MD5: 253e4d8fb195a5ed459a1ae5096cfb21
SHA1: badb3aac16f2ce95ba39497229917a65beef6b19
SHA256: f88acbb8aea993490052affa986968f62a255a53ca6a6bb3a2e739c3356f4bcf
SSDeep: 49152:ajNexZrgPrX3SI8b/IV9sVHK6RhVMVqo8x5T97WK31a:sNgZrgl8bw7sZtREVR88K8
Size: 3391488 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: Rational Thought Solutions
Created at: 2015-04-30 21:40:03
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:432

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:432 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top2_v1[1].jpg (6580 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-1.4.4.min[2].js (1645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\request[1].js (145 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\reset[1].css (25 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (146 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\index[1].css (11773 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ccc[1].css (1485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\login_lianm4[1].htm (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-1.4.4.min[1].js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sanyangbinggui[2].htm (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ztsp_052[1].jpg (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ztsp_051[1].jpg (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tc[1].jpg (5068 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sanyangbinggui[4].htm (104 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@q1[1].txt (504 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@q1[2].txt (252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\app[1].gif (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAAJSLQN.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sanyangbinggui[3].htm (104 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index[1].htm (7476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\body[1].jpg (13647 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (203 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (289 bytes)
%Documents and Settings%\%current user%\Application Data\E_UIEngine\90afea1eeb37be7a93471c36152ab43a\90afea1eeb37be7a93471c36152ab43a.jpg.data (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA5OWN5L.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\login_150722_v1[1].htm (644 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sanyangbinggui[5].htm (104 bytes)
%Documents and Settings%\%current user%\Application Data\E_UIEngine\90afea1eeb37be7a93471c36152ab43a\90afea1eeb37be7a93471c36152ab43a.jpg (1924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top1_v1[1].jpg (5440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\zhuc_tit[1].gif (1439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[2].php (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\main[1].jpg (7296 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ztgame[1].txt (1443 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (176 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\trh168[1].htm (5461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sanyangbinggui[1].htm (104 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ztgame[2].txt (954 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (21976 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\down[1].gif (4538 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (255 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\login_150722[1].htm (645 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@ztgame[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@q1[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sanyangbinggui[4].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ztgame[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@q1[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-1.4.4.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sanyangbinggui[2].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\app[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sanyangbinggui[3].htm (0 bytes)

