[Dshield] Anonymizer?

Sat Aug 2 17:19:33 GMT 2008

   I deliberately picked a "tame" alert to keep the message from getting
censored. I'm sorry if I missed the obvious. Perhaps as Mike Hale
pointed out, a Google search was done that loaded the page and triggered
the snort alerts but no link was clicked so my proxy didn't log
anything. I can duplicate that by searching for Dustysxxx. Apparently my
proxy is not blocking on content. Here is a full alert anyway. Thanks
everyone.

#(2 - 429601) [2008-07-30 14:14:04] [local/1781] [snort/1781]  PORN
dildo
IPv4: MYPROXY -> SUSPECTWS
      hlen=5 TOS=0 dlen=1300 ID=38493 flags=0 offset=0 TTL=64
chksum=28077
TCP:  port=8080 -> dport: 2346  flags=***A**** seq=156623875
      ack=3189117941 off=5 res=0 win=6972 urp=0 chksum=11219
Payload:  length = 1260

000 : 26 75 6D 3D 31 22 2C 22 22 2C 22 6A 4E 68 74 70   &um=1","","jNhtp
010 : 64 75 59 4E 64 6B 4F 50 4D 3A 22 2C 22 68 74 74   duYNdkOPM:","htt
020 : 70 3A 2F 2F 77 77 77 2E 64 75 73 74 79 73 78 78   p://www.dustysxx
030 : 78 2E 63 6F 6D 2F 62 6F 74 77 2F 77 65 6E 64 79   x.com/botw/wendy
040 : 32 32 37 30 36 2E 6A 70 67 22 2C 22 31 30 30 22   22706.jpg","100"
050 : 2C 22 31 35 30 22 2C 22 5C 78 33 63 62 5C 78 33   ,"150","\x3cb\x3
060 : 65 46 54 56 5C 78 33 63 2F 62 5C 78 33 65 20 57   eFTV\x3c/b\x3e W
070 : 65 6E 64 79 20 2D 20 5C 78 33 63 62 5C 78 33 65   endy - \x3cb\x3e
080 : 42 69 67 5C 78 33 63 2F 62 5C 78 33 65 20 48 61   Big\x3c/b\x3e Ha
090 : 6E 67 69 6E 67 20 54 69 74 73 22 2C 22 22 2C 22   nging Tits","","
0a0 : 22 2C 22 37 31 32 20 78 20 31 30 37 32 20 2D 20   ","712 x 1072 - 
0b0 : 34 32 6B 22 2C 22 6A 70 67 22 2C 22 77 77 77 2E   42k","jpg","www.
0c0 : 64 75 73 74 79 73 78 78 78 2E 63 6F 6D 22 2C 22   dustysxxx.com","
0d0 : 22 2C 22 22 2C 22 68 74 74 70 3A 2F 2F 74 62 6E   ","","http://tbn
0e0 : 30 2E 67 6F 6F 67 6C 65 2E 63 6F 6D 2F 69 6D 61   0.google.com/ima
0f0 : 67 65 73 22 2C 22 31 22 2C 5B 5D 29 3B 64 79 6E   ges","1",[]);dyn
100 : 2E 49 6D 67 28 22 68 74 74 70 3A 2F 2F 77 77 77   .Img("http://www
110 : 2E 69 73 65 65 6B 67 69 72 6C 73 2E 63 6F 6D 2F   .iseekgirls.com/
120 : 62 6C 6F 67 2F 32 30 30 37 2F 31 31 2F 31 33 2F   blog/2007/11/13/
130 : 66 74 76 2D 6B 61 6E 64 69 63 65 2D 70 6C 61 79   ftv-kandice-play
140 : 69 6E 67 2D 77 69 74 68 2D 61 2D 62 69 67 2D 64   ing-with-a-big-d
150 : 69 6C 64 6F 2F 26 68 3D 37 35 33 26 77 3D 35 30   ildo/&h=753&w=50
160 : 30 26 73 7A 3D 36 31 26 68 6C 3D 65 6E 26 73 74   0&sz=61&hl=en&st
170 : 61 72 74 3D 36 36 26 75 6D 3D 31 22 2C 22 22 2C   art=66&um=1","",
180 : 22 36 2D 35 74 42 4F 5F 77 6F 58 33 4A 5A 4D 3A   "6-5tBO_woX3JZM:
190 : 22 2C 22 68 74 74 70 3A 2F 2F 77 77 77 2E 69 73   ","http://www.is
1a0 : 65 65 6B 67 69 72 6C 73 2E 63 6F 6D 2F 62 6C 6F   eekgirls.com/blo
1b0 : 67 2F 77 70 2D 63 6F 6E 74 65 6E 74 2F 75 70 6C   g/wp-content/upl
1c0 : 6F 61 64 73 2F 32 30 30 37 2F 31 31 2F 66 74 76   oads/2007/11/ftv
1d0 : 5F 67 69 72 6C 73 5F 6B 61 6E 64 69 63 65 2E 6A   _girls_kandice.j
1e0 : 70 67 22 2C 22 39 34 22 2C 22 31 34 32 22 2C 22   pg","94","142","
1f0 : 5C 78 33 63 62 5C 78 33 65 46 54 56 5C 78 33 63   \x3cb\x3eFTV\x3c
200 : 2F 62 5C 78 33 65 20 4B 61 6E 64 69 63 65 22 2C   /b\x3e Kandice",
210 : 22 22 2C 22 22 2C 22 35 30 30 20 78 20 37 35 33   "","","500 x 753
