Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Many hits from

We are getting many hits from domain 2500 hits in less than 24 hours.

We do not have a web and/or ftp server. Our connection to the internet is normally only email and web browsing. Our protection to the ouside world is a Ciso SA520 firewall.

We would like to know the origin of these hits. How can I deduce what type of hits these are?


Everyone's tags (1)
Cisco Employee

Hi, is

Hi, is categorized under Illegal Activities, could you let me  know where  are  you seeing these hits ?

If someone initiates a connection from internet , destined to ASA or hosts behind ASA, its dropped on the ASA by default, however , if host behind ASA is browsing some infected or malicious website , those hosts can get infected.

For more information , you can check logs on ASA or ASDM real time logs.



Prashant Joshi


New Member

I see these hits in SA520

I see these hits in SA520-Status-Reports.

Must say I blocked this URL in SA520-FireWall-Content Filtering-Blocked URLs.

Cisco Employee

Reports page is to display

Reports page is to display the top 10 websites that have been visited or the
top 10 websites that have been blocked by content filtering or ProtectLink URL filtering components.
The page is only active when Content Filtering or ProtectLink URL filtering components are enabled.

I believe you have blocked this website via content filtering and users trying to browse that website and getting blocked and that is the  expected behavior.

From the Report View list, we can choose the type of report to view from the drop-down
list, either Website Hits or Website Blocks. Then click Apply to save your changes.

Click Refresh Data to update the data on the screen.

Click Reset Data to reset the values to 0.

CreatePlease to create content