Registry activity

The process %original file name%.exe:432 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1430419203"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 3C 16 4B 10 93 63 AF 8D 5B 7E BA 76 23 26 2A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://141.dg.g2g1.com/
hxxp://www.cfmogu.com/1.htm	192.126.113.201
hxxp://cc.zgunion.cn/mshow.aspx?AID=10851	115.236.16.240
hxxp://cc.zgunion.cn/AP5Min.aspx?AID=10851&Auth=AC1D06D058020A33AFD6BCAC2CBB56483F9888B8FEE2AD1FD4A83D36D630BA79&referer=http://www.sanyangbinggui.cn/&utz=1439574512452	115.236.16.240
hxxp://cc.zgunion.cn/AP5Min.aspx?AID=10851&Auth=AC1D06D058020A33AFD6BCAC2CBB56483F9888B8FEE2AD1FD4A83D36D630BA79&referer=http://www.sanyangbinggui.cn/&utz=1439574512655	115.236.16.240
hxxp://cc.zgunion.cn/AP5Min.aspx?AID=10851&Auth=AC1D06D058020A33AFD6BCAC2CBB56483F9888B8FEE2AD1FD4A83D36D630BA79&referer=http://www.sanyangbinggui.cn/&utz=1439574513999	115.236.16.240
hxxp://cc.zgunion.cn/AP5Min.aspx?AID=10851&Auth=AC1D06D058020A33AFD6BCAC2CBB56483F9888B8FEE2AD1FD4A83D36D630BA79&referer=http://www.sanyangbinggui.cn/&utz=1439574514045	115.236.16.240
hxxp://counter.ztgame.com.ztinfoga.com/ref.php?ref=2478161&return_url=http://zt.ztgame.com/index.html?ad=2478161	101.226.182.61
hxxp://cc.zgunion.cn/AP5Min.aspx?AID=10851&Auth=AC1D06D058020A33AFD6BCAC2CBB56483F9888B8FEE2AD1FD4A83D36D630BA79&referer=http://www.sanyangbinggui.cn/&utz=1439574515264	115.236.16.240
hxxp://p.huluwa8.com/2/1878.html?uid=14516
hxxp://1st.ecoma.glb0.lxdns.com/jump3.html?p=20113164&from=offsite&wp=1&sid=14516
hxxp://xnop006.tlgslb.com/index.html?ad=2478161
hxxp://shangmen.fzyol.com/yjm/
hxxp://1st.ecoma.glb0.lxdns.com/p/20113164?from=offsite&sid=14516&wp=1&cps=&r=1003
hxxp://1st.ecoma.glb0.lxdns.com/1003?p=20113164
hxxp://xnop006.tlgslb.com/css/v12/reset.css
hxxp://xnop006.tlgslb.com/css/v12/intro/index.css
hxxp://d.86fm.com/appios.asp?ref=18mobappios&pid=5269	122.225.105.102
hxxp://p23.tcdn.qq.com/landingpage/20140925.css
hxxp://p.huluwa8.com/api/c.php?platform_id=2&union_id=1878&union_type=1&link_id=0
hxxp://p.huluwa8.com/js/2/g2.js?0.3310466620431648
hxxp://xnop006.tlgslb.com/images/v12/intro/ztsp_051.jpg
hxxp://xnop006.tlgslb.com/images/v12/intro/ztsp_052.jpg
hxxp://xnop5002.tlgslb.com/webjs/lib/seajs/seajs/3.0.0/sea.js
hxxp://p.huluwa8.com/2/
hxxp://xnop5002.tlgslb.com/webjs/lib/jquery/jquery/1.7.2/jquery.js?20150720
hxxp://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js	180.149.136.219
hxxp://1st.ecoma.glb0.lxdns.com/swfs/2e/17500fdsah/index.swf
hxxp://1st.ecoma.glb0.lxdns.com/images/vali_sprite.png
hxxp://p.huluwa8.com/p/2/1878/0/2.js?uid=14516&lt=15516&key=0&tid=1&0.08844176864198688
hxxp://1st.ecoma.glb0.lxdns.com/swfs/2e/17500fdsah/bg.jpg
hxxp://1st.ecoma.glb0.lxdns.com/swfs/2e/17500fdsah/bg.swf
hxxp://allmy.6711.com/api/login.php?action=status&game_id=90&server_id=6767&callback=_loginCheck&tid=2&0.07878923819038785
hxxp://1st.ecoma.glb0.lxdns.com/love/image/logo/logo_ipad.png
hxxp://1st.ecoma.glb0.lxdns.com/zhenai3/zhenai2012/js/lib/jquery-1.8.3.min.js
hxxp://1st.ecoma.glb0.lxdns.com/swfs/2e/17500fdsah/ren.swf
hxxp://1st.ecoma.glb0.lxdns.com/swfs/2e/17500fdsah/ren01.swf
hxxp://shangmen.fzyol.com/yjm/landing_page_new.js
hxxp://1st.ecoma.glb0.lxdns.com/swfs/2e/17500fdsah/sound.swf
hxxp://p.huluwa8.com/p/2/1878/0/5.js?uid=14516&lt=18266&key=0&tid=3&0.2769682448994523
hxxp://p23.tcdn.qq.com/landingpage/loading.gif
hxxp://trh168.com/	180.131.56.198
hxxp://js.users.51.la/18216795.js	117.21.226.37
hxxp://weibo.grid.sinaedge.com/news/content2014/jquery-1.11.1.min.js
hxxp://icon.51.la/icon_0.gif	42.236.73.3
hxxp://xnop012.tlgslb.com/style/xiu/v1/css/xiu_v.12.css?20150720
hxxp://xnop012.tlgslb.com/style/xiu/v1/css/xiu_base_v.2.css?20150720
hxxp://trh168.com/js/DD_Deldtedng	180.131.56.198
hxxp://trh168.com/css1/ccc.css	180.131.56.198
hxxp://xnop012.tlgslb.com/style/xiu/v1/css/sub/xiu_sns_v.1.css?20150720
hxxp://q1.xdwscache.ourwebcdn.com/login/login_lianm4.html?radid=lm03_lw&rsid=14516&check=1
hxxp://xnop012.tlgslb.com/style/xiu/v1/css/sub/xiu_login_v.2.css?20150720
hxxp://gp1.wac.v2cdn.net/popWareDetail/jfs/t712/106/1425118530/521379/1040476c/553f1d53Nc9dd9e7b.jpg
hxxp://xnop012.tlgslb.com/style/xiu/woxiu/v1/css/base_v.1.css?20150720
hxxp://xnop012.tlgslb.com/style/xiu/base/v1/css/gift_v.1.css?20150720
hxxp://xnop012.tlgslb.com/style/xiu/woxiu/v1/css/live_v.2.css?20150720
hxxp://xnop012.tlgslb.com/style/xiu/v1/css/sub/xiu_guide_v.8.css?20150720
hxxp://p23.tcdn.qq.com/landingpage/images_0925/104506944.jpg
hxxp://p23.tcdn.qq.com/landingpage/images_0925/108722559.jpg
hxxp://vip.hyc.org.cn.w.alikunlun.com/music.swf?music=hxxp://rm.sina.com.cn/wm/VZ200705101138395899VK/music/p17_42.mp3	222.73.134.110
hxxp://p23.tcdn.qq.com/landingpage/images_0925/107493457.jpg
hxxp://p23.tcdn.qq.com/landingpage/images_0925/108671561.jpg
hxxp://q1.xdwscache.ourwebcdn.com/jquery/jquery-1.4.4.min.js?v=1
hxxp://q1.xdwscache.ourwebcdn.com/js/request.js?v=20140627
hxxp://xnop012.tlgslb.com/webjs/page/common/header/1.0/module.js?20150720
hxxp://q1.xdwscache.ourwebcdn.com/zhuce/login_150722.html
hxxp://q1.xdwscache.ourwebcdn.com/lw/js/tongji?v=1
hxxp://xnop012.tlgslb.com/style/xiu/v1/js/ui/f2e_woxiu.js?20150720
hxxp://q1.xdwscache.ourwebcdn.com/zhuce/login_150722_v1.html
hxxp://p23.tcdn.qq.com/landingpage/images_0925/105582094.jpg
hxxp://xnop012.tlgslb.com/script/page/xiu/v3/swfobject.js?20150720
hxxp://q1.xdwscache.ourwebcdn.com/jquery/jquery-1.4.4.min?v=1
hxxp://p23.tcdn.qq.com/landingpage/images_0925/82814631.jpg
hxxp://q1.xdwscache.ourwebcdn.com/lw/images/login/login150731/top2_v1.jpg
hxxp://q1.xdwscache.ourwebcdn.com/lw/images/login/login150731/top1_v1.jpg
hxxp://q1.xdwscache.ourwebcdn.com/s/passport/Scripts/Common/CommonV1?v=20120518
hxxp://p23.tcdn.qq.com/landingpage/images_0925/94636632.jpg
hxxp://p23.tcdn.qq.com/landingpage/images_0925/110576353.jpg
hxxp://q1.xdwscache.ourwebcdn.com/lw/images/login/login150731/body.jpg
hxxp://q1.xdwscache.ourwebcdn.com/lw/images/login/login150731/main.jpg
hxxp://p23.tcdn.qq.com/landingpage/images_0925/108781221.jpg
hxxp://q1.xdwscache.ourwebcdn.com/s/passport/Scripts/Common/form_validatorV1?v=20120518
hxxp://weibo.grid.sinaedge.com/wm/VZ200705101138395899VK/music/p17_42.mp3
hxxp://q1.xdwscache.ourwebcdn.com/js/request?v=20140627
hxxp://xnop012.tlgslb.com/upload/js/badge.js?20150720
hxxp://p23.tcdn.qq.com/landingpage/images_0925/107881660.jpg
hxxp://q1.xdwscache.ourwebcdn.com/lw/images/login/login150731/down.gif?v=1
hxxp://q1.xdwscache.ourwebcdn.com/zhuce/
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/home_bg/bg01.jpg
hxxp://xnop012.tlgslb.com/upload/xiu/95/40/qq-grrqhbaotm_56.com_150814204101.jpg
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/bg/rev_marquee.png
hxxp://xnop012.tlgslb.com/webjs/page/play/room/player/1.0/module.js?v=20150814
hxxp://q1.xdwscache.ourwebcdn.com/s/passport/Scripts/Action/zhuce_140922?v=1
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/upload/yl02.jpg
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/upload/yl04.png
hxxp://xnop012.tlgslb.com/webjs/page/common/footer/1.0/module.js?v=20150814
hxxp://xnop012.tlgslb.com/style/xiu/woxiu/v1/img/base/iux_w.png
hxxp://xnop012.tlgslb.com/webjs/page/play/room/home/1.0/module.js?v=20150814
hxxp://q1.xdwscache.ourwebcdn.com/lw/images/login/login150722/zhuc_tit.gif?v=1
hxxp://p23.tcdn.qq.com/landingpage/images_0925/110523568.jpg
hxxp://xnop012.tlgslb.com/upload/js/cnzzstat.js
hxxp://q1.xdwscache.ourwebcdn.com/lw/images/login/login150722/tc.jpg?v=1
hxxp://xnop5002.tlgslb.com/flashApp/vshow_player_woxiu.15.06.26.a.swf
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/upload/yl05.png
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/bg.png?v=0531
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/upload/yl06.png
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=4367119&web_id=4367119
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/topic/Satyr_Game/Satyr_Game_icon.png
hxxp://q1.xdwscache.ourwebcdn.com/c/JS/WebVisit?v=20130404
hxxp://xnop012.tlgslb.com/style/xiu/woxiu/v1/img/base/mail.gif
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=4367119&t=z
hxxp://oz.cnzz.com/stat.htm?id=4367119&r=&lg=en-us&ntime=none&cnzz_eid=703645937-1439574404-&showp=1276x846&t=value、月月的房间-在线演艺平台-我...&h=1&rnd=1001760940	198.11.132.200
hxxp://xnop012.tlgslb.com/webjs/page/common/base/1.0/module.js?v=20150814
hxxp://xnop012.tlgslb.com/webjs/page/play/common/chat/1.0/module.js?v=20150814
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/activity/super_web/bar_leaf01.png
hxxp://xnop012.tlgslb.com/style/xiu/woxiu/v1/img/bg/bg_car.jpg
hxxp://xnop012.tlgslb.com/style/xiu/woxiu/v1/img/bg/car_line.jpg
hxxp://p23.tcdn.qq.com/landingpage/images_0925/107644834.jpg
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/base/adimn_hz.png
hxxp://xnop012.tlgslb.com/webjs/page/play/common/gift/1.0/module.js?v=20150814
hxxp://xnop012.tlgslb.com/style/xiu/woxiu/v1/img/base/pan_ulogo.png
hxxp://q1.xdwscache.ourwebcdn.com/c/JS/WebClick?v=20130404
hxxp://xnop012.tlgslb.com/webjs/page/play/room/zhubo/1.0/module.js?v=20150814
hxxp://1st.ecoma.glb0.lxdns.com/crossdomain.xml?ver=1
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/bg/rev_icon_h.png
hxxp://p23.tcdn.qq.com/landingpage/images_0925/108613721.jpg
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/base/iux_h.png
hxxp://1st.ecoma.glb0.lxdns.com/crossdomain.xml
hxxp://xnop012.tlgslb.com/webjs/page/play/room/recommend/1.0/module.js?v=20150814
hxxp://xnop012.tlgslb.com/style/xiu/woxiu/v1/img/upload/zb_tips.gif
hxxp://xnop012.tlgslb.com/webjs/page/play/common/hdcommon/1.0/module.js?v=20150814
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/icon_v1.gif
hxxp://p23.tcdn.qq.com/landingpage/images_0925/111637032.jpg
hxxp://xnop012.tlgslb.com/webjs/page/play/room/userlist/1.0/viewers.js?v=20150814
hxxp://all.cnzz.com.danuoyi.tbcache.com/c.php?id=5127645
hxxp://xnop012.tlgslb.com/style/xiu/woxiu/v1/img/bg/zyxupop.png
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/activity/car_code.png
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/h_gift_small_v_1.png
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5127645&t=q
hxxp://xnop042.tlgslb.com/crossdomain.xml
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=Play&do=InitPlay&id=1003&userid=1439574551733&chatflag=0&t=0.5279487099684342
hxxp://oz.cnzz.com/stat.htm?id=5127645&r=http://lw.q1.com/login/login_lianm4.html?radid=lm03_lw&rsid=14516&check=1&lg=en-us&ntime=1439573297&cnzz_eid=1318753598-1439573297-http://lw.q1.com/&showp=1276x846&t=深圳冰川网络股份有限公司&h=1&rnd=175355424	198.11.132.200
hxxp://oz.cnzz.com/stat.htm?id=5127645&r=http://lw.q1.com/login/login_lianm4.html?radid=lm03_lw&rsid=14516&check=1&lg=en-us&ntime=none&cnzz_eid=1318753598-1439573297-http://lw.q1.com/&showp=1276x846&t=深圳冰川网络股份有限公司&h=1&rnd=1797728833	198.11.132.200
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=Play&do=UpdateRoom&room_user_id=qq-grrqhbaotm&user_id=1439574551733&type=&islive=y&t=0.8944996767820068
hxxp://p23.tcdn.qq.com/landingpage/images_0925/91472312.jpg
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/activity/Rob_gf_medal.png
hxxp://p23.tcdn.qq.com/landingpage/images_0925/106730492.jpg
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1151261426	42.120.219.171
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=564142903	42.120.219.171
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/topic/zb_union/play_icon.png
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/rev/rev_gift.png
hxxp://xnop5002.tlgslb.com/style/xiu/v1/img/rev/sub/ph_flower.png?v=0910
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=Play&do=getUserListPart2&room_user_id=qq-grrqhbaotm&user_id=1439574551733&t=0.7839964297304807
hxxp://p23.tcdn.qq.com/landingpage/images_0925/106779355.jpg
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/rev/rev_icon.png
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/base/renrenIcon.png
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=1&t=0.25663908058275875
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/rev/rev_face_vip.png
hxxp://cnzz.mmstat.com/app.gif?&cna=ERhVDn4rygUCAcLyYNrtvDDJ	42.120.219.171
hxxp://cnzz.mmstat.com/app.gif?&cna=ERhVDkCWFB4CAcLyYNrWiH2	42.120.219.171
hxxp://p23.tcdn.qq.com/landingpage/images_0925/58404730.jpg
hxxp://xnop5002.tlgslb.com/style/xiu/v1/js/DD_belatedPNG_0.0.7a-min.js
hxxp://p23.tcdn.qq.com/landingpage/images_0925/104878950.jpg
hxxp://p23.tcdn.qq.com/landingpage/images_0925/106801898.jpg
hxxp://xnop5002.tlgslb.com/style/xiu/v1/img/rev/sub/ph_flower.png
hxxp://xnop5002.tlgslb.com/style/xiu/v1/img/face/x/laugh.gif
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=play&do=getRoomBadge&t=0.5447824661582423&room_user_id=qq-grrqhbaotm
hxxp://1st.ecoma.glb0.lxdns.com/photo/68/22/qq-hxqmxmkhmx_56.com_.jpg?t=2014022615
hxxp://1st.ecoma.glb0.lxdns.com/photo/60/0/qq-exiyyvralh_56.com_.jpg?t=2014022615
hxxp://xnop5002.tlgslb.com/style/xiu/v1/img/face/x/awesome.gif
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/rev/rev_sprite.png?v=0930
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/ug/icon_user_v_3.png?v=1130
hxxp://xnop5002.tlgslb.com/style/xiu/v1/img/face/x/indecent.gif
hxxp://1st.ecoma.glb0.lxdns.com/photo/68/93/csufku_56.com_.jpg?t=2014022615
hxxp://1st.ecoma.glb0.lxdns.com/photo/65/1/qq-inqbcwgtzs_56.com_.jpg?t=2014022615
hxxp://1st.ecoma.glb0.lxdns.com/photo/70/28/leung221_56.com_.jpg?t=2014022615
hxxp://xnop012.tlgslb.com/style/xiu/woxiu/v1/img/base/iux_h.png
hxxp://p23.tcdn.qq.com/landingpage/images_0925/62314474.jpg
hxxp://xnop042.tlgslb.com/56get
hxxp://p23.tcdn.qq.com/landingpage/images_0925/111659089.jpg
hxxp://p23.tcdn.qq.com/landingpage/images_0925/95230235.jpg
hxxp://p23.tcdn.qq.com/landingpage/images_0925/108657174.jpg
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=2&t=0.29743014459576555
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=3&t=0.429235291877897
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/rev/rev_h.png
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=4&t=0.6534786860744608
hxxp://1st.ecoma.glb0.lxdns.com/photo/95/53/qq-cpctdygsqr_56.com_.jpg?t=2014022615
hxxp://1st.ecoma.glb0.lxdns.com/photo/89/60/qq-ubxmbpmylw_56.com_.jpg?t=2014022615
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=PlayRoomApi&do=getAjaxFreeBroadcastCount&user_id=1439574551733&t=0.26503781888000233
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/col/cr_show_v1/newImage/1045_car.png
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=HdActive&do=getAthenaRoomPageRank&t=0.22103879664357096&room_user_id=qq-grrqhbaotm&page=1
hxxp://1st.ecoma.glb0.lxdns.com/photo/43/60/qq-kvnfrspuke_56.com_.jpg?t=2014022615
hxxp://1st.ecoma.glb0.lxdns.com/photo/19/73/qq-zhjhjgaiqh_56.com_.jpg?t=2014022615
hxxp://p23.tcdn.qq.com/landingpage/images_0925/108020309.jpg
hxxp://hm.e.shifen.com/h.js?0d44710c272c2edcd40af46e2c0d6546
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/col/cr_show_v1/newImage/1045_cards.png
hxxp://p23.tcdn.qq.com/landingpage/images_0925/93812002.jpg
hxxp://1st.ecoma.glb0.lxdns.com/photo/65/1/qq-inqbcwgtzs_56.com_.jpg?869
hxxp://1st.ecoma.glb0.lxdns.com/photo/68/22/qq-hxqmxmkhmx_56.com_.jpg?412
hxxp://1st.ecoma.glb0.lxdns.com/photo/1/97/qq-lykszsawpl_56.com_.jpg?346
hxxp://1st.ecoma.glb0.lxdns.com/photo/60/0/qq-exiyyvralh_56.com_.jpg?722
hxxp://1st.ecoma.glb0.lxdns.com/photo/95/53/qq-cpctdygsqr_56.com_.jpg?172
hxxp://xnop5002.tlgslb.com/style/xiu/v1/img/pic/xiu_small_avatar.jpg
hxxp://1st.ecoma.glb0.lxdns.com/photo/39/29/bhuhao8866_56.com_.jpg?387
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1789288798&si=0d44710c272c2edcd40af46e2c0d6546&st=1&v=1.1.2&lv=1&tt=value、月月的房间-在线演艺平台-我秀
hxxp://1st.ecoma.glb0.lxdns.com/html/domain.html
hxxp://1st.ecoma.glb0.lxdns.com/xapi/plapi.php?pl_type=xiu&roomid=1003
hxxp://p23.tcdn.qq.com/landingpage/images_0925/105280318.jpg
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/base/pop_login.gif
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=PlayRoomApi&do=moreRecommendHead&room_user_id=qq-grrqhbaotm&t=0.5274907663258246
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/col/cr_show_v1/newImage/1029_car.png
hxxp://xnop012.tlgslb.com/upload/mm/woxiudatu/24/60/1428995798_plads1_.jpg
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/col/cr_show_v1/newImage/1029_cards.png
hxxp://1st.ecoma.glb0.lxdns.com/index.php?action=PlayRoomApi&do=moreRecommendData&room_user_id=qq-grrqhbaotm&page=1&t=0.6627516678864604
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/col/cr_show_v1/newImage/1073_car.png
hxxp://xnop012.tlgslb.com/upload/mm/woxiudatu/24/60/1439176691_plads1_.jpg
hxxp://xnop5002.tlgslb.com/style/xiu/woxiu/v1/img/base/base_v.1.png
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/col/cr_show_v1/newImage/1073_cards.png
hxxp://xnop012.tlgslb.com/style/xiu/v1/img/col/cr_show_v1/newImage/1030_car.png
hxxp://www.woxiu.com/index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=3&t=0.429235291877897	203.130.61.92
hxxp://images8.baihe.com/landingpage/loading.gif	221.204.198.37
hxxp://uface.xiuimg.com/photo/68/22/qq-hxqmxmkhmx_56.com_.jpg?412	203.130.61.92
