Many hits from www.3322.org.

[fzanvIT12]

We are getting many hits from domain www.3322.org. 2500 hits in less than 24 hours.

We do not have a web and/or ftp server. Our connection to the internet is normally only email and web browsing. Our protection to the ouside world is a Ciso SA520 firewall.

We would like to know the origin of these hits. How can I deduce what type of hits these are?

Thanks

[Prashant Joshi]

Hi,

www.3322.org is categorized under Illegal Activities, could you let me  know where  are  you seeing these hits ?

If someone initiates a connection from internet , destined to ASA or hosts behind ASA, its dropped on the ASA by default, however , if host behind ASA is browsing some infected or malicious website , those hosts can get infected.

For more information , you can check logs on ASA or ASDM real time logs.

Thanks

Prashant Joshi

[fzanvIT12]

I see these hits in SA520-Status-Reports.

Must say I blocked this URL in SA520-FireWall-Content Filtering-Blocked URLs.

[Prashant Joshi]

Reports page is to display the top 10 websites that have been visited or the
top 10 websites that have been blocked by content filtering or ProtectLink URL filtering components.
The page is only active when Content Filtering or ProtectLink URL filtering components are enabled.

I believe you have blocked this website via content filtering and users trying to browse that website and getting blocked and that is the  expected behavior.

From the Report View list, we can choose the type of report to view from the drop-down
list, either Website Hits or Website Blocks. Then click Apply to save your changes.
•
Click Refresh Data to update the data on the screen.
•
Click Reset Data to reset the values to 0.