.192.253.224" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397912"/>
        <to usec="0" sec="1473397925"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="211.101.247.240" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397601"/>
        <to usec="0" sec="1473397966"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="123.95.222.238" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397603"/>
        <to usec="0" sec="1473397622"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="187.44.187.211" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397646"/>
        <to usec="0" sec="1473397659"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="219.52.50.212" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1473397209"/>
        <to usec="0" sec="1473397210"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="58.18.221.222" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397594"/>
        <to usec="0" sec="1473397596"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="84.251.225.253" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397366"/>
        <to usec="0" sec="1473397383"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="187.193.62.195" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397307"/>
        <to usec="0" sec="1473397344"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="211.101.187.223" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397498"/>
        <to usec="0" sec="1473397509"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="211.249.221.226" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397474"/>
        <to usec="0" sec="1473397995"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="104.94.66.230" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397392"/>
        <to usec="0" sec="1473397403"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="181.20.82.231" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397608"/>
        <to usec="0" sec="1473397622"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="59.211.234.37" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397213"/>
        <to usec="0" sec="1473397240"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="191.225.25.211" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473398029"/>
        <to usec="0" sec="1473398067"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="83.53.27.9" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397822"/>
        <to usec="0" sec="1473397847"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.224.127.241" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397209"/>
        <to usec="0" sec="1473397213"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="178.104.200.247" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397788"/>
        <to usec="0" sec="1473397790"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="186.7.152.90" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397912"/>
        <to usec="0" sec="1473397923"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="41.112.251.66" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397207"/>
        <to usec="0" sec="1473397221"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="189.133.137.177" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397562"/>
        <to usec="0" sec="1473397575"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="173.45.148.85" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397811"/>
        <to usec="0" sec="1473397955"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="94.43.163.171" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397636"/>
        <to usec="0" sec="1473397640"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.54.126.89" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397558"/>
        <to usec="0" sec="1473397570"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="94.211.66.98" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473398059"/>
        <to usec="0" sec="1473398090"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="95.79.195.159" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397327"/>
        <to usec="0" sec="1473397378"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="167.7.176.112" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397485"/>
        <to usec="0" sec="1473397502"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="95.100.35.104" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397494"/>
        <to usec="0" sec="1473398053"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="189.32.2.246" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397722"/>
        <to usec="0" sec="1473397745"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="14.130.164.218" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397966"/>
        <to usec="0" sec="1473397995"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="187.62.207.80" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397309"/>
        <to usec="0" sec="1473397334"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="125.155.25.101" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397815"/>
        <to usec="0" sec="1473398096"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="186.140.115.36" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397225"/>
        <to usec="0" sec="1473397268"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="202.156.54.209" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397379"/>
        <to usec="0" sec="1473397393"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="220.193.1.113" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397789"/>
        <to usec="0" sec="1473397802"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="187.143.172.210" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397797"/>
        <to usec="0" sec="1473397808"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="83.48.107.148" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397981"/>
        <to usec="0" sec="1473397994"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="178.49.230.37" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397364"/>
        <to usec="0" sec="1473397387"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="179.150.87.123" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397345"/>
        <to usec="0" sec="1473397356"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="121.132.85.1" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397522"/>
        <to usec="0" sec="1473397547"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="187.42.48.189" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1473397807"/>
        <to usec="0" sec="1473397810"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="81.61.44.160" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397575"/>
        <to usec="0" sec="1473397605"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="183.27.30.162" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397551"/>
        <to usec="0" sec="1473397562"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="124.150.122.152" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473398094"/>
        <to usec="0" sec="1473398100"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="179.57.126.231" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397972"/>
        <to usec="0" sec="1473397974"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="187.47.100.238" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397852"/>
        <to usec="0" sec="1473397876"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="211.110.33.33" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397727"/>
        <to usec="0" sec="1473397840"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="106.236.53.203" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397554"/>
        <to usec="0" sec="1473397567"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="91.97.103.7" dst_port="22"/>
        </slice>
        <from usec="0" sec="1473398045"/>