hxxp://x3.xiuimg.com/style/xiu/base/v1/css/gift_v.1.css?20150720	14.152.91.102
hxxp://xiu.xiuimg.com/upload/js/cnzzstat.js	14.152.91.101
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/upload/yl05.png	112.67.255.173
hxxp://uface.xiuimg.com/photo/39/29/bhuhao8866_56.com_.jpg?387	203.130.61.92
hxxp://abc.ss229.com/AP5Min.aspx?AID=10851&Auth=AC1D06D058020A33AFD6BCAC2CBB56483F9888B8FEE2AD1FD4A83D36D630BA79&referer=http://www.sanyangbinggui.cn/&utz=1439574512452	115.236.16.240
hxxp://www.woxiu.com/1003?p=20113164	203.130.61.92
hxxp://images9.baihe.com/landingpage/images_0925/91472312.jpg	221.204.198.37
hxxp://x2.xiuimg.com/webjs/page/common/footer/1.0/module.js?v=20150814	14.152.91.102
hxxp://www.woxiu.com/index.php?action=play&do=getRoomBadge&t=0.5447824661582423&room_user_id=qq-grrqhbaotm	203.130.61.92
hxxp://img.res.szgla.com/lw/images/login/login150731/down.gif?v=1	220.162.97.209
hxxp://x3.xiuimg.com/style/xiu/v1/img/rev/rev_h.png	14.152.91.102
hxxp://x2.xiuimg.com/webjs/page/play/room/userlist/1.0/viewers.js?v=20150814	14.152.91.102
hxxp://kwcdn.000dn.com/images/vali_sprite.png	203.130.61.92
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/base/pop_login.gif	112.67.255.173
hxxp://x3.xiuimg.com/style/xiu/woxiu/v1/img/bg/bg_car.jpg	14.152.91.102
hxxp://abc.ss229.com/AP5Min.aspx?AID=10851&Auth=AC1D06D058020A33AFD6BCAC2CBB56483F9888B8FEE2AD1FD4A83D36D630BA79&referer=http://www.sanyangbinggui.cn/&utz=1439574512655	115.236.16.240
hxxp://img.res.szgla.com/lw/images/login/login150722/zhuc_tit.gif?v=1	220.162.97.209
hxxp://images9.baihe.com/landingpage/images_0925/111659089.jpg	221.204.198.37
hxxp://images9.baihe.com/landingpage/images_0925/107493457.jpg	221.204.198.37
hxxp://xiu.xiuimg.com/upload/js/badge.js?20150720	14.152.91.101
hxxp://css.res.szgla.com/s/passport/Scripts/Common/form_validatorV1?v=20120518	218.6.111.42
hxxp://www.woxiu.com/p/20113164?from=offsite&sid=14516&wp=1&cps=&r=1003	203.130.61.92
hxxp://zt.ztgame.com/images/v12/intro/ztsp_052.jpg	122.226.183.171
hxxp://images9.baihe.com/landingpage/images_0925/106730492.jpg	221.204.198.37
hxxp://zt.ztgame.com/css/v12/intro/index.css	122.226.183.171
hxxp://css.res.szgla.com/c/JS/WebClick?v=20130404	218.6.111.42
hxxp://zt.ztgame.com/index.html?ad=2478161	122.226.183.171
hxxp://x3.xiuimg.com/style/xiu/woxiu/v1/img/bg/zyxupop.png	14.152.91.102
hxxp://img3.cache.netease.com/love/image/logo/logo_ipad.png	203.130.61.92
hxxp://x3.xiuimg.com/style/xiu/v1/img/bg/rev_icon_h.png	14.152.91.102
hxxp://x3.xiuimg.com/style/xiu/v1/css/xiu_v.12.css?20150720	14.152.91.102
hxxp://images9.baihe.com/landingpage/images_0925/104878950.jpg	221.204.198.37
hxxp://x3.xiuimg.com/style/xiu/woxiu/v1/img/upload/zb_tips.gif	14.152.91.102
hxxp://www.woxiu.com/jump3.html?p=20113164&from=offsite&wp=1&sid=14516	203.130.61.92
hxxp://hm.baidu.com/h.js?0d44710c272c2edcd40af46e2c0d6546	220.181.7.190
hxxp://img.res.szgla.com/lw/images/login/login150722/tc.jpg?v=1	220.162.97.209
hxxp://css.res.szgla.com/jquery/jquery-1.4.4.min?v=1	218.6.111.42
hxxp://uface.xiuimg.com/photo/60/0/qq-exiyyvralh_56.com_.jpg?722	203.130.61.92
hxxp://oq.cnzz.com/stat.htm?id=5127645&r=http://lw.q1.com/login/login_lianm4.html?radid=lm03_lw&rsid=14516&check=1&lg=en-us&ntime=none&cnzz_eid=1318753598-1439573297-http://lw.q1.com/&showp=1276x846&t=深圳冰川网络股份有限公司&h=1&rnd=1797728833	198.11.132.200
hxxp://images9.baihe.com/landingpage/images_0925/107881660.jpg	221.204.198.37
hxxp://uface.xiuimg.com/photo/65/1/qq-inqbcwgtzs_56.com_.jpg?t=2014022615	203.130.61.92
hxxp://img.res.szgla.com/lw/images/login/login150731/top1_v1.jpg	220.162.97.209
hxxp://x3.xiuimg.com/style/xiu/v1/css/sub/xiu_sns_v.1.css?20150720	14.152.91.102
hxxp://css.res.szgla.com/lw/js/tongji?v=1	218.6.111.42
hxxp://x2.xiuimg.com/webjs/page/play/common/gift/1.0/module.js?v=20150814	14.152.91.102
hxxp://g.4kt2.com/2/1878.html?uid=14516	14.18.238.176
hxxp://x3.xiuimg.com/style/xiu/v1/img/home_bg/bg01.jpg	14.152.91.102
hxxp://x2.xiuimg.com/script/page/xiu/v3/swfobject.js?20150720	14.152.91.102
hxxp://www.woxiu.com/index.php?action=PlayRoomApi&do=moreRecommendData&room_user_id=qq-grrqhbaotm&page=1&t=0.6627516678864604	203.130.61.92
hxxp://uface.xiuimg.com/photo/65/1/qq-inqbcwgtzs_56.com_.jpg?869	203.130.61.92
hxxp://my.6711.com/api/login.php?action=status&game_id=90&server_id=6767&callback=_loginCheck&tid=2&0.07878923819038785	121.201.59.28
hxxp://s4.cnzz.com/stat.php?id=4367119&web_id=4367119	1.99.192.15
hxxp://zt.ztgame.com/css/v12/reset.css	122.226.183.171
hxxp://abc.ss229.com/AP5Min.aspx?AID=10851&Auth=AC1D06D058020A33AFD6BCAC2CBB56483F9888B8FEE2AD1FD4A83D36D630BA79&referer=http://www.sanyangbinggui.cn/&utz=1439574514045	115.236.16.240
hxxp://x3.xiuimg.com/style/xiu/woxiu/v1/img/base/iux_h.png	14.152.91.102
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/activity/car_code.png	112.67.255.173
hxxp://x3.xiuimg.com/style/xiu/woxiu/v1/css/base_v.1.css?20150720	14.152.91.102
hxxp://x2.xiuimg.com/style/xiu/v1/img/rev/rev_face_vip.png	14.152.91.102
hxxp://vip.hyc.org.cn/music.swf?music=hxxp://rm.sina.com.cn/wm/VZ200705101138395899VK/music/p17_42.mp3	222.73.134.110
hxxp://g.4kt2.com/p/2/1878/0/2.js?uid=14516&lt=15516&key=0&tid=1&0.08844176864198688	14.18.238.176
hxxp://x1.xiuimg.com/style/xiu/v1/img/face/x/laugh.gif	112.67.255.173
hxxp://g.4kt2.com/p/2/1878/0/5.js?uid=14516&lt=18266&key=0&tid=3&0.2769682448994523	14.18.238.176
hxxp://kwcdn.000dn.com/swfs/2e/17500fdsah/bg.swf	203.130.61.92
hxxp://i4.zastatic.com/zhenai3/zhenai2012/js/lib/jquery-1.8.3.min.js	203.130.61.92
hxxp://images9.baihe.com/landingpage/images_0925/105280318.jpg	221.204.198.37
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/base/renrenIcon.png	112.67.255.173
hxxp://css.res.szgla.com/s/passport/Scripts/Action/zhuce_140922?v=1	218.6.111.42
hxxp://www.woxiu.com/index.php?action=PlayRoomApi&do=moreRecommendHead&room_user_id=qq-grrqhbaotm&t=0.5274907663258246	203.130.61.92
hxxp://www.woxiu.com/index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=2&t=0.29743014459576555	203.130.61.92
hxxp://n.sinaimg.cn/news/content2014/jquery-1.11.1.min.js	222.73.28.54
hxxp://xiu.xiuimg.com/upload/mm/woxiudatu/24/60/1439176691_plads1_.jpg	14.152.91.101
hxxp://kwcdn.000dn.com/swfs/2e/17500fdsah/sound.swf	203.130.61.92
hxxp://www.woxiu.com/index.php?action=Play&do=UpdateRoom&room_user_id=qq-grrqhbaotm&user_id=1439574551733&type=&islive=y&t=0.8944996767820068	203.130.61.92
hxxp://g.4kt2.com/js/2/g2.js?0.3310466620431648	14.18.238.176
hxxp://x1.xiuimg.com/style/xiu/v1/img/face/x/indecent.gif	112.67.255.173
hxxp://uface.xiuimg.com/photo/43/60/qq-kvnfrspuke_56.com_.jpg?t=2014022615	203.130.61.92
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/upload/yl06.png	112.67.255.173
hxxp://x3.xiuimg.com/style/xiu/v1/css/xiu_base_v.2.css?20150720	14.152.91.102
hxxp://img.res.szgla.com/lw/images/login/login150731/top2_v1.jpg	220.162.97.209
hxxp://x1.xiuimg.com/style/xiu/v1/img/pic/xiu_small_avatar.jpg	112.67.255.173
hxxp://x3.xiuimg.com/style/xiu/woxiu/v1/img/base/mail.gif	14.152.91.102
hxxp://images9.baihe.com/landingpage/images_0925/105582094.jpg	221.204.198.37
hxxp://images9.baihe.com/landingpage/images_0925/94636632.jpg	221.204.198.37
hxxp://x2.xiuimg.com/webjs/page/play/room/home/1.0/module.js?v=20150814	14.152.91.102
hxxp://www.woxiu.com/index.php?action=Play&do=getUserListPart2&room_user_id=qq-grrqhbaotm&user_id=1439574551733&t=0.7839964297304807	203.130.61.92
hxxp://lw.q1.com/js/request.js?v=20140627	220.162.97.209
hxxp://x3.xiuimg.com/style/xiu/v1/img/h_gift_small_v_1.png	14.152.91.102
hxxp://www.woxiu.com/index.php?action=Play&do=InitPlay&id=1003&userid=1439574551733&chatflag=0&t=0.5279487099684342	203.130.61.92
hxxp://x3.xiuimg.com/style/xiu/v1/img/col/cr_show_v1/newImage/1029_car.png	14.152.91.102
hxxp://images9.baihe.com/landingpage/images_0925/106779355.jpg	221.204.198.37
hxxp://css.res.szgla.com/c/JS/WebVisit?v=20130404	218.6.111.42
hxxp://pcookie.cnzz.com/app.gif?&cna=ERhVDn4rygUCAcLyYNrtvDDJ	42.120.219.171
hxxp://css.res.szgla.com/jquery/jquery-1.4.4.min.js?v=1	218.6.111.42
hxxp://x3.xiuimg.com/style/xiu/v1/img/rev/rev_gift.png	14.152.91.102
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/upload/yl02.jpg	112.67.255.173
hxxp://uface.xiuimg.com/photo/95/53/qq-cpctdygsqr_56.com_.jpg?172	203.130.61.92
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1789288798&si=0d44710c272c2edcd40af46e2c0d6546&st=1&v=1.1.2&lv=1&tt=value、月月的房间-在线演艺平台-我秀	220.181.7.190
hxxp://x3.xiuimg.com/style/xiu/v1/css/sub/xiu_guide_v.8.css?20150720	14.152.91.102
hxxp://img30.360buyimg.com/popWareDetail/jfs/t712/106/1425118530/521379/1040476c/553f1d53Nc9dd9e7b.jpg	93.184.220.20
hxxp://x1.xiuimg.com/style/xiu/v1/img/rev/sub/ph_flower.png?v=0910	112.67.255.173
hxxp://x3.xiuimg.com/style/xiu/v1/img/rev/rev_icon.png	14.152.91.102
hxxp://x3.xiuimg.com/style/xiu/woxiu/v1/img/bg/car_line.jpg	14.152.91.102
hxxp://images9.baihe.com/landingpage/images_0925/58404730.jpg	221.204.198.37
hxxp://x1.xiuimg.com/style/xiu/v1/js/DD_belatedPNG_0.0.7a-min.js	112.67.255.173
hxxp://images9.baihe.com/landingpage/images_0925/108671561.jpg	221.204.198.37
hxxp://www.woxiu.com/xapi/plapi.php?pl_type=xiu&roomid=1003	203.130.61.92
hxxp://x3.xiuimg.com/style/xiu/v1/img/bg/rev_marquee.png	14.152.91.102
hxxp://c.cnzz.com/core.php?web_id=4367119&t=z	188.254.86.248
hxxp://counter.ztgame.com/ref.php?ref=2478161&return_url=http://zt.ztgame.com/index.html?ad=2478161	101.226.182.61
hxxp://lw.q1.com/login/login_lianm4.html?radid=lm03_lw&rsid=14516&check=1	220.162.97.209
hxxp://x2.xiuimg.com/style/xiu/v1/js/ui/f2e_woxiu.js?20150720	14.152.91.102
hxxp://x1.xiuimg.com/style/xiu/v1/img/rev/sub/ph_flower.png	112.67.255.173
hxxp://www.woxiu.com/html/domain.html	203.130.61.92
hxxp://css.res.szgla.com/s/passport/Scripts/Common/CommonV1?v=20120518	218.6.111.42
hxxp://img.res.szgla.com/lw/images/login/login150731/body.jpg	220.162.97.209
hxxp://images9.baihe.com/landingpage/images_0925/108613721.jpg	221.204.198.37
hxxp://images9.baihe.com/landingpage/images_0925/110576353.jpg	221.204.198.37
hxxp://rm.sina.com.cn/wm/VZ200705101138395899VK/music/p17_42.mp3	222.73.28.97
hxxp://oq.cnzz.com/stat.htm?id=5127645&r=http://lw.q1.com/login/login_lianm4.html?radid=lm03_lw&rsid=14516&check=1&lg=en-us&ntime=1439573297&cnzz_eid=1318753598-1439573297-http://lw.q1.com/&showp=1276x846&t=深圳冰川网络股份有限公司&h=1&rnd=175355424	198.11.132.200
hxxp://kwcdn.000dn.com/swfs/2e/17500fdsah/ren.swf	203.130.61.92
hxxp://x3.xiuimg.com/style/xiu/v1/img/bg.png?v=0531	14.152.91.102
hxxp://images9.baihe.com/landingpage/images_0925/108722559.jpg	221.204.198.37
hxxp://abc.ss229.com/AP5Min.aspx?AID=10851&Auth=AC1D06D058020A33AFD6BCAC2CBB56483F9888B8FEE2AD1FD4A83D36D630BA79&referer=http://www.sanyangbinggui.cn/&utz=1439574513999	115.236.16.240
hxxp://x3.xiuimg.com/style/xiu/woxiu/v1/img/base/pan_ulogo.png	14.152.91.102
hxxp://xiu.xiuimg.com/upload/xiu/95/40/qq-grrqhbaotm_56.com_150814204101.jpg	14.152.91.101
hxxp://c.cnzz.com/core.php?web_id=5127645&t=q	188.254.86.248
hxxp://static3.baihe.com/landingpage/20140925.css	113.6.237.65
hxxp://x2.xiuimg.com/webjs/page/common/base/1.0/module.js?v=20150814	14.152.91.102
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/topic/zb_union/play_icon.png	112.67.255.173
hxxp://x2.xiuimg.com/webjs/page/play/room/zhubo/1.0/module.js?v=20150814	14.152.91.102
hxxp://x3.xiuimg.com/style/xiu/v1/img/col/cr_show_v1/newImage/1073_car.png	14.152.91.102
hxxp://g.4kt2.com/2/	14.18.238.176
hxxp://x2.xiuimg.com/webjs/page/play/common/hdcommon/1.0/module.js?v=20150814	14.152.91.102
hxxp://images9.baihe.com/landingpage/images_0925/108020309.jpg	221.204.198.37
hxxp://x3.xiuimg.com/style/xiu/v1/img/rev/rev_sprite.png?v=0930	14.152.91.102
hxxp://x2.xiuimg.com/webjs/page/common/header/1.0/module.js?20150720	14.152.91.102
hxxp://x3.xiuimg.com/style/xiu/v1/img/col/cr_show_v1/newImage/1045_car.png	14.152.91.102
hxxp://x3.xiuimg.com/style/xiu/v1/img/ug/icon_user_v_3.png?v=1130	14.152.91.102
hxxp://uface.xiuimg.com/photo/68/22/qq-hxqmxmkhmx_56.com_.jpg?t=2014022615	203.130.61.92
hxxp://images9.baihe.com/landingpage/images_0925/93812002.jpg	221.204.198.37
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/base/adimn_hz.png	112.67.255.173
hxxp://w.cnzz.com/c.php?id=5127645	1.99.192.14
hxxp://g.4kt2.com/api/c.php?platform_id=2&union_id=1878&union_type=1&link_id=0	14.18.238.176
hxxp://x1.xiuimg.com/flashApp/vshow_player_woxiu.15.06.26.a.swf	112.67.255.173
hxxp://images9.baihe.com/landingpage/images_0925/108657174.jpg	221.204.198.37
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/activity/super_web/bar_leaf01.png	112.67.255.173
hxxp://kwcdn.000dn.com/swfs/2e/17500fdsah/index.swf	203.130.61.92
hxxp://www.woxiu.com/crossdomain.xml	203.130.61.92
hxxp://x1.xiuimg.com/webjs/lib/jquery/jquery/1.7.2/jquery.js?20150720	112.67.255.173
hxxp://x2.xiuimg.com/webjs/page/play/common/chat/1.0/module.js?v=20150814	14.152.91.102
hxxp://images9.baihe.com/landingpage/images_0925/62314474.jpg	221.204.198.37
hxxp://www.woxiu.com/index.php?action=HdActive&do=getAthenaRoomPageRank&t=0.22103879664357096&room_user_id=qq-grrqhbaotm&page=1	203.130.61.92
hxxp://dnlive.fastcdn.com/crossdomain.xml	121.11.64.38
hxxp://images9.baihe.com/landingpage/images_0925/111637032.jpg	221.204.198.37
hxxp://x3.xiuimg.com/style/xiu/v1/img/icon_v1.gif	14.152.91.102
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/base/iux_h.png	112.67.255.173
hxxp://x3.xiuimg.com/style/xiu/v1/img/topic/Satyr_Game/Satyr_Game_icon.png	14.152.91.102
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/upload/yl04.png	112.67.255.173
hxxp://uface.xiuimg.com/photo/19/73/qq-zhjhjgaiqh_56.com_.jpg?t=2014022615	203.130.61.92
hxxp://kwcdn.000dn.com/swfs/2e/17500fdsah/ren01.swf	203.130.61.92
hxxp://uface.xiuimg.com/photo/1/97/qq-lykszsawpl_56.com_.jpg?346	203.130.61.92
hxxp://uface.xiuimg.com/photo/95/53/qq-cpctdygsqr_56.com_.jpg?t=2014022615	203.130.61.92
hxxp://uface.xiuimg.com/photo/70/28/leung221_56.com_.jpg?t=2014022615	203.130.61.92
hxxp://images9.baihe.com/landingpage/images_0925/107644834.jpg	221.204.198.37
hxxp://lw.q1.com/zhuce/login_150722.html	220.162.97.209
hxxp://zt.ztgame.com/images/v12/intro/ztsp_051.jpg	122.226.183.171
hxxp://lw.q1.com/zhuce/	220.162.97.209
hxxp://img.res.szgla.com/lw/images/login/login150731/main.jpg	220.162.97.209
hxxp://x1.xiuimg.com/webjs/lib/seajs/seajs/3.0.0/sea.js	112.67.255.173
hxxp://x1.xiuimg.com/style/xiu/v1/img/face/x/awesome.gif	112.67.255.173
hxxp://www.woxiu.com/index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=1&t=0.25663908058275875	203.130.61.92
hxxp://uface.xiuimg.com/photo/68/93/csufku_56.com_.jpg?t=2014022615	203.130.61.92
hxxp://abc.ss229.com/AP5Min.aspx?AID=10851&Auth=AC1D06D058020A33AFD6BCAC2CBB56483F9888B8FEE2AD1FD4A83D36D630BA79&referer=http://www.sanyangbinggui.cn/&utz=1439574515264	115.236.16.240
hxxp://images9.baihe.com/landingpage/images_0925/82814631.jpg	221.204.198.37
hxxp://x3.xiuimg.com/style/xiu/v1/img/col/cr_show_v1/newImage/1045_cards.png	14.152.91.102
hxxp://uface.xiuimg.com/photo/89/60/qq-ubxmbpmylw_56.com_.jpg?t=2014022615	203.130.61.92
hxxp://images9.baihe.com/landingpage/images_0925/110523568.jpg	221.204.198.37
hxxp://x3.xiuimg.com/style/xiu/v1/css/sub/xiu_login_v.2.css?20150720	14.152.91.102
hxxp://www.woxiu.com/index.php?action=PlayRoomApi&do=getAjaxFreeBroadcastCount&user_id=1439574551733&t=0.26503781888000233	203.130.61.92
hxxp://x3.xiuimg.com/style/xiu/woxiu/v1/img/base/iux_w.png	14.152.91.102
hxxp://x2.xiuimg.com/webjs/page/play/room/player/1.0/module.js?v=20150814	14.152.91.102
hxxp://x3.xiuimg.com/style/xiu/woxiu/v1/css/live_v.2.css?20150720	14.152.91.102
hxxp://lw.q1.com/js/request?v=20140627	220.162.97.209
hxxp://lw.q1.com/zhuce/login_150722_v1.html	220.162.97.209
hxxp://dnlive.fastcdn.com/56get	121.11.64.38
hxxp://x1.xiuimg.com/style/xiu/woxiu/v1/img/activity/Rob_gf_medal.png	112.67.255.173
hxxp://www.woxiu.com/crossdomain.xml?ver=1	203.130.61.92
hxxp://www.sanyangbinggui.cn/	183.61.162.78
hxxp://x3.xiuimg.com/style/xiu/v1/img/col/cr_show_v1/newImage/1029_cards.png	14.152.91.102
hxxp://x2.xiuimg.com/webjs/page/play/room/recommend/1.0/module.js?v=20150814	14.152.91.102
hxxp://images9.baihe.com/landingpage/images_0925/95230235.jpg	221.204.198.37
hxxp://uface.xiuimg.com/photo/60/0/qq-exiyyvralh_56.com_.jpg?t=2014022615	203.130.61.92
hxxp://images9.baihe.com/landingpage/images_0925/106801898.jpg	221.204.198.37
hxxp://www.woxiu.com/index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=4&t=0.6534786860744608	203.130.61.92
hxxp://kwcdn.000dn.com/swfs/2e/17500fdsah/bg.jpg	203.130.61.92
hxxp://pcookie.cnzz.com/app.gif?&cna=ERhVDkCWFB4CAcLyYNrWiH2	42.120.219.171
hxxp://x3.xiuimg.com/style/xiu/v1/img/col/cr_show_v1/newImage/1073_cards.png	14.152.91.102
hxxp://images9.baihe.com/landingpage/images_0925/108781221.jpg	221.204.198.37
hxxp://images9.baihe.com/landingpage/images_0925/104506944.jpg	221.204.198.37
www.cnfrn.com	123.103.241.170
web.51.la	182.236.163.64
www.dnerw.com	123.103.241.170
reg.ztgame.com	101.226.182.18
dplay.xiuimg.com	115.238.226.152
v3.jiathis.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0
ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET POLICY Outdated Windows Flash Version IE

