The remote host is a Remote Utilities server awaiting remote connection requests. Remote Utilities is an application that allows users to access their computers (work or home) from anywhere in the world using the Remote Utilities client. The listening server application establishes a connection to an Internet server and allows the remote client to connect over the established HTTPS connection. As such, Remote Utilities has the ability to bypass firewalls and proxies. NNM has observed the hostname of this system during the session setup.

The remote host is running the Remote Utilities client. This software allows a user to remotely access computer systems running the Remote Utilities listening server over a LAN or via the Internet. NNM has observed the hostname of this system during the session setup.

The remote host is a Remote Utilities server awaiting remote connection requests. Remote Utilities is an application that allows users to access their computers (work or home) from anywhere in the world using the Remote Utilities client. The listening server application establishes a connection to an Internet server and allows the remote client to connect over the established HTTPS connection. As such, Remote Utilities has the ability to bypass firewalls and proxies. NNM has observed the software version during session setup.

The remote host is running the Remote Utilities client. This software allows a user to remotely access computer systems running the Remote Utilities listening server over a LAN or via the Internet. NNM has observed the software version during session setup.

The remote host is running the Remote Utilities client. This software allows a user to remotely access computer systems running the Remote Utilities listening server over a LAN or via the Internet.

The remote host is running the PRTG Network Monitor.

The remote host is running the PRTG Network Monitor. An HTTP server is included in the pool of services being monitored by this instance of PRTG.

The remote host was observed making DNS queries to one or more OpenDNS public DNS servers. Utilizing OpenDNS's public DNS service may allow users to bypass web filtering or circumvent other security measures. Malicious actors may also use these servers in an attempt to discretely reach out to internet resources while remaining undetected.

 OpenDNS Public DNS Addresses :
  - 208.67.220.220
  - 208.67.222.222

The remote host has sent data over port 500 which does not seem to be valid ISAKMP traffic.

The remote host has been observed accessing SoundCloud. SoundCloud is a free online music streaming site that relies on user-submitted original content to promote new artists.

The remote host was detected to be using Tumblr. Tumblr is a network service which allows for sharing of blog posts, images, and videos.

The remote host was detected to be using Pinterest. Pinterest is a 'pin board' application which is used in conjunction with Facebook or Twitter to post images, notes, and other media formats into a feed.

The remote host has been observed accessing Linkedin.com. Linkedin is a business-oriented social networking service mainly used for professional networking.

The remote host has been observed accessing the Glassdoor.com mobile application. Glassdoor is a website where employees and former employees anonymously review companies and their management.

The remote host has been observed accessing Glassdoor.com. Glassdoor is a website where employees and former employees anonymously review companies and their management.

The remote host was observed browsing craigslist.org. Craigslist (styled craigslist) is a classified advertisements website with sections devoted to jobs, housing, personals, for sale, items wanted, services, community, gigs, resumes, and discussion forums.

The remote mobile host has been observed using Tinder. Tinder is a location-based dating and social discovery application (using Facebook) that facilitates communication between mutually interested users, allowing matched users to chat. Note, NNM has observed connections from this host to the following server : 'taurus.iad.appboy.com'.

The remote mobile host has been observed using Tinder. Tinder is a location-based dating and social discovery application (using Facebook) that facilitates communication between mutually interested users, allowing matched users to chat. Note, NNM has observed connections from this host to the following server : 'm.facebook.com'.

The remote mobile host has been observed using Tinder. Tinder is a location-based dating and social discovery application (using Facebook) that facilitates communication between mutually interested users, allowing matched users to chat.

PVS has observed a surge in SSLv2 connection requests from this client.

The remote host is performing a vulnerability scan using Qualys.

The remote host is performing a scan using OpenVAS, an open-source vulnerability scanner.

The remote host is performing a scan using Skipfish, an active web application security reconnaissance tool provided by Google.

The remote host is performing a scan using w3af, the Web Application Attack and Audit Framework.

The remote host is performing a scan using GoLismero, an open-source vulnerability scanner.

The remote host is performing a port scan using Nikto, a popular open-source web vulnerability scanner.

The remote host is performing a web application scan using Nikto, a popular open-source web vulnerability scanner.

The remote host is utilizing Nmap, an open-source network scanner capable of discovering listening services or open ports on remote systems.

The remote host is running Air Video server. Air Video is a software application for Apple OS X which allows multimedia streaming across a number of devices.

The remote host was observed making DNS queries to one or more Google public DNS servers. Utilizing Google's public DNS service may allow users to bypass web filtering or circumvent other security measures. Malicious actors may also use these servers in an attempt to discretely reach out to internet resources while remaining undetected.

 Google Public DNS Addresses :
  - 8.8.8.8
  - 8.8.4.4

The remote DNS client has experienced a surge in activity.

The remote host is a DNS client utilizing TCP. This can be an indicator of malicious activity.

The remote host has sent a large DNS response which contained a TEXT record. Note: TEXT records are a normal DNS request but larger messages should be inspected for possibly malicious traffic.

The remote host has sent data over port 53 which does not seem to be valid DNS traffic.