        <to usec="0" sec="1473398053"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="222.212.54.190" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397246"/>
        <to usec="0" sec="1473397260"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="95.103.202.186" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397248"/>
        <to usec="0" sec="1473397276"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="88.122.118.203" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397762"/>
        <to usec="0" sec="1473397773"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="190.196.119.39" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397681"/>
        <to usec="0" sec="1473397694"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="190.248.136.169" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1473397988"/>
        <to usec="0" sec="1473397993"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="111.247.95.91" dst_port="445"/>
            <filter src_ip="111.247.95.91" dst_port="139"/>
        </slice>
        <from usec="0" sec="1473397200"/>
        <to usec="0" sec="1473397495"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="95.218.200.191" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397568"/>
        <to usec="0" sec="1473397580"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="187.205.182.194" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397882"/>
        <to usec="0" sec="1473397906"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="114.225.253.32" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397706"/>
        <to usec="0" sec="1473397726"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="179.107.37.224" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397204"/>
        <to usec="0" sec="1473397229"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="183.106.212.26" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473398000"/>
        <to usec="0" sec="1473398028"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="61.166.71.31" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397424"/>
        <to usec="0" sec="1473398081"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="220.89.135.30" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397318"/>
        <to usec="0" sec="1473398084"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="187.22.27.157" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397827"/>
        <to usec="0" sec="1473397887"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,sntscSYNt">
        <slice>
            <filter src_ip="207.23.222.241" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397872"/>
        <to usec="0" sec="1473397913"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="122.54.211.14" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473398070"/>
        <to usec="0" sec="1473398081"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="186.42.0.248" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473398066"/>
        <to usec="0" sec="1473398100"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="78.12.186.5" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473398080"/>
        <to usec="0" sec="1473398091"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="201.190.104.128" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397802"/>
        <to usec="0" sec="1473397814"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,020,1 1 1 0 0 0 0 0 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="113.148.66.245"/>
        </slice>
        <from usec="0" sec="1473397228"/>
        <to usec="0" sec="1473397230"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="187.42.48.189" src_port="1433"/>
        </slice>
        <from usec="0" sec="1473397807"/>
        <to usec="0" sec="1473397809"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,011,1 1 0 0 0 0 0 0 0 0 0 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="182.214.80.228" src_port="1433"/>
        </slice>
        <from usec="0" sec="1473397525"/>
        <to usec="0" sec="1473397527"/>
    </anomaly>
    <anomaly type="notice" value="0.533656,1.258690,999,1 1 0 0 0 0 0 0 0 0 0 0,ptmpla">
        <slice>
            <filter src_ip="115.212.143.138" dst_port="53413"/>
        </slice>
        <from usec="0" sec="1473397278"/>
        <to usec="0" sec="1473397281"/>
    </anomaly>
    <anomaly type="notice" value="0.771258,1.315620,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="1.70.55.88" dst_port="23"/>
        </slice>
        <from usec="0" sec="1473397459"/>
        <to usec="0" sec="1473397474"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,504,0 0 0 0 0 0 0 0 0 1 0 0,salphfl">
        <slice>
            <filter src_ip="104.225.206.255"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,504,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="104.233.232.111"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,010,0 0 0 0 0 0 0 0 0 1 0 0,sntscSYNt">
        <slice>
            <filter src_ip="124.247.197.52"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.699117,1.244930,503,1 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="133.196.134.130"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="133.196.196.13"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,503,0 0 0 0 0 0 0 0 0 1 0 0,ntscACK">
        <slice>
            <filter src_ip="163.95.184.138"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,503,0 0 0 0 0 0 0 0 0 1 0 0,point_to_point">
        <slice>
            <filter src_ip="163.95.141.187" dst_ip="112.235.174.195" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="163.95.35.96"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,011,0 0 0 0 0 0 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="203.5.132.72" dst_ip="177.63.196.77" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,999,0 0 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="203.5.159.205" src_port="17269"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="91.95.88.177"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter dst_ip="103.29.116.30"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,503,0 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="63.71.236.254" dst_ip="133.117.35.223" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.699117,1.244930,503,1 0 0 0 0 0 0 0 0 1 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="216.117.75.109" dst_ip="163.95.11.232" dst_port="80"/>
            <filter src_ip="216.117.75.108" dst_ip="163.95.11.232" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,504,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.95.240.56" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,504,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.95.250.119" src_port="80"/>
            <filter dst_ip="163.95.250.119" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.95.169.55" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,503,0 0 0 0 0 0 0 0 0 1 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="163.95.23.114" src_port="80"/>
            <filter dst_ip="163.95.23.114" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,504,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.95.150.76" src_port="443"/>
            <filter dst_ip="163.95.150.76" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,504,0 0 0 0 0 0 0 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="163.95.140.116" src_port="443"/>
            <filter dst_ip="163.95.140.116" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.356254,1.257190,504,1 0 0 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="23.100.143.143" dst_port="443"/>
        </slice>
        <from usec="0" sec="1473397242"/>
        <to usec="0" sec="1473397968"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,999,0 0 0 0 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter dst_ip="185.225.182.180"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="notice" value="0.876126,1.320900,054,0 0 0 0 0 0 0 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="17.157.22.117" dst_ip="202.9.114.165" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