Traffic

GET /c/JS/WebClick?v=20130404 HTTP/1.1

Accept: */*

Referer: hXXp://lw.q1.com/zhuce/login_150722.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.res.szgla.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Fri, 14 Aug 2015 17:49:03 GMT

Cache-Control: max-age=2678400

Content-Length: 1308

Content-Type: text/html

Server: Microsoft-IIS/6.0

access-control-allow-origin: *

access-control-allow-credentials: true

X-Powered-By: ASP.NET

X-Via: 1.1 fuz114:6 (Cdn Cache Server V2.0)

Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.or
g/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>.....
.......</TITLE>..<META HTTP-EQUIV="Content-Type" Content="tex
t/html; charset=GB2312">..<STYLE type="text/css">..  BODY { f
ont: 9pt/12pt .... }..  H1 { font: 12pt/15pt .... }..  H2 { font: 9pt/
12pt .... }..  A:link { color: red }..  A:visited { color: maroon }..&
lt;/STYLE>..</HEAD><BODY><TABLE width=500 border=0 c
ellspacing=10><TR><TD>..<h1>............</h1&g
t;....................................................<hr>..<
p>................</p>..<ul>..<li>...............
.........................................</li>..<li>......
......................................................................
......</li>..<li>....<a href="javascript:history.back(1
)">....</a>....................</li>..</ul>..<
h2>HTTP .... 404 - ..................<br>Internet ........ (I
IS)</h2>..<hr>..<p>..............................<
;/p>..<ul>..<li>.... <a href="hXXp://go.microsoft.co
m/fwlink/?linkid=8180">Microsoft ............</a>..........&l
dquo;HTTP”..“404”........</li>..<li>....
“IIS ....”...... IIS ...... (inetmgr) ....................
....“........”..“............”..“.......
...........”........</li>..</ul>..</TD><
<<< skipped >>>

GET /images/vali_sprite.png HTTP/1.1

Accept: */*

Referer: hXXp://g.4kt2.com/2/1878.html?uid=14516

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: kwcdn.000dn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 17:57:36 GMT

Date: Fri, 14 Aug 2015 16:57:36 GMT

Server: nginx/1.4.2

Content-Type: image/png

Content-Length: 28934

Last-Modified: Fri, 07 Aug 2015 08:11:30 GMT

ETag: "55c46832-7106"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 fuzhou191:8108 (Cdn Cache Server V2.0), 1.1 kf48:1 (Cdn Cache Server V2.0)

Connection: keep-alive
.PNG........IHDR.............L<......gAMA......a.... cHRM..z&......
........u0...`..:....p..Q<....bKGD.......C......pHYs...........~...
pjIDATx...{.,YY....ZU..v.3s..pf.a.a..C.o4x..J......L.$Q....1.F.F..""".
Q....Q$...W ....30....}...]....Q..{...9{.........svwW=.Y..V}..g..B.!..
B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.Q7.(;}..
6>.k^...... ...SK.6N.v.q.\...y.k.?...?..3..y.s...1.C..r...yF.......
..7.....c.cI.#1.k#.......ul(.&.B....^.o..1e.........y..[6L..3...o.%..o
.B...<.C..0.......;..n. .1.......k,.Z:gN.....o...... >..2.:..Jz.
..!B..>......{,...p./.\....p.Z..U.r.....-B~..r..x......9.....gX..w.
z|.sk........v..*|.B.QkN............a$Q..._.o........p._.x.....:.{z.w.
.......t.h..V.}U5PW..Y....g.z...Wgq......P.....6...3P..!...M{....vm...
.....X..|o..-..n..96..."}..).......P...&...J|,...?0..M.......;.Y>..
..&'DO.=..p.G.[........D.4,.8....k.=?.z~..~.......o.....w=....k......f
S[;8.|..!.#1...4...|?.w....6vY^..........1....}.\.:.s...}76F-o..../z..
..Nl]h.I..o.k....c..v.,..#.>d...g........qC..2RO..7.&..{~..._......
......._G.A........r.g..cu..........QC[.M...m..Q.Rc`i...........&-5nY.
`.......5)^....E....o.j...F..@(.l..|P..5....hI......g...d..!..B.b.bV."
.P...h....\...p."[email protected]....[..7};.W.....oS|...#...~.........
A.1.[......~...O....=x........T.........>|..~.scm.z..B..{B......^..
N..........i..I.wB~.=.;..j.4..y..Q.M.......i.....q.w...Xk1.`.1.Z.s.Zk.
4=.^..}Or.]w.L7...M.E3IF....*nz:...?....R^......3..Y..u.W....%.sGY..=,
g7A.D.......F..d.l........_ .H.!..3...YhA.bZ.!..s..A....IS.K.YL.\%
<<< skipped >>>

GET /swfs/2e/17500fdsah/bg.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://kwcdn.000dn.com/swfs/2e/17500fdsah/index.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: kwcdn.000dn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 18:18:10 GMT

Date: Fri, 14 Aug 2015 17:18:10 GMT

Server: nginx/0.8.54

Content-Type: image/jpeg

Content-Length: 31406

Last-Modified: Sat, 08 Mar 2014 04:13:56 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zjjhdx37:8080 (Cdn Cache Server V2.0), 1.1 kf50:6 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.............)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:B7073AA26D4811E38874ED27A5189BEA" xmpMM:DocumentI
D="xmp.did:B7073AA36D4811E38874ED27A5189BEA"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:B7073AA06D4811E38874ED27A5189BEA" stRef:doc
umentID="xmp.did:B7073AA16D4811E38874ED27A5189BEA"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.............).)A&&AB///BG?>>?GGGGGGGGGGGGGGGGGGGGG
GGGGGGGGGGGGGGGGGGGGGGG..))4&4?((?G?5?GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
GGGGGGGGGGGGGGGGGG........x.."..........v.............................
.......................................!..1..AQ".2a...................
...!1..AQaq"2.B3.............?........m.O.[.....PW?j...rLU$.2{....P...
......{O...j.;..K.[.....F....5h....S?_..K...S.=.%sb ...U.;|.>3.....
..........?.j<.........3..R|7..q/.W/...v..?.4.F.....'...'.....g...5
z.....g.U.....-....ZIoO~.......L...SM>.-..8..~.]t....6?.GD..c.^...k
ql...^#...a...u..7.Li%[email protected]`ff.f`ff.f`ff.f`ff.f`ff.f`ff
<<< skipped >>>

GET /swfs/2e/17500fdsah/ren.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://kwcdn.000dn.com/swfs/2e/17500fdsah/index.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: kwcdn.000dn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 18:01:11 GMT

Date: Fri, 14 Aug 2015 17:01:11 GMT

Server: nginx/0.8.54

Content-Type: application/x-shockwave-flash

Content-Length: 1384

Last-Modified: Sat, 08 Mar 2014 04:13:56 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zjjhdx38:8104 (Cdn Cache Server V2.0), 1.1 kf48:8 (Cdn Cache Server V2.0)

Connection: keep-alive
CWS.M...x....LSW..O[)0......._....p.....N,*.."...N132.#.......(`[email protected]
..V.bA.u#j..!5....2.......e....K6H...}.{.=m.-.8{.b.)..B....-e.4.....d.
.....U.k..P..D......... 4..M..]..~R}G..=G......<..oa..>..R.&[..w
...*..Q..8<..K.q.,......~.?r.a>C..%[email protected]. 
~.....`a&.UZ..T...$i*M...#<R;.Z.mY,..., .gK......"Q..a$.|.!.,G..4kG
J.q...E......./..H.DH..=...S_.:.$....F.% ....C.H..[....iHt.....G.....6
.....h`.H}.]............I..|D...gHd....F....6.'..y..T..d .')*...Y..NM.
..aU...!.fY.N..COd) .... .....zbsW.O...,%.....(......k..4...l.,.I..w..
........n*......M|..Mpldc.....}..x.'...F~.'....P....d.../B~...|...].._
.X.Qy4..zR..X./.....s..k.[Z...t.....:.........mpl.A..q.z ..... [.W~..j
..C......#.N...F:.....:e.K...F.h.j]..*.`[email protected].}..n.)-.. 
....sWw.}.....3T.)*...\....d..$..1.DdQ_...r'....<gY\...Bw..........
.v.$.Ipy.L.N.@......=4&.$Q......yXw.....Z|D.;...~....u..E Y.W_w.!&A}..
.W.:.....6..I....\0..G......95...;.d|[email protected].:.....$-.2.
.....rp_......ru..=..P....[z....o.<@.....).u.Q.B....c8l...~.lO2~.".
......."..'........E.z......8.S.p.../..........\.oz.,......l..r.Cr..0.
7..........c.0./. !.1.u.i...;....-O.. /......qb!aL......m..s ...o.8K..
2.....d7..<........v('.3.2*.......u....!)Z' .X......B."......E...Nd
wz...c.#.9.].h...V..h%w ..)3k2F.x%6.1.H..Ri.~._V....`.(9....=/.Qc...c.
....|X.r]h!....J.I...Q..&...M...H=u.V.a..B..U.'.K.d..7Y.Q....e..^.oj..
b...1'q.....
<<< skipped >>>

GET /swfs/2e/17500fdsah/ren01.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://kwcdn.000dn.com/swfs/2e/17500fdsah/index.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: kwcdn.000dn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 18:00:30 GMT

Date: Fri, 14 Aug 2015 17:00:30 GMT

Server: nginx/0.8.54

Content-Type: application/x-shockwave-flash

Content-Length: 358268

Last-Modified: Sat, 08 Mar 2014 04:13:56 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zjjhdx41:8105 (Cdn Cache Server V2.0), 1.1 kf50:1 (Cdn Cache Server V2.0)

