VICTIM: GET /xxxxxxxxx HTTP/1.0User-Agent: bHost: 41.236.2.118 VICTIM: POST /w.php?ifc=0 HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: siliconfireware.ruContent-Length: 4Connection: Keep-AlivePragma: no-cachea=23 ATTACKER: GET /?a_id=8614&domainname=siliconfireware.ru&adultfilter=off/w.php?ifc=0 HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Referer: http:/siliconfireware.ru/w.php?ifc=0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: searchportal.information.comConnection: Keep-Alive ATTACKER: GET /index.mas?epl=01990098UlsNZ0sAVVETVRBeUBESQ1sbSUQKWV4CDltTUUpRRgRHUUxKTEpEGhFYElxRAwUWUlBWEQ1aQz4DWVpbU1FVWAQSFksEVAEAVAdSVglXVxUAaw9TXg0BUFUTVFxNWEUDXFgWXUtYXFIHHxVNSA0WDAhSBRJQUQdHBVpYWVFaXwRYUV9LUAlaVw5eBApKABFSE1FIRRY HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Referer: http:/siliconfireware.ru/w.php?ifc=0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: searchportal.information.comConnection: Keep-Alive ATTACKER: GET /?epl=04300036UlsNZ0sAVVETVRBeUBESQ1sbSUQKWV4CDltTUUpRRgRHUUxKTEpEGhFYElxRAwUWUlBWEQdQRAgGW2pRXAkFVBNXA0xcAlxGGA0QBl8MCV0SEghYF2pVDQ5WXl1cCQBDQUdfCQtRBgNRBVNRCUMHbAhQWw9VBANHE1RbXGdHVABRCVYBClMAA1kAWkVZARNfFVIPWxdQRVwOU1MXTxpBDUULC15aQABQURYWBksROVoFCVMCVBNTDgxUXFZWVVwACEcLVFAGXFoHWRAGTwQUVk9GExETWkcUD1FQSgVbVwMTRApZSgAOWA5RBkVUCgVSDWsOWBZHClBVE0ZUUVdUOlxQXwofBlxBD0QQGgUwNRUEUgBSAEFeFwRqWVlWU0QEUlFfXVdDUkEVXxYGSxE5XBFAD1gNal4FXAMACg0ACFUMDQ HTTP/1.0Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990098UlsNZ0sAVVETVRBeUBESQ1sbSUQKWV4CDltTUUpRRgRHUUxKTEpEGhFYElxRAwUWUlBWEQ1aQz4DWVpbU1FVWAQSFksEVAEAVAdSVglXVxUAaw9TXg0BUFUTVFxNWEUDXFgWXUtYXFIHHxVNSA0WDAhSBRJQUQdHBVpYWVFaXwRYUV9LUAlaVw5eBApKABFSE1FIRRYUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: searchportal.information.comConnection: Keep-AliveCookie: ident=click:0%7csearch:0%7cexitpop:0%7ctoken:qxztvqryvvuurrsy%7clload:0%7clvisit:1245705121; siliconfireware.ru=click:0%7csearch:0%7cexitpop:0%7clload:0%7clvisit:1245705121; Spusr=ac15000a6b5c4a3ff3a1632d ATTACKER: GET /skins/universal/V/images/bul_brown.gif HTTP/1.0Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990098UlsNZ0sAVVETVRBeUBESQ1sbSUQKWV4CDltTUUpRRgRHUUxKTEpEGhFYElxRAwUWUlBWEQ1aQz4DWVpbU1FVWAQSFksEVAEAVAdSVglXVxUAaw9TXg0BUFUTVFxNWEUDXFgWXUtYXFIHHxVNSA0WDAhSBRJQUQdHBVpYWVFaXwRYUV9LUAlaVw5eBApKABFSE1FIRRYUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive VICTIM: POST /w.php?ifc=0 HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: ebookfinaltrash.ruContent-Length: 4Connection: Keep-AlivePragma: no-cachea=23 VICTIM: POST /w.php?ifc=0 HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: ebookfinaltrash.ruContent-Length: 4Connection: Keep-AlivePragma: no-cachea=23 VICTIM: POST /w.php?ifc=0 HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Accept-Language: en-usContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: siliconfireware.ruContent-Length: 4Connection: Keep-AliveCache-Control: no-cachea=23 