220 : 20 2D 20 36 31 6B 22 2C 22 6A 70 67 22 2C 22 77    - 61k","jpg","w
230 : 77 77 2E 69 73 65 65 6B 67 69 72 6C 73 2E 63 6F   ww.iseekgirls.co
240 : 6D 22 2C 22 22 2C 22 22 2C 22 68 74 74 70 3A 2F   m","","","http:/
250 : 2F 74 62 6E 30 2E 67 6F 6F 67 6C 65 2E 63 6F 6D   /tbn0.google.com
260 : 2F 69 6D 61 67 65 73 22 2C 22 31 22 2C 5B 5D 29   /images","1",[])
270 : 3B 64 79 6E 2E 49 6D 67 28 22 68 74 74 70 3A 2F   ;dyn.Img("http:/
280 : 2F 73 73 73 6F 7A 65 2E 62 6C 6F 67 73 70 6F 74   /sssoze.blogspot
290 : 2E 63 6F 6D 2F 26 68 3D 32 35 36 26 77 3D 31 37   .com/&h=256&w=17
2a0 : 30 26 73 7A 3D 38 26 68 6C 3D 65 6E 26 73 74 61   0&sz=8&hl=en&sta
2b0 : 72 74 3D 36 37 26 75 6D 3D 31 22 2C 22 22 2C 22   rt=67&um=1","","
2c0 : 45 62 42 46 5F 72 6C 6D 66 43 79 51 42 4D 3A 22   EbBF_rlmfCyQBM:"
2d0 : 2C 22 68 74 74 70 3A 2F 2F 77 77 77 2E 61 73 72   ,"http://www.asr
2e0 : 65 64 61 73 2E 63 6F 6D 2F 69 6D 61 67 65 73 2F   edas.com/images/
2f0 : 6C 69 6E 6B 73 2F 32 35 35 39 31 2E 6A 70 67 22   links/25591.jpg"
300 : 2C 22 37 34 22 2C 22 31 31 31 22 2C 22 5C 78 33   ,"74","111","\x3
310 : 63 62 5C 78 33 65 46 54 56 20 42 69 67 5C 78 33   cb\x3eFTV Big\x3
320 : 63 2F 62 5C 78 33 65 20 42 4F 4F 42 53 20 43 68   c/b\x3e BOOBS Ch
330 : 61 72 6C 6F 74 74 65 22 2C 22 22 2C 22 22 2C 22   arlotte","","","
340 : 31 37 30 20 78 20 32 35 36 20 2D 20 38 6B 22 2C   170 x 256 - 8k",
350 : 22 6A 70 67 22 2C 22 73 73 73 6F 7A 65 2E 62 6C   "jpg","sssoze.bl
360 : 6F 67 73 70 6F 74 2E 63 6F 6D 22 2C 22 22 2C 22   ogspot.com","","
370 : 22 2C 22 68 74 74 70 3A 2F 2F 74 62 6E 30 2E 67   ","http://tbn0.g
380 : 6F 6F 67 6C 65 2E 63 6F 6D 2F 69 6D 61 67 65 73   oogle.com/images
390 : 22 2C 22 31 22 2C 5B 5D 29 3B 64 79 6E 2E 49 6D   ","1",[]);dyn.Im
3a0 : 67 28 22 68 74 74 70 3A 2F 2F 68 6F 74 62 61 62   g("http://hotbab
3b0 : 65 73 2E 70 75 6E 74 2E 6E 6C 2F 69 6E 64 65 78   es.punt.nl/index
3c0 : 2E 70 68 70 25 33 46 72 25 33 44 31 25 32 36 69   .php%3Fr%3D1%26i
3d0 : 64 25 33 44 34 32 39 32 35 32 25 32 36 74 62 6C   d%3D429252%26tbl
3e0 : 5F 61 72 63 68 69 65 66 25 33 44 30 26 68 3D 31   _archief%3D0&h=1
3f0 : 37 35 26 77 3D 34 35 30 26 73 7A 3D 35 33 26 68   75&w=450&sz=53&h
400 : 6C 3D 65 6E 26 73 74 61 72 74 3D 36 38 26 75 6D   l=en&start=68&um
410 : 3D 31 22 2C 22 22 2C 22 75 62 74 63 43 4B 6C 49   =1","","ubtcCKlI
420 : 70 6E 48 72 69 4D 3A 22 2C 22 68 74 74 70 3A 2F   pnHriM:","http:/
430 : 2F 68 6F 74 62 61 62 65 73 2E 70 75 6E 74 2E 6E   /hotbabes.punt.n
440 : 6C 2F 75 70 6C 6F 61 64 2F 50 49 4E 4B 5F 54 4F   l/upload/PINK_TO
450 : 59 2E 6A 70 67 22 2C 22 31 32 37 22 2C 22 34 39   Y.jpg","127","49
460 : 22 2C 22 42 6C 6F 6E 64 65 20 62 61 62 65 20 77   ","Blonde babe w
470 : 69 74 68 20 5C 78 33 63 62 5C 78 33 65 62 69 67   ith \x3cb\x3ebig
480 : 5C 78 33 63 2F 62 5C 78 33 65 20 70 69 6E 6B 20   \x3c/b\x3e pink 
490 : 74 6F 79 20 4D 4F 56 49 45 22 2C 22 22 2C 22 22   toy MOVIE","",""
4a0 : 2C 22 34 35 30 20 78 20 31 37 35 20 2D 20 35 33   ,"450 x 175 - 53
4b0 : 6B 22 2C 22 6A 70 67 22 2C 22 68 6F 74 62 61 62   k","jpg","hotbab
4c0 : 65 73 2E 70 75 6E 74 2E 6E 6C 22 2C 22 22 2C 22   es.punt.nl","","
4d0 : 22 2C 22 68 74 74 70 3A 2F 2F 74 62 6E 30 2E 67   ","http://tbn0.g
4e0 : 6F 6F 67 6C 65 2E 63 6F 6D 2F 69 6D               oogle.com/im