Connection: keep-alive
CWS.....x...u\T].?|...n$..%.K........i.)i....PABBA...EJz.3..x_.]..~~..
.ut..k...w.^{.sf.........P..R..xI.A............._... ......?1..Z... Jr
[email protected]./gK;g....@[email protected]....
..A.T./.......`.......2...@R_y............"..E....V..2f..VRv.f..V.?$..
[email protected]......:Y.Z...d.4A.> .:8.....)...<m...$].].a..<..tT...f&
'_......v....t..r0F K.."...t.... ...y.......N......L.;..?.Ex....../...
.......fxUO.R...8.KB.....0."G....,.:?.....`....E^..2....._&.&.4.Aa....
;@........NE.B...B.N..f(...#...Z...?..(HD.._&.....\[...r.q....;.......
.....t8 .w.  .u......9`..C.....b..).%.*.V..WX....^..(.....:..8...C...o
.z..,u...6.`...?P..r..[..........=..S...\q.....8.t.r.W.3H..5....n6^a..
.M.Y...&..`[email protected]..... 3...<Saz..X[?.e..I?.Kt...G..{.m.BQ..>
...f.q..m......c4.........."....9:.K.....H'..G....^(p.2.. .. ..6H'....
<..`..e.L..?.G...ex.......!.E...D....K..;.*.."!!.Y.....36....;. ...
..c.7.....!xs.A...,............H....... [email protected]..\h.."""..!.d...
P&.c.1.{....h....Y<l.,]|.......?w..s.$.MwKw.[K..@I..... .t..e.....&
gt;..J..Ps/OO...%....%;.*cfa.B..I. 1.....,,,@8`[email protected]
.:Z.<G~.......6.....k..#.#..6..j..[Z../.M.Sm.s...j.tt.q...P.V;.[tb&
gt;@..r=. .k=..#..\..xM`x.Dhkgc...<...ca...*.......6.9l9;GP*.I.$...
.%....=.W2._......F.4`..$!1!.....V..l`NE.9..4.z.f.KN.Xr4.9U..H...Z. .B
...q1...#d...uq.A8...&.s....a....qNr.a@.....=.g.h..p.|.d...........6.r
....../..*....W1........r..sq......`q&..s.28....l:.Y.0...<8...1.wy.
[email protected]$sK=R.....l.`[email protected])A..E..c.m..
<<< skipped >>>

GET /iplookup/iplookup.php?format=js HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: int.dpool.sina.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 14 Aug 2015 17:48:47 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 149

Connection: close

DPOOL_HEADER: tyr106

SINA-LB:aGEuMTE5LmcyLnlmLmxiLnNpbmFub2RlLmNvbQ==

SINA-TS:OWJmMjk2Y2UgMCAwIDAgNSAwCg==
var remote_ip_info = {"ret":1,"start":-1,"end":-1,"country":"\u4e4c\u5
14b\u5170","province":"","city":"","district":"","isp":"","type":"","d
esc":""};..

GET /photo/68/22/qq-hxqmxmkhmx_56.com_.jpg?t=2014022615 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: uface.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 18:03:23 GMT

Date: Fri, 14 Aug 2015 17:03:23 GMT

Server: openresty

Content-Type: image/jpeg

Content-Length: 2280

Last-Modified: Fri, 23 Jan 2015 18:43:15 GMT

ETag: "54c29643-8e8"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf48:0 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................<.<.....................................
.....5........................!....1AQaq."2..Rb.......Bc..............
...................).......................!..1."2AQaq.#3.............
.?............R..{{...R..../.p1.....:`...T.W=L?*.I...:jpRg.[...S..G.._
q..%...$..s4..rK....yl5<.-.Z..........8...  ;9..s.0..'i@......\...4
..i:..A...r..e<Qt. ..SKMP..F.a.82(..>...>i7.........c..,..y .
U.#......>D`....;rAe...........s...8...N.......=.....%B.> .c.7..
S.......d.P......h...<.....*..G..!D.Vi.c$...}T.......O...5.0.Lrrg..
..l.V..".r$...m.G......:[email protected]....^.*DK...L......\v.0`m.  ...;.
h8.......$....HU.2...A`.......P......=.>[email protected].
cD.*.r-.]....W...J.`N.GE,.`YW. 6W.o-M..L......h......|Kq.2..[..:......
C.^...]m.,LD'....._'mv.}-...G.e.U.F..H......u.r..U...Vz.9.1ST..#.Q.#.;
.. .N.....jK.U5=5\mN.i.C..H......e.6"..5.t...n.UANd.]Y.{H..\.......`..
.z......H......*....p.?.?..'.jz.].5C.....8...*v.:.D.....g..z....I.J%.f
I.d..|......e.Z....p.....-u...z....E%..O4...E,Dn|2N..?mk.....}.UU6....
[email protected]=....>..n1.....Zn..%....hR..A...........k.
...RF.G4._./iM-.....M...K......;..>.w..;|.....Z0;.4...I..5utaj...2.
....R.g.[.nN......h.........u......!.P3....4...R...M.u.......Y...Rd..a
c)t.fK...;G.....E$...Q5B.d....s....o..4.j`8..M.F.K..$..6)....(..x.....
....U.X.....y`..Q.Re....\ %.T....t(.pR).P.{.....4'."$......5qt....
<<< skipped >>>

GET /photo/65/1/qq-inqbcwgtzs_56.com_.jpg?t=2014022615 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: uface.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 18:03:19 GMT

Date: Fri, 14 Aug 2015 17:03:19 GMT

Server: openresty

Content-Type: image/jpeg

Content-Length: 1717

Last-Modified: Mon, 30 Mar 2015 09:42:07 GMT

ETag: "55191a6f-6b5"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf50:3 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................<.<.....................................
......4.........................!..1AQ."aq....2B.#3.br................
........................................!1."A2............?..CD$.WX..f
.|t.TZD.]O.-$.(.......a5B.qX.[....Y.5....!.#.....|t..%7.QW;...u#{..d.y
D...z..`.%I'.....h....\<.&..........x.gs.....3.4ju..)...X.[5%.D"..c
..S..(.|4>......MJ....?..".....w.w...mb..#.W.........j.AU...n}.....
[email protected]>..4......F%M...7...\.....%G..KE......g...>.J....
\.i...........EN.....!j....zJ.*gl...M.....>:.....u.....M......0I.-.
~...p..rH>.h|yt.............2.V,.....&?R....C=.;.....,kHd..r.I.3...
|..V.rt.....}.j......>.z......Uz.*.......i.*x...s.uj..RI~..i.A_|6w.
 #M.T.O...h..h.M./.-..=.y.T6=..N.F.....CkE.UF..c.....N...Z.D....B....^
..d.....h.1;f..z.W.h&....x.$.O.Lc..H.w/2t1F.......U.QR.#.T*..Q.4..\./.
4.]...T..$R....|.B...;F..E.....v.........CS..T5...R.QT.O....e..k.m.l..
...W...OM..`...~<.>...n4.3..-r.&....vy.....a{........Uw...x. .a.
t...7..dX..(=..Q....?M`.....F`.G...1..A.......|.VO6N.hi...Ic%.gU~..<
;gWdh.... .X.7..7Yj&...=.....@.......;......c.X...!B.....6,2.....#..E.
3.......X..5.;V,....GEE..H...z..$hTr..h$.VN....J....J......:.9.VkQ...U
....=.XKO#$.A2%.N....._?..f.I...u#sS-.z..$........Z....0m..z.O..i.....
f^....#./>ux......./S ..4..;P.M..8....xw...c..:~.3K.Z.o.3Ip2FN.F~z.
.Z.s..Pq5dE.<.....Q.M.#AU..m...........C:])X_..q....*j......m.J
<<< skipped >>>

GET /photo/70/28/leung221_56.com_.jpg?t=2014022615 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: uface.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 18:03:20 GMT

Date: Fri, 14 Aug 2015 17:03:20 GMT

Server: openresty

Content-Type: image/jpeg

Content-Length: 2129

Last-Modified: Mon, 27 Jul 2015 14:31:23 GMT

ETag: "55b640bb-851"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf48:1 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................<.<.....................................
.......<..........................!1.."AQ.2Baq.....3Ec..#$%br......
..............................)......................!.1..A."Qaq.#2...
............?.R.>[email protected]..{.....c....s.x.....e../Nq=.
..It.y...Q......]...jD......Z.S........K5.ijw..R. [email protected]..
..6..........yFO(.i..$M....0...?,G&Rf.V..........m.yR..../IVeg..I..Q..
Z$....&3.......##....h.]..2J..6jz.~4._.,~....u.....{P4R-.......X..r...
./../...... B...a.t...k..w.zx...~.w.....sQ6q..P..........cP...X.....I.
. .~..2.CKS$e#.,....c...e...C.......c!.o..q.&.h.....;t...1.&.,...l....
...A...5.....MV`..n.=.. .x.-!i.q....@b;l...........q..F.~..1......P...
..6*..w....:..=..,e....0..a.g.s\......16..98!a...?w3..1'..&.m&...R....
...LS.".g..H..........I%.......2....K......X...2..t-..*..B.)...^.....o
....`...;.mu...hL.5caG.O/.E.DLE..u{X....w3 .>q.<t6..Q.fU..E...q.
......PE....4Y....2y..i..U...(*`......@}.~...gWR.P..)..7..@$.Ju.!gR...
.....3..Y.zofbyd.5}...E.G.'.:>.........T...H.......8*.. .:.^..]]...
6.m........8$3.q,Cy......p:./uP:...1...Ms..*..9.e..3.,.......b.^......
.......O91W../...#.S.Pk=7[,q.V~.Z`..........|..]8...d.v'.Q...Fo[O;....
}? .....|.zz|.*..C.i,...PPjZ...S..w`DR.M. b$.1.(......,.Y%.{....--[..I
]....2.2....c.&.......J..:..%W"....}.Z..........rI..m.n.e*.p]J.".3.8a.
........[s.....2..wNeD..Q5[.<.."...7-q....#5a...ZCQ..ST.g.d.'..
<<< skipped >>>

GET /photo/95/53/qq-cpctdygsqr_56.com_.jpg?t=2014022615 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: uface.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 18:03:21 GMT

Date: Fri, 14 Aug 2015 17:03:21 GMT

Server: openresty

Content-Type: image/jpeg

Content-Length: 1764

Last-Modified: Thu, 06 Aug 2015 07:29:54 GMT

ETag: "55c30cf2-6e4"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf50:7 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................<.<.....................................
.....6..........................!."1AQ.aq..#$2Cs.......3b.............
..................."......................!..1"A.Bq.............?...*K
n.%....i).H.Z.3..M.q..Y....A....p.4X...|...|T...!9 8..]........Q.2RV..
...b......aS..I..  &.P.........i..o....pb....*....Cyer..>.<PI...
:CE.OL.Xp{..|S..X.M..*..Vy..X,8G#.?.g...f.,.T.....'.b].....[4.R....2Cz
6....C8..O..[s2S>.G.PM..F.jR..#p../N..v..4.....%I:.w.v....V*.......
/......y..;.b,.Iq.......N.BJ..Ct.....wEyq.3I~..\...MV*.)...M.K..d..zf&
...h..#.=..}..~)..........P.d...I..r...~..].......`.T;r......B.o."9..:
..w....R1.g.uODm.4......N.........Ml......IJ.L....B}.y.8.... Zp..I..y.
......U}u....o....vL.L....i..]....YK...e..........3}..^L".....h..<.
.q.8x{#.4.D...Q...E.j.9..Y'H..H]g~p.Hi .9.G.......#...&Q.#JjRZ])....s_
0P!C.....x-R.].Q):..$...H7m..)*O .E.1......F..S.57...B....C .......\.!
.dQ....p...Q............A....<j..L.....J.a./...9.O.Dc!IC.4....Bm...
.. .q.}a[%..Y...8.. ...R...........!.]5....M.J.E7...N..G..G ..d%Yb^eh-
..%#...6I.'g...F....z..Q..:........ ..lA..\...`.SLNN5,m.....o.Sj.J...V
.Z.tJ..H..Bc..p[.T.....>}...|...3'f.m..%.r.....$...jN......J. c...K
:[email protected]./:.}.&.Q.U....7..
.'.m.t.......g.*.f..&C.I..6^.h....U..o.cF<....d...O^.e9...J ....F.N
'v.#.._.\.D......(o...n|..........t=Sy.3.4..$.....Q......g..4...J.
<<< skipped >>>

GET /photo/43/60/qq-kvnfrspuke_56.com_.jpg?t=2014022615 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: uface.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 18:03:22 GMT

Date: Fri, 14 Aug 2015 17:03:22 GMT

Server: openresty

Content-Type: image/jpeg

Content-Length: 1876

Last-Modified: Wed, 08 Apr 2015 00:25:08 GMT

ETag: "55247564-754"

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf48:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=3600
......JFIF.............C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((......<.<.."..................................
....../..........................!1.."A.Qq#2a....Bb...................
............(.....................!...1A."aq....2B.............?. i...
...UU7CQ54..z....>.\......et.=..4..Ao.....%.J....I.^....=.......lk.
..P...v,.......Gz.i.f.HX...o.......h.....e.....a...... .5B...QO..!....
...\....ZoT....[5C[*]..2.F...,@.s..#....W..^...J.M5..|.Q].....=.`..=..
;U? r....N..t....,......k|.....S.7..xA.I...W..O.[.%...e_........3.r...
m.w.....J..T.....IM....(.$-.P.......'`n.....H.w...Q.4T...L.I.D...l.$.9
/~r..B.jm...=8_...u..~....z.`........$.to"Q.]e...)la.D.'.3...zm.o.....
%.(..$..%.C,j_-.F.g....>;p...;...b.*!J....L.#.9...y...:..m...CU..n.
R.<<...TY...=0?..'..T...kn..z...g.z....dc$j ..H`Uy.8..`.....|>
;...M..^.9.B..U..m.|............i4....a3......j...4.jJ.{ Z..EB...ND.(.
.Q...z.=<..[.[........."...s......*..A............EW.....Ei.f......
Fy..2....'3v...Q.. '.....u...Y.-.Udv9....I.\Zr}$.>.X{hm.m..p.Z....]
4.OXe...8...8.p1.:.h6&.k}..ER.W..^....V..G,.G.!.`F.'T.......J..#..]E..
...3...J.r.`.V...Ns.6.O...*.j..*[email protected],[email protected]...{
r..m.7...*...2|.. .}..Mi.Q[i..5.)O.c...(..p56..P$jX..... .v~..>....
.\.0?M=..... ..D....i.]3P...).Zq.(pu[..J.v&...\[email protected]{.
...WAi...8....Y($..F...G.....H..;...{..Op.n)[email protected].
..W....n.{SR.UF..*.n.........1.v....."....5?....X.!B...0<.?d..k
<<< skipped >>>

GET /photo/65/1/qq-inqbcwgtzs_56.com_.jpg?869 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: uface.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 18:03:19 GMT

