[Dshield] Anonymizer?

[Tom Fischer]

   I had some p-rn alerts show up in my Snort log, and I'm trying to
figure out why my proxy server did not block the access. The proxy
server shows the accessed url as tbn0.google.com. The Snort alert shows
that url followed by a string of unsavory links. Am I right in
suspecting that this user is accessing an external proxy to anonymize
the traffic? Here is a sample of the alert info:

ttp://tbn0.google.com/images","1",[]);dyn.Img("http://www.jessicaalbasYY
YY.com/tag/tight-jeans/&h=745&w=490&sz=69&hl=en&start=74","","hxe5ocKZgf
h81M:"

   I apologies' for the brevity, I did not want to set off any filters.