Tor2web is a software project that allows Tor hidden services to be accessed from a standard browser without being connected to the Tor network. In the past, various malware campaigns and botnets have utilized Tor2Web to exfiltrate data or communicate externally. Recent traffic from this host indicates it has accessed a Tor URL through a known Tor2Web proxy.

The remote host has sent data over port 123 which does not seem to be valid NTP traffic.

The remote host has just made a connection to the i2p network. The i2p network allows users to tunnel traffic anonymously and encrypted to untrackable servers.

The remote host is running Tor Browser.  Tor Browser has successfully connected to a Tor node.

The remote client was observed connecting to a Virtual Private Network (VPN) through an HTTP proxy. The client is configured to use an HTTP proxy to tunnel the VPN connection to an external network. This type of connection allows a local user to connect to a remote network as if they were local users.  A VPN that allows split-tunneling will essentially serve as a bridge between the remote network and the internal network.  Special care should be taken to ensure that remote VPN clients connect securely and do not introduce an unacceptable level of risk to the internal computing environment.

The remote server was just observed making a connection to updates.metasploit.com.  This connection attempt usually indicates a Metasploit server that is downloading updates from the metasploit.com web site.  Metasploit is an attack framework that allows users to automatically exploit and backdoor vulnerable applications via the network.

The remote host has an application installed (such as Superfish) that uses the Komodia SSL Digestor SDK. This SDK is used to perform MitM attacks on all HTTPS connections. This is accomplished by installing a root CA certificate associated with the SDK into the Windows trusted system certificate store. The private keys for many of these root CAs are publicly known. Furthermore, this SDK is insecurely implemented and will report websites that use specially crafted self-signed certificates as trusted to the user.

A MitM attacker can exploit this vulnerability by reading and/or modifying communications encrypted via HTTPS without the user's knowledge.

The remote host is running the Google Gbridge client.  Gbridge is a VPN application which allows a user to chat, share files, share desktops, and more with peers over a VPN connection.

The remote host is configured with the TLS heartbeat message feature and appears to be affected by an out-of-bounds read flaw.  This flaw could allow a remote attacker to read the contents of up to 64KB of server memory, potentially exposing passwords, private keys, and other sensitive data.

The remote host is running the Microsoft Xbox gaming console

ID	Name	Severity
9587	Remote Utilities Listening Server Hostname Detection	Info
9586	Remote Utilities Client Hostname Detection	Info
9585	Remote Utilities Listening Server Version Detection	Info
9584	Remote Utilities Client Version Detection	Info
9581	Remote Utilities Client Detection	Info
9517	PRTG Network Monitor Detection	Info
9516	PRTG Network Monitor Query Detection	Info
9365	OpenDNS Public DNS Usage Detection	Info
7212	Non-ISAKMP Traffic Over Port 500/UDP	Info
9362	SoundCloud Detection	Info
9250	Tumblr Mobile Application Detection	Info
9248	Tumblr Detection via TLS	Info
9247	Pinterest Mobile Application Detection	Info
9245	Linkedin.com Detection	Info
9230	Glassdoor Mobile Application Detection	Info
9228	Glassdoor.com Detection	Info
6321	Pinterest Detection via TLS	Info
9167	craigslist.org Browsing Detected	Info
9166	Tinder Detection via DNS (deprecated)	Info
9165	Tinder Detection via DNS	Info
9162	Tinder Detection on Android	Info
9161	Tinder Detection on iOS	Info
7184	SSLv2 Client Connection Surge	Medium
9092	Qualys Scanner Detection via UDP	Info
9091	OpenVAS Scanner Detection	Info
9090	Skipfish Web Application Scanner Detection	Info
9089	Skipfish Web Application Scanner Detection	Info
9088	w3af Web Application Scanner Detection	Info
9087	GoLismero Security Scanner Detection	Info
9086	Nikto Port Scanning Detection	Info
9085	Nikto Web Server Scanning Detection	Info
9057	Nmap Scanner Detection	Info
9808	Air Video Server Detection	Info
8996	Google Public DNS Usage Detection	Info
7175	DNS Statistical Surge	Info
7174	DNS TCP Connection Detection	Info
7173	DNS TEXT Type Record Detection	Info
7172	Non-DNS Traffic Over Port 53	Info
7177	Tor2Web Access Detection	Medium
7176	Non-NTP Traffic Over Port 123	Info
7170	I2P Outbound Connection Detection	Info
7167	Tor Browser Detection	Info
3177	VPN Tunnel Detection via HTTP CONNECT	Info
3806	Metasploit Server Detection	Info
8930	Komodia SSL Digestor SDK MitM (Detected via HTTP Request)	Medium
8929	Komodia SSL Digestor SDK MitM (Detected via DNS Query)	Medium
8239	Gbridge Client Detection	Info
7108	OpenSSL Heartbeat Information Disclosure (Heartbleed)	High
8094	Xbox Gaming Console Detection	Info
8093	Xbox Gaming Console Detection	Info

Policy Family for Nessus Network Monitor