Date: Fri, 14 Aug 2015 17:03:19 GMT

Server: openresty

Content-Type: image/jpeg

Content-Length: 1717

Last-Modified: Mon, 30 Mar 2015 09:42:07 GMT

ETag: "55191a6f-6b5"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf50:3 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................<.<.....................................
......4.........................!..1AQ."aq....2B.#3.br................
........................................!1."A2............?..CD$.WX..f
.|t.TZD.]O.-$.(.......a5B.qX.[....Y.5....!.#.....|t..%7.QW;...u#{..d.y
D...z..`.%I'.....h....\<.&..........x.gs.....3.4ju..)...X.[5%.D"..c
..S..(.|4>......MJ....?..".....w.w...mb..#.W.........j.AU...n}.....
[email protected]>..4......F%M...7...\.....%G..KE......g...>.J....
\.i...........EN.....!j....zJ.*gl...M.....>:.....u.....M......0I.-.
~...p..rH>.h|yt.............2.V,.....&?R....C=.;.....,kHd..r.I.3...
|..V.rt.....}.j......>.z......Uz.*.......i.*x...s.uj..RI~..i.A_|6w.
 #M.T.O...h..h.M./.-..=.y.T6=..N.F.....CkE.UF..c.....N...Z.D....B....^
..d.....h.1;f..z.W.h&....x.$.O.Lc..H.w/2t1F.......U.QR.#.T*..Q.4..\./.
4.]...T..$R....|.B...;F..E.....v.........CS..T5...R.QT.O....e..k.m.l..
...W...OM..`...~<.>...n4.3..-r.&....vy.....a{........Uw...x. .a.
t...7..dX..(=..Q....?M`.....F`.G...1..A.......|.VO6N.hi...Ic%.gU~..<
;gWdh.... .X.7..7Yj&...=.....@.......;......c.X...!B.....6,2.....#..E.
3.......X..5.;V,....GEE..H...z..$hTr..h$.VN....J....J......:.9.VkQ...U
....=.XKO#$.A2%.N....._?..f.I...u#sS-.z..$........Z....0m..z.O..i.....
f^....#./>ux......./S ..4..;P.M..8....xw...c..:~.3K.Z.o.3Ip2FN.F~z.
.Z.s..Pq5dE.<.....Q.M.#AU..m...........C:])X_..q....*j......m.J
<<< skipped >>>

GET /photo/1/97/qq-lykszsawpl_56.com_.jpg?346 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: uface.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Expires: Fri, 14 Aug 2015 18:16:17 GMT

Date: Fri, 14 Aug 2015 17:16:17 GMT

Server: openresty

Content-Type: text/html

Content-Length: 154

Location: hXXp://x1.xiuimg.com/style/xiu/v1/img/pic/xiu_small_avatar.jpg

Cache-Control: max-age=3600

Age: 1

X-Via: 1.1 kf50:9 (Cdn Cache Server V2.0)

Connection: keep-alive
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /photo/95/53/qq-cpctdygsqr_56.com_.jpg?172 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: uface.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 18:03:21 GMT

Date: Fri, 14 Aug 2015 17:03:21 GMT

Server: openresty

Content-Type: image/jpeg

Content-Length: 1764

Last-Modified: Thu, 06 Aug 2015 07:29:54 GMT

ETag: "55c30cf2-6e4"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf50:7 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................<.<.....................................
.....6..........................!."1AQ.aq..#$2Cs.......3b.............
..................."......................!..1"A.Bq.............?...*K
n.%....i).H.Z.3..M.q..Y....A....p.4X...|...|T...!9 8..]........Q.2RV..
...b......aS..I..  &.P.........i..o....pb....*....Cyer..>.<PI...
:CE.OL.Xp{..|S..X.M..*..Vy..X,8G#.?.g...f.,.T.....'.b].....[4.R....2Cz
6....C8..O..[s2S>.G.PM..F.jR..#p../N..v..4.....%I:.w.v....V*.......
/......y..;.b,.Iq.......N.BJ..Ct.....wEyq.3I~..\...MV*.)...M.K..d..zf&
...h..#.=..}..~)..........P.d...I..r...~..].......`.T;r......B.o."9..:
..w....R1.g.uODm.4......N.........Ml......IJ.L....B}.y.8.... Zp..I..y.
......U}u....o....vL.L....i..]....YK...e..........3}..^L".....h..<.
.q.8x{#.4.D...Q...E.j.9..Y'H..H]g~p.Hi .9.G.......#...&Q.#JjRZ])....s_
0P!C.....x-R.].Q):..$...H7m..)*O .E.1......F..S.57...B....C .......\.!
.dQ....p...Q............A....<j..L.....J.a./...9.O.Dc!IC.4....Bm...
.. .q.}a[%..Y...8.. ...R...........!.]5....M.J.E7...N..G..G ..d%Yb^eh-
..%#...6I.'g...F....z..Q..:........ ..lA..\...`.SLNN5,m.....o.Sj.J...V
.Z.tJ..H..Bc..p[.T.....>}...|...3'f.m..%.r.....$...jN......J. c...K
:[email protected]./:.}.&.Q.U....7..
.'.m.t.......g.*.f..&C.I..6^.h....U..o.cF<....d...O^.e9...J ....F.N
'v.#.._.\.D......(o...n|..........t=Sy.3.4..$.....Q......g..4...J.
<<< skipped >>>

GET /upload/js/badge.js?20150720 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xiu.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: DnionOS/1.2.1.2

Date: Fri, 14 Aug 2015 17:48:59 GMT

Content-Type: application/x-javascript

Content-Length: 10719

Connection: keep-alive

Last-Modified: Fri, 14 Aug 2015 17:40:01 GMT

Vary: Accept-Encoding

ETag: W/"55ce27f1-15c31"

Expires: Fri, 14 Aug 2015 17:46:22 GMT

Cache-Control: max-age=300

Content-Encoding: gzip

Age: 163

Via: zjhz_167_175 (DLC-3.0), gd_91_56 (DLC-3.0)
...........}[..6....EEM.H.......,;|..Ml.G..vO..Q..........,i.41/.C6.m_
.m..N..X..d.L....*..G.* .<........E..o.t&..fg/.>......v.].......
[email protected].".......KS.......K.z...].yr...|.....9
.#..,.g....,T..D~.EB~.{.../..7r.........._..g.>KV7...w.t..]>..n.
./"=....U..DD.D$....]IZ'..W...KB...3...>.&...ZM.M....".xM.H?-Yt....
>-Yt..d.LQ..E.C....Y..G.,_CXIVYd..E."T.....!~d.?<E......S.1_....
j.....?.2....O<.. AFj...R9w8f.".#P.j.H..u\...?...'z.F.ht..#m....^..
........A:$'..%.,.r.....~...H....%.OE.. ..U8.....)[.......,._.(......$
.,..W.V...b...AX.X"...M.....^...Q.I.v}..... .c...V._.".l1.}5......*.i.
....H...,*.dJ.C/P.......R............6o..f...l...Y..Ky.B..........)7.{
.6ZFq...]oo...].]QJ.t..@...&..8-..):..o...Qh<./....9S.{L...T...H.{.
.9. ^.9.T..!.C..A.Ld.e*~}v{}.u.l............_E...:L}....,.6X...`.~iY..
......;;......Z..L.. cX..{Z..#..'.m^a.td.|P.Rm..'6.$...<[email protected]...'..
|...F..tg..C.Z......a...@..'W...4.}{.H....R....j.$.{U.4...B..y..n..Yj.
A...F...9!5..."..=.:.9.&Xi.I."#.{P..y.T.y5....E..s.V..yY>X......@V.
...ew$D.>... o..j..C?U.m.......e0u.6.....G.;.....V.M...%.?..E6u..MV
y*.P.u.....m.....^.......q........f....3y..]..7u.ZM.$Pg..tJ-......[R4u
.6...L...I'><u|6.G..j.$A...S..0..*K..G;.U.6$.`..Au.J...m..-...$.
.G...C.D.....r.....vo<.`.V.?.W....;C,..U.h.1....<M4w"....Q.....s
M...#..hb..a..'....U.].k.v_K.Q!b...E-$.....B..L[>.......O..........
6p.@}P..b....G..neem....L..b....=...M0..`6E....f.H.&...\..........<
2.p.*.[..)\.2u..g5.E.G.q.7..V.AV......V..z0.].q..`n..x.......{....
<<< skipped >>>

GET /upload/xiu/95/40/qq-grrqhbaotm_56.com_150814204101.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xiu.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: DnionOS/1.2.1.2

Date: Fri, 14 Aug 2015 17:49:00 GMT

Content-Type: image/jpeg

Content-Length: 13808

Connection: keep-alive

Last-Modified: Fri, 14 Aug 2015 12:41:01 GMT

ETag: "55cde1dd-35f0"

Expires: Sat, 13 Aug 2016 12:41:01 GMT

Cache-Control: max-age=31536000

Accept-Ranges: bytes

Age: 18479

Via: zjhz_167_173 (DLC-3.0), gd_91_53 (DLC-3.0)
......JFIF.....H.H.....C..............................................
......................C...............................................
........................r.............................................
.A............................!1.A."Qa.2q..#R..B...$3Sbr..CU..........
............................8.........................!1..AQa".2q.....
...3BR..#b...............?.h...j;m.^....C6......;%.......8...Ci.Q.....
...ff|.-..c^Y.-F..Y...F..B-Z..C.:.5.?.Jh.mJ.z.I..K........U...T...p...
 ....YW....E.....!*jE..)...c.....m... !G...>ru..G=t....\[...^...U.B
..b.'....3:...*...t..l.].:3.o..'.,......%%..;...,...2X....`H\. .s.....
..u.mV-..5*...=.....Yh....)...<.J.>{..uK_..1wst.y...3}J.t(..]./.
n.C....z...M....m.....aHF...d...xt.<V......2<............|...v..
.....*8.R^............~t.....20T9.;[[email protected].]B#...=...pUg!.Z.^r...R
.FDg...`(.R.Ev..1'..62..s..O.D$.b...=..q}V.Z......G8....!K.....Cr...(T
.l\...2R.M...J d..y>.M^..r.a...>..'..U.[.......=...F.R..'....qJ.
AW"pBTFBI.7..q.....a.l. .........g...)u.C...$.._l.R..R...P...>6N...
....my9m.".P..?......#%^s.t.A\\......V.q..e.l..d.>...Z.".3K.....{..
......'\..u......n..g..{...H..z.M..,.Q......./(....Z...x.<_.s|....7
C.1.nk..elt....Q........A..bj.:...Cg.)....Y?Q..]MKV.Noq.....,"..;.....
J............oI../.Dz".W..-,....q....g........U-...S......pE..R}.n>
.[]/.v........-T...-.D..KPR.!.2..>..E8.y.4X...UXo.a.U..g.....;*..=.
.....nz3.U..Z.RJ.W..:..*...|.V;....lW..j..G.`.~.?...Zw.X....<..G...
i.B.C...^.lT.....]." ....=...>0F5..R1("...Q.....0.w.Y...9..u...
<<< skipped >>>

GET /9.gif?abc=1&rnd=1151261426 HTTP/1.1

Accept: */*

Referer: hXXp://lw.q1.com/zhuce/login_150722_v1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Fri, 14 Aug 2015 17:49:05 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=ERhVDkCWFB4CAcLyYNrWiH2 ; expires=Mon, 11-Aug-25 17:49:05 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=1cc0918b; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=5760a235eff9d69d56f2d651_1439574545; expires=Mon, 11-Aug-25 17:49:05 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=ERhVDkCWFB4CAcLyYNrWiH2 

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Fri, 14 Aug 2015 17:49:05 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=ERhVDkCWFB
4CAcLyYNrWiH2 ; expires=Mon, 11-Aug-25 17:49:05 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=1cc0918b; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=5760a235eff9d69d56f2d651_1439574545; expires=Mon, 
11-Aug-25 17:49:05 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=ERhVDkCWFB4CAcLyYNrWiH2 ..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

GET /stat.php?id=4367119&web_id=4367119 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s4.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 9935

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:46:44 GMT

Last-Modified: Fri, 14 Aug 2015 17:46:44 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache28.l2de1[0,200-0,H], cache53.l2de1[1,0], cache5.ru1[80,200-0,M], cache4.ru1[81,0]

Age: 138

X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2

X-Swift-SaveTime: Fri, 14 Aug 2015 17:49:02 GMT

X-Swift-CacheTime: 5262
(function(){function k(){this.c="4367119";this.R="z";this.N="";this.K=
"";this.M="";this.r="1439574404";this.P="oz.cnzz.com";this.L="";this.u
="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" thi
s.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}f
unction g(a,b){try{var c=.[];c.push("siteid=4367119");c.push("name=" f
(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.pus
h("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent)
);c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()
));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(
d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent
,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),this.ia()
,this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.ea(),t
his.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[this.t]=e
[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:functio
n(){try{var a=this;e._czc={push:function(){return a.B.apply(a,argument
s)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[o
bject Array]"==={}.toString.call(a))for(var b=0;b<a.length;b  ){var
 c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]
"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPage
view":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(
d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz_accou
nt||e._cz_account===this.c){e._cz_account=this.c;if("[object Array
<<< skipped >>>

GET /upload/mm/woxiudatu/24/60/1439176691_plads1_.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xiu.xiuimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: DnionOS/1.2.1.2

Date: Fri, 14 Aug 2015 17:49:11 GMT

Content-Type: image/jpeg

Content-Length: 92215

Connection: keep-alive

Last-Modified: Mon, 10 Aug 2015 03:18:11 GMT

ETag: "55c817f3-16837"

Expires: Tue, 09 Aug 2016 03:18:12 GMT

Cache-Control: max-age=31536000

Accept-Ranges: bytes

Age: 397859

Via: gdst_251_30 (DLC-3.0), gd-91-54 (DLC-3.0)
......Exif..II*.................Ducky.......d.....zhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c01
4 79.151481, 2013/03/13-12:09:15        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:da04eb2c-f484-cc4
4-aa6a-5b51962b09dc" xmpMM:DocumentID="xmp.did:09C36D563C2011E5AA9B830
137C0AB34" xmpMM:InstanceID="xmp.iid:09C36D553C2011E5AA9B830137C0AB34"
 xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:da04eb2c-f484-cc44-aa6a-5b51962b09dc" st
Ref:documentID="xmp.did:da04eb2c-f484-cc44-aa6a-5b51962b09dc"/> <
;/rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket
 end="r"?>....Adobe.d..............................................
......................................................................
.............................t."......................................
.............................................................!1...AQ"2
.aqB#3....R.....bC$.V....r..cs4.W...S..D5E.&7....T%U.FG..dt.6.........
.................!..1".AQ.a.2B#..q...R3...b.C$4...r..S..T.%c...DdU..s.
...5&'...Eeu..FVG............?...^[email protected]......}t#.r.`.E....?.I$c..
[email protected]\.7m.A.0..1.....W.seSP.S....Ri...,.S...g.Ia.'
<<< skipped >>>