ATTACKER: GET /?a_id=8614&domainname=siliconfireware.ru&adultfilter=off/w.php?ifc=0 HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Referer: http:/siliconfireware.ru/w.php?ifc=0Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: searchportal.information.comConnection: Keep-Alive ATTACKER: GET /index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlc HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Referer: http:/siliconfireware.ru/w.php?ifc=0Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: searchportal.information.comConnection: Keep-Alive ATTACKER: GET /?epl=04000004UlsNZ0sAVVETVRBeUBESQ1sbSUQKWV4CDltTUUpRRgRHUUxKTEpEGhFYElxRAwUWUlBWEQdQRAgGW2pRXAkGVwESAVlNAFRbE0lfEV0CD1wPR0BZDEFoAw1aVlNdUAxUE0ARBQhXBwFWAFdWDFxAUj5dAgpbAwZVR0dUVlxrQgBQUF8ODFMGA1EGUVUeBAJGDUAAXg9BUhNcWlNeF0MfFV1EXVFfBhYHBQBEB1cIB1oPWgdaBghECA1cVldWUlgXUEMDSlxLQUFHQA0TTQsCVhMJCVEFE0cJAEZQBVRbUAETWA1bWAlsXA5FEF4JUUBQDkEIQxFMCjQyE1BeXlFSEVxCB2dVBF1TFFEFBgUACBUAQRJYF1BEFT5aRUxRW186XFBfDgxXBgBYAVJR HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: searchportal.information.comConnection: Keep-AliveCookie: ident=click:0%7csearch:0%7cexitpop:0%7ctoken:rwzstsssyuusypyy%7clload:0%7clvisit:1245705548; siliconfireware.ru=click:0%7csearch:0%7cexitpop:0%7clload:0%7clvisit:1245705548; Spusr=ac15000a7ab94a3ff54c5241 ATTACKER: GET /skins/universal/V/images/internet-circles/body_bg.jpg HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive ATTACKER: GET /skins/universal/V/images/internet-circles/container_bg.jpg HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive ATTACKER: GET /skins/universal/V/images/internet-circles/td_bg.jpg HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive ATTACKER: GET /skins/universal/V/images/internet-circles/keywords_bg.jpg HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive ATTACKER: GET /skins/universal/V/images/internet-circles/pop_cat_bottom.jpg HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive ATTACKER: GET /skins/universal/V/images/internet-circles/pop_cat_top.jpg HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive ATTACKER: GET /skins/universal/V/images/internet-circles/searchtext_bg.jpg HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive ATTACKER: GET /skins/universal/V/images/internet-circles/search.jpg HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive ATTACKER: GET /skins/universal/V/images/internet-circles/bullet.jpg HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive ATTACKER: GET /skins/universal/V/images/internet-circles/footer_bg.jpg HTTP/1.1Accept: */*Referer: http:/searchportal.information.com/index.mas?epl=01990055VFAXVE0DWlgVVRBeVwMAHBYaFl8TCl4HAhAGXAgSVgpaaxBdXwBBURMNChdMFVwcTkcPWwpWWA8HXEddT1VDABtGFxdOS0NcEQ8LBVtAVVdREgJYDlReDw9UWF0FR1gJXFcNVl8MQVEWURAGFhcTFQ9bEmgBWVgCClBRBQkSRRYIBVAMDFIDAVQEWkVZOg9XXAxQBlcAccept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)Host: spi.domainsponsor.comConnection: Keep-Alive