Based on your the log you provided, this alarm relates to traffic outbound from your monitored network, (though I noticed you haven't defined your Protected Network, represented by variable $IN, yet) right?
The internal system is attempting to connect to IP 66.35.229.217, which does not resolve via an inverse lookup. The whois info says it belongs to Savvis Communications Inc. (savvis.net), which appears to be a web-hosting provider, or a "managed IP services provider" in their own words.
When you try to connect a browser to the same destination IP (http://66:35.229.217), you're immediately redirected to another site, http://www.gatorcorporation.com, which is blocked by my content filters as a undesirable web site.
This site has some interesting reverse lookup info.
Non-authoritative answer:
Name: web.balance.gator.COM
Address: 66.35.229.182
Aliases: http://WWW.GATORCORPORATION.COM
It looks like there is a pool of IP addresses that all point back to the alias http://www.gatorcorporation.com to me. Given that, are you sure you don't have some spyware installed?
To answer your original question, yes this looks like a false positive, given what the alarm was supposed to trigger on. That being said, given the info gleaned about the web server involved, you might still want to double-check and make sure that you really aren't impacted by spyware, in light of the "gator" inferences.
I hope this helps,
Alex Arndt