GET /c.php?id=5127645 HTTP/1.1

Accept: */*

Referer: hXXp://lw.q1.com/zhuce/login_150722.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: w.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 9935

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:28:17 GMT

Last-Modified: Fri, 14 Aug 2015 17:28:17 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache47.l2de1[0,200-0,H], cache1.l2de1[1,0], cache10.ru1[0,200-0,H], cache11.ru1[0,0]

Age: 1247

X-Cache: HIT TCP_MEM_HIT dirn:0:793696811

X-Swift-SaveTime: Fri, 14 Aug 2015 17:29:01 GMT

X-Swift-CacheTime: 5356
(function(){function k(){this.c="5127645";this.R="q";this.N="";this.K=
"";this.M="";this.r="1439573297";this.P="oq.cnzz.com";this.L="";this.u
="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" thi
s.c;this.G="CZ_UUID" this.c;this.v="1";this.A={};this.a={};this.la()}f
unction g(a,b){try{var c=.[];c.push("siteid=5127645");c.push("name=" f
(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.pus
h("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent)
);c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()
));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(
d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent
,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),this.ia()
,this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.ea(),t
his.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[this.t]=e
[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:functio
n(){try{var a=this;e._czc={push:function(){return a.B.apply(a,argument
s)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[o
bject Array]"==={}.toString.call(a))for(var b=0;b<a.length;b  ){var
 c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]
"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPage
view":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(
d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz_accou
nt||e._cz_account===this.c){e._cz_account=this.c;if("[object Array
<<< skipped >>>

GET /s/passport/Scripts/Common/form_validatorV1?v=20120518 HTTP/1.1

Accept: */*

Referer: hXXp://lw.q1.com/zhuce/login_150722.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.res.szgla.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Fri, 14 Aug 2015 17:48:59 GMT

Cache-Control: max-age=2678400

Content-Length: 1308

Content-Type: text/html

Server: Microsoft-IIS/6.0

access-control-allow-origin: *

access-control-allow-credentials: true

X-Powered-By: ASP.NET

X-Via: 1.1 fuz114:6 (Cdn Cache Server V2.0)

Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.or
g/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>.....
.......</TITLE>..<META HTTP-EQUIV="Content-Type" Content="tex
t/html; charset=GB2312">..<STYLE type="text/css">..  BODY { f
ont: 9pt/12pt .... }..  H1 { font: 12pt/15pt .... }..  H2 { font: 9pt/
12pt .... }..  A:link { color: red }..  A:visited { color: maroon }..&
lt;/STYLE>..</HEAD><BODY><TABLE width=500 border=0 c
ellspacing=10><TR><TD>..<h1>............</h1&g
t;....................................................<hr>..<
p>................</p>..<ul>..<li>...............
.........................................</li>..<li>......
......................................................................
......</li>..<li>....<a href="javascript:history.back(1
)">....</a>....................</li>..</ul>..<
h2>HTTP .... 404 - ..................<br>Internet ........ (I
IS)</h2>..<hr>..<p>..............................<
;/p>..<ul>..<li>.... <a href="hXXp://go.microsoft.co
m/fwlink/?linkid=8180">Microsoft ............</a>..........&l
dquo;HTTP”..“404”........</li>..<li>....
“IIS ....”...... IIS ...... (inetmgr) ....................
....“........”..“............”..“.......
...........”........</li>..</ul>..</TD><
<<< skipped >>>

GET /wm/VZ200705101138395899VK/music/p17_42.mp3 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://vip.hyc.org.cn/music.swf?music=hXXp://rm.sina.com.cn/wm/VZ200705101138395899VK/music/p17_42.mp3

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: rm.sina.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 14 Aug 2015 17:53:25 GMT

Cache-Control: max-age=300

Content-Type: audio/mpeg

Accept-Ranges: bytes

ETag: "1373145766"

Last-Modified: Thu, 10 May 2007 08:55:25 GMT

Content-Length: 1064948

Date: Fri, 14 Aug 2015 17:48:25 GMT

Server: Apache 1.3.29

Age: 34

Via: http/1.1 ctc.shanghai.ts.56 (ApacheTrafficServer/4.2.1.1 [cHs f ])

X-Via-CDN: f=Edge,s=ctc.shanghai.ts.56,c=194.242.96.218
...\.,............\[email protected].... [email protected].|..O.......BnnP.......y.ff.
..;-?..c7'...R....>dhoR_..o..T([email protected].....$.U....O........R..
.~...>.LH..`H......t. ....B......x...........x(..kd....E..T...7C..t
.W.;&...\IE....?..P.7Lf........gR6)...r...&`^..].8..`a..1.....t.@....&
5...V.....\.`3.0...34...bO.s...NE......hY cC........F`c.......... ..@x
....yP....3R|{5 .]#B S'......t..F. :....K.......j.D.........B......T..
.......\U.....e..........(...J...!.*.M.....=.........7.Mo.......4.o...
..9....................Y..."2.UqEB' u3......de.....S?..g.}...o..S..._.
...).....C......"[email protected]..;....8..)....J4DV....wD...z.V...{[email protected]..
dSF...\......c.."..S.....Y0...6.._..9.........................SDM\.S*.
..B<*...l [email protected]./f...[J.........W......b...o........G.=.1...P.o
.0.k.....i.. .....[........_.Ee.V.hVqXZ.f.v..#0a.J.jDa.....x-..)..o.._
........|..,...G..'[email protected],`......$.
.J..3..l.......&...7e..[.b.....z.....>....y{yeo..G.N"]{..^..R......
.C..tY=..=....].z=Z.#.BS...;..$D..=Z{........anO..u.....T....y./.t....
..._.R5...|P0T...2. ....bf..L!k..V.W..../.n.....7....7....-...7qR...P.
...hp.......g.Sh<.y.bV..$m.0.U...T..1.OmMv/W.m.u....N.<.dj.....]
_>yR.:..s.j...........n.[..[.....^.....]'.S..........G].*{eF.U.b...
w....s^woj...Y9...|..~...0.%...@[email protected]....... .......s.R.V...31.u.
.U...E..t.X.....a.C...*,/U.....J&.....&]...V............2...fx..."3.o4
d...KO.o!.K..5...0..9.32.gV...[.0.....~.<c.LZ)..r..V.....i.9h..j3#.
...{.....h.2R ......|qp..M.(.-....nUtHL..$D..a`..`.;..[5)..?..H..&
<<< skipped >>>

GET /crossdomain.xml?ver=1 HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Expires: Tue, 29 Mar 2016 08:19:50 GMT

Date: Mon, 30 Mar 2015 08:19:50 GMT

Server: openresty

Content-Type: text/xml

Content-Length: 288

Last-Modified: Fri, 27 Mar 2015 12:38:01 GMT

ETag: "55154f29-120"

Cache-Control: max-age=31536000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
<?xml version="1.0" ?> .<cross-domain-policy>.<allow-ac
cess-from domain="*.woxiu.com" /> .<allow-access-from domain="*.
zhubotv.com" /> .<allow-access-from domain="*.56img.com" /> .
<allow-access-from domain="*.56.com" />.<allow-access-from do
main="*.xiuimg.com" /> .</cross-domain-policy>.HTTP/1.1 200 O
K..Expires: Tue, 29 Mar 2016 08:19:50 GMT..Date: Mon, 30 Mar 2015 08:1
9:50 GMT..Server: openresty..Content-Type: text/xml..Content-Length: 2
88..Last-Modified: Fri, 27 Mar 2015 12:38:01 GMT..ETag: "55154f29-120"
..Cache-Control: max-age=31536000..Accept-Ranges: bytes..Age: 1..X-Via
: 1.1 kf49:8 (Cdn Cache Server V2.0)..Connection: keep-alive..<?xml
 version="1.0" ?> .<cross-domain-policy>.<allow-access-fro
m domain="*.woxiu.com" /> .<allow-access-from domain="*.zhubotv.
com" /> .<allow-access-from domain="*.56img.com" /> .<allo
w-access-from domain="*.56.com" />.<allow-access-from domain="*.
xiuimg.com" /> .</cross-domain-policy>.....


GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Expires: Sat, 26 Mar 2016 12:57:13 GMT

Date: Fri, 27 Mar 2015 12:57:13 GMT

Server: openresty

Content-Type: text/xml

Content-Length: 288

Last-Modified: Fri, 27 Mar 2015 12:38:01 GMT

ETag: "55154f29-120"

Cache-Control: max-age=31536000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
<?xml version="1.0" ?> .<cross-domain-policy>.<allow-ac
cess-from domain="*.woxiu.com" /> .<allow-access-from domain="*.
zhubotv.com" /> .<allow-access-from domain="*.56img.com" /> .
<allow-access-from domain="*.56.com" />.<allow-access-from do
main="*.xiuimg.com" /> .</cross-domain-policy>.HTTP/1.1 200 O
K..Expires: Sat, 26 Mar 2016 12:57:13 GMT..Date: Fri, 27 Mar 2015 12:5
7:13 GMT..Server: openresty..Content-Type: text/xml..Content-Length: 2
88..Last-Modified: Fri, 27 Mar 2015 12:38:01 GMT..ETag: "55154f29-120"
..Cache-Control: max-age=31536000..Accept-Ranges: bytes..Age: 1..X-Via
: 1.1 kf49:8 (Cdn Cache Server V2.0)..Connection: keep-alive..<?xml
 version="1.0" ?> .<cross-domain-policy>.<allow-access-fro
m domain="*.woxiu.com" /> .<allow-access-from domain="*.zhubotv.
com" /> .<allow-access-from domain="*.56img.com" /> .<allo
w-access-from domain="*.56.com" />.<allow-access-from domain="*.
xiuimg.com" /> .</cross-domain-policy>.....


GET /index.php?action=Play&do=InitPlay&id=1003&userid=1439574551733&chatflag=0&t=0.5279487099684342 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:04 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 14 Aug 2015 17:49:04 GMT

Cache-Control: no-cache, no-store, must-revalidate

Pragma: no-cache

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
f08..{"chatContent":{"sodata":[{"room_user_id":"qq-grrqhbaotm","send_u
ser_id":"csufku","to_user_id":"qq-hxqmxmkhmx","chatmsg":"[`x_awesome`]
","chatdo":{"zl":"1","gi":"31","g":"0","private_live":"2"},"send_user_
info":{"user_id":"csufku","nickname":"\u6e56\u5357\u5927\u5b66\u9ad8\u
5bcc\u5e05","roomid":"159998","user_type":"0","grade":{"in":"6","out":
"22"},"is_good_num":"1","private_chat":"1","user_ext":"new|0&nobadge|0
&facepacks|","ip":"","badge":[],"phone_ext":{"vip":"{\"green\":\"0\",\
"red\":\"0\",\"blue\":\"0\"}"}},"to_user_info":{"user_id":"qq-hxqmxmkh
mx","nickname":"\u7855\u5fc3\u4e0d\u6094","roomid":"31455893","user_ty
pe":"1","grade":{"in":"8","out":"28"},"is_good_num":"0","private_chat"
:"1","user_ext":"new|0&nobadge|0&facepacks|1,100","ip":"","badge":{"1"
:{"t":"244|2","n":"\u95ea\u4eae\u670b\u53cb\u5708\u8fbe\u4eba\u7c89\u4
e1d","c":"w_bgall hz255_v1"},"2":{"t":"233|1","n":"\u70b9\u6b4c\u738b"
,"c":"w_bgall hz251"},"3":{"t":"2|2","n":"\u95ea\u4eae\u6d6a\u6f2b\u73
8b\u5b50","c":"w_bgall mv_002"},"4":{"t":"3|2","n":"\u8d22\u8fd0\u4ea8
\u901a","c":"w_bgall mv_003"},"5":{"t":"1|1","n":"\u5e78\u798f\u516c\u
4e3b","c":"w_bgall bgall_s5"},"6":{"t":"74|2","n":"\u7c89\u4e1d\u94f6\
u8d28\u5956\u676f\u52cb\u7ae0","c":"w_bgall hz118"},"7":{"t":"t","n":"
\u9ad8\u7ea7VIP","c":"vp1"},"8":{"t":"t","n":"\u516c\u7235","c":"gz_ic
on zg05"}},"phone_ext":{"vip":"{\"green\":\"0\",\"red\":\"0\",\"blue\"
:\"0\"}"}},"sendtime":"2015-08-15 01:45:42","public":"1","scheck":"","
ns":"","type":"send","chatno":"1"},{"room_user_id":"qq-grrqhbaotm"
<<< skipped >>>

GET /index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=1&t=0.25663908058275875 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:05 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
39e..{"code":1,"data":[{"user_id":"qq-hxqmxmkhmx","dou":831054,"roomid
":"31455893","nickname":"\u7855\u5fc3\u4e0d\u6094","grade":28,"noble":
{"severn":5,"name":"\u516c\u7235","icon":"<em class=\"ugvfix gr05\"
><\/em>","chat_icon":"gz_icon zg05"}},{"user_id":"qq-exiyyvra
lh","dou":165501,"roomid":"81684265","nickname":"value\u3001\u72ec\u97
38","grade":17,"noble":{"severn":3,"name":"\u4f2f\u7235","icon":"<e
m class=\"ugvfix gr03\"><\/em>","chat_icon":"gz_icon zg03"}},
{"user_id":"csufku","dou":23855,"roomid":"159998","nickname":"\u6e56\u
5357\u5927\u5b66\u9ad8\u5bcc\u5e05","grade":22,"noble":[]},{"user_id":
"qq-inqbcwgtzs","dou":9094,"roomid":"85354774","nickname":"value\u3001
\u671b\u5ae6\u5a25","grade":15,"noble":{"severn":3,"name":"\u4f2f\u723
5","icon":"<em class=\"ugvfix gr03\"><\/em>","chat_icon":"
gz_icon zg03"}},{"user_id":"leung221","dou":2250,"roomid":"86514361","
nickname":"Lsm\u264f\u5c0f\u7c73","grade":6,"noble":[]}]}..0...
...


GET /index.php?action=play&do=getRoomBadge&t=0.5447824661582423&room_user_id=qq-grrqhbaotm HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:06 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 14 Aug 2015 17:49:06 GMT

Cache-Control: no-cache, no-store, must-revalidate

Pragma: no-cache

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
31..{"code":1,"data":{"263":{"1":["qq-hxqmxmkhmx"]}}}..0..HTTP/1.1 200
 OK..Date: Fri, 14 Aug 2015 17:49:06 GMT..Server: openresty..Content-T
ype: text/javascript; charset=UTF-8..Transfer-Encoding: chunked..P3P: 
CP=CAO PSA OUR..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Last-Modified:
 Fri, 14 Aug 2015 17:49:06 GMT..Cache-Control: no-cache, no-store, mus
t-revalidate..Pragma: no-cache..X-Via: 1.1 kf49:8 (Cdn Cache Server V2
.0)..Connection: keep-alive..31..{"code":1,"data":{"263":{"1":["qq-hxq
mxmkhmx"]}}}..0......


GET /index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=3&t=0.429235291877897 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:09 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
401..{"code":1,"data":[{"user_id":"qq-hxqmxmkhmx","dou":22553424,"room
id":"31455893","nickname":"\u7855\u5fc3\u4e0d\u6094","grade":28,"noble
":{"severn":5,"name":"\u516c\u7235","icon":"<em class=\"ugvfix gr05
\"><\/em>","chat_icon":"gz_icon zg05"}},{"user_id":"qq-inqbcw
gtzs","dou":1515016,"roomid":"85354774","nickname":"value\u3001\u671b\
u5ae6\u5a25","grade":15,"noble":{"severn":3,"name":"\u4f2f\u7235","ico
n":"<em class=\"ugvfix gr03\"><\/em>","chat_icon":"gz_icon
 zg03"}},{"user_id":"qq-exiyyvralh","dou":1353364,"roomid":"81684265",
"nickname":"value\u3001\u72ec\u9738","grade":17,"noble":{"severn":3,"n
ame":"\u4f2f\u7235","icon":"<em class=\"ugvfix gr03\"><\/em&g
t;","chat_icon":"gz_icon zg03"}},{"user_id":"qq-cpctdygsqr","dou":4559
03,"roomid":"87603475","nickname":"\u6c89\u8ff7-\u795e","grade":14,"no
ble":{"severn":4,"name":"\u4faf\u7235","icon":"<em class=\"ugvfix g
r04\"><\/em>","chat_icon":"gz_icon zg04"}},{"user_id":"qq-ubx
mbpmylw","dou":69752,"roomid":"85146733","nickname":"FaMiLy\u6c89-\u77
61","grade":13,"noble":[]}]}..0......


GET /index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=4&t=0.6534786860744608 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:10 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
480..{"code":1,"data":[{"user_id":"qq-hxqmxmkhmx","dou":100398459,"roo
mid":"31455893","nickname":"\u7855\u5fc3\u4e0d\u6094","grade":28,"nobl
e":{"severn":5,"name":"\u516c\u7235","icon":"<em class=\"ugvfix gr0
5\"><\/em>","chat_icon":"gz_icon zg05"}},{"user_id":"qq-kvnfr
spuke","dou":8689838,"roomid":"20090582","nickname":"\u73cd\u60dc\u03c
9\u660e\u660e","grade":18,"noble":{"severn":1,"name":"\u7537\u7235","i
con":"<em class=\"ugvfix gr01\"><\/em>","chat_icon":"gz_ic
on zg01"}},{"user_id":"qq-exiyyvralh","dou":6357615,"roomid":"81684265
","nickname":"value\u3001\u72ec\u9738","grade":17,"noble":{"severn":3,
"name":"\u4f2f\u7235","icon":"<em class=\"ugvfix gr03\"><\/em
>","chat_icon":"gz_icon zg03"}},{"user_id":"qq-inqbcwgtzs","dou":30
19027,"roomid":"85354774","nickname":"value\u3001\u671b\u5ae6\u5a25","
grade":15,"noble":{"severn":3,"name":"\u4f2f\u7235","icon":"<em cla
ss=\"ugvfix gr03\"><\/em>","chat_icon":"gz_icon zg03"}},{"use
r_id":"qq-zhjhjgaiqh","dou":2209033,"roomid":"13397848","nickname":"\u
4f73\u4f73\u306e\u547c\u5438","grade":18,"noble":{"severn":4,"name":"\
u4faf\u7235","icon":"<em class=\"ugvfix gr04\"><\/em>","ch
at_icon":"gz_icon zg04"}}]}..0......


GET /index.php?action=HdActive&do=getAthenaRoomPageRank&t=0.22103879664357096&room_user_id=qq-grrqhbaotm&page=1 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:10 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
5e6..{"code":1,"ranks":[{"user_id":"qq-hxqmxmkhmx","dou":"36000","nick
name":"\u7855\u5fc3\u4e0d\u6094","photo":"http:\/\/uface.xiuimg.com\/p
hoto\/68\/22\/qq-hxqmxmkhmx_56.com_.jpg?412","grade":28,"roomid":"3145
5893","guard":"2"},{"user_id":"qq-inqbcwgtzs","dou":"36000","nickname"
:"value\u3001\u671b\u5ae6\u5a25","photo":"http:\/\/uface.xiuimg.com\/p
hoto\/65\/1\/qq-inqbcwgtzs_56.com_.jpg?869","grade":15,"roomid":"85354
774","guard":"2"},{"user_id":"qq-exiyyvralh","dou":"36000","nickname":
"value\u3001\u72ec\u9738","photo":"http:\/\/uface.xiuimg.com\/photo\/6
0\/0\/qq-exiyyvralh_56.com_.jpg?722","grade":17,"roomid":"81684265","g
uard":"2"},{"user_id":"qq-cpctdygsqr","dou":"36000","nickname":"\u6c89
\u8ff7-\u795e","photo":"http:\/\/uface.xiuimg.com\/photo\/95\/53\/qq-c
pctdygsqr_56.com_.jpg?172","grade":14,"roomid":"87603475","guard":"2"}
,{"user_id":"qq-lykszsawpl","dou":"3600","nickname":"value\u3001\u76f8
\u601d","photo":"http:\/\/uface.xiuimg.com\/photo\/1\/97\/qq-lykszsawp
l_56.com_.jpg?346","grade":7,"roomid":"86565607","guard":0},{"user_id"
:"bhuhao8866","dou":"1200","nickname":"\u6d69\u54e58866","photo":"http
:\/\/uface.xiuimg.com\/photo\/39\/29\/bhuhao8866_56.com_.jpg?387","gra
de":10,"roomid":"87281774","guard":0},{"user_id":"lingren","dou":"1200
","nickname":"value\u3001\u7075\u4eba","photo":"http:\/\/x3.xiuimg.com
\/style\/xiu\/v1\/img\/pic\/xiu_small_avatar.jpg","grade":3,"roomid":"
86042928","guard":0}],"stat":{"stars":12,"gift_amount":133,"fans_count
":15,"step":0,"next_star_step":0,"finish":1}}..0......
<<< skipped >>>

GET /html/domain.html HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; Hm_lvt_0d44710c272c2edcd40af46e2c0d6546=1439574558; Hm_lpvt_0d44710c272c2edcd40af46e2c0d6546=1439574558; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:11 GMT

Server: openresty

Content-Type: text/html

Last-Modified: Mon, 27 Oct 2014 11:51:58 GMT

Transfer-Encoding: chunked

ETag: W/"544e31de-443"

Content-Encoding: gzip

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
230............}S...0.}N.b..........I$......*....$n..Kq..U..#.|...../i
7..HIl.3g..3.........".&0y..... ..w.7...cx.|......L9..X.yF.Bn_!@...!!U
U....|E.o.Vi.Up.tD#.."D~....i...?d....Dk......."....}....7...AR&((%.})
....<.,......z.!.^'[email protected]^0..b.<[email protected]..,kC
9Dy!....I.F.....8Oi.)..c.....S..<[email protected]^.$7vp...A.l...Fpo>..9.g..
..p....i.S*.H..*.k[.vkJ..[../k...Tf![....\^.2..5....TO]..f.E-y.KY... .
..|..?.;0(.....at.}.`h8a.JD.C.%.0i..6....... .g......J...:.U....r...fO
...x.k.D.SX.....:U.../t.h..a......W..>..2.s.C....G.@7...{.v..s9~...
.).wj{........#.C.....0..HTTP/1.1 200 OK..Date: Fri, 14 Aug 2015 17:49
:11 GMT..Server: openresty..Content-Type: text/html..Last-Modified: Mo
n, 27 Oct 2014 11:51:58 GMT..Transfer-Encoding: chunked..ETag: W/"544e
31de-443"..Content-Encoding: gzip..X-Via: 1.1 kf49:8 (Cdn Cache Server
 V2.0)..Connection: keep-alive..230............}S...0.}N.b..........I$
......*....$n..Kq..U..#.|...../i7..HIl.3g..3.........".&0y..... ..w.7.
..cx.|......L9..X.yF.Bn_!@...!!UU....|E.o.Vi.Up.tD#.."D~....i...?d....
Dk......."....}....7...AR&((%.})....<.,......z.!.^'[email protected]^0..
b.<[email protected]..,kC9Dy!....I.F.....8Oi.)..c.....S..<.@
.ga^.$7vp...A.l...Fpo>..9.g....p....i.S*.H..*.k[.vkJ..[../k...Tf![.
...\^.2..5....TO]..f.E-y.KY... ...|..?.;0(.....at.}.`h8a.JD.C.%.0i..6.
...... .g......J...:.U....r...fO...x.k.D.SX.....:U.../t.h..a......W..&
gt;..2.s.C....G.@7...{.v..s9~....).wj{........#.C.....0......
<<< skipped >>>

GET /index.php?action=PlayRoomApi&do=moreRecommendHead&room_user_id=qq-grrqhbaotm&t=0.5274907663258246 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; Hm_lvt_0d44710c272c2edcd40af46e2c0d6546=1439574558; Hm_lpvt_0d44710c272c2edcd40af46e2c0d6546=1439574558; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:11 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
195..{"code":1,"data":[{"url":"http:\/\/VVV.woxiu.com\/index.php?actio
n=IndexList&do=cityZbList&page=1&area=其他","name":"\u54
0c\u57ce"},{"url":"http:\/\/VVV.woxiu.com\/index.php?action=IndexList&
do=impressZbList&page=1&mid=1","name":"\u840c\u59b9\u5b50","mid":"1"},
{"url":"http:\/\/VVV.woxiu.com\/index.php?action=IndexList&do=impressZ
bList&page=1&mid=3","name":"\u597d\u58f0\u97f3","mid":"3"}]}..0..

GET /api/c.php?platform_id=2&union_id=1878&union_type=1&link_id=0 HTTP/1.1

Accept: */*

Referer: hXXp://g.4kt2.com/2/1878.html?uid=14516

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.4kt2.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Fri, 14 Aug 2015 17:48:31 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 14 Aug 2015 17:48:31 GMT

Cache-Control: no-cache, must-revalidate

Pramga: no-cache
399..var gconfig={"platform_id":2,"platform_domain":"regapi.6711.com",
"status_login_domain":"my.6711.com","ad_domain_cdn":"http:\/\/kwcdn.00
0dn.com","platform_deploy":"2","union_id":1878,"union_type":1,"union_c
ategory":4,"link_id":-1,"referer":"tglm_6711","title":"\u8d85\u552f\u7
f8e\u610f\u58833D\u7cbe\u54c1\u7f51\u6e38\uff01\u7edd\u5bf9\u4e0d\u53e
f\u9519\u8fc7.","title_id":"2320","ad_param":"17500fdsah","ad_name":"\
u552f\u7f8e\u96ea\u98d8\u7248([FL]\u6a21\u677f)","ad_id":"17500","bann
er_id":0,"swf_file":"\/swfs\/2e\/17500fdsah\/","digest":"","flash_path
":"http:\/\/kwcdn.000dn.com\/swfs\/2e\/17500fdsah\/","width":"1400","h
eight":"700","left":"","top":"0","game_id":"90","game_server_id":"6767
","template_id":3100,"proportion":"100","time_temp":"1439526298"};gcon
fig.key=0;.function getTimestamp(){var d=new Date();var timestamp=Date
.parse(d) d.getMilliseconds();return timestamp}..var vtime = adltime =
 getTimestamp();..0..HTTP/1.1 200 OK..Server: nginx/1.4.2..Date: Fri, 
14 Aug 2015 17:48:31 GMT..Content-Type: application/x-javascript..Tran
sfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.2.
14..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Last-Modified: Fri, 14 Aug
 2015 17:48:31 GMT..Cache-Control: no-cache, must-revalidate..Pramga: 
no-cache..399..var gconfig={"platform_id":2,"platform_domain":"regapi.
6711.com","status_login_domain":"my.6711.com","ad_domain_cdn":"http:\/
\/kwcdn.000dn.com","platform_deploy":"2","union_id":1878,"union_type":
1,"union_category":4,"link_id":-1,"referer":"tglm_6711","title":"\
<<< skipped >>>

GET /2/ HTTP/1.1

Accept: */*

Referer: hXXp://g.4kt2.com/2/1878.html?uid=14516

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.4kt2.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Fri, 14 Aug 2015 17:48:46 GMT

Content-Type: text/html

Content-Length: 1280

Connection: keep-alive

Last-Modified: Fri, 07 Mar 2014 12:21:26 GMT

ETag: "5319b9c6-500"

Expires: Fri, 14 Aug 2015 18:48:46 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes
<html>.<head>.<meta http-equiv="Content-Language" conte
nt="zh-CN">.<meta HTTP-EQUIV="Content-Type" CONTENT="text/html; 
charset=utf-8">.<title></title>.</head>.<body&
gt;.<script language="javascript">..//..var _domain_37 = "p.777w
yx.com|p.17kuxun.com|p.zx910.com";..var _domain_67 = "p.yocc.net|p.zx9
15.com";..var _domain_95 = "p.haliyuya.com|p.0wan0.com";....//baidu_tg
..var _domain_1 = "sgyx.17kuxun.com";..var _domain_2 = "sqyx.17kuxun.c
om";..var _domain_3 = "aszt.17kuxun.com";...var _domain_cu = document.
domain;..if((location.search).indexOf('?404')!=-1){...if((location.hre
f).indexOf('/s/1/403/')!=-1||(location.href).indexOf('/s/2/208/')!=-1|
|(location.href).indexOf('/s/3/1030/')!=-1){....url = "/nopage.html";.
..}else{....url = "/1/843.html";...}..}else if(_domain_37.indexOf(_dom
ain_cu)!=-1){...url = "/1/820.html";..}else if(_domain_67.indexOf(_dom
ain_cu)!=-1){...url = "/2/821.html";..}else if(_domain_95.indexOf(_dom
ain_cu)!=-1){...url = "/3/822.html";..}else if(_domain_1.indexOf(_doma
in_cu)!=-1){...url = "/s/1/381/2763.html";..}else if(_domain_2.indexOf
(_domain_cu)!=-1){...url = "/s/1/381/2747.html";..}else if(_domain_3.i
ndexOf(_domain_cu)!=-1){...url = "/s/1/381/2764.html";..}else{...url =
 "/1/823.html";..}..document.location.href=url;.</script>.</b
ody>.</html>.....
<<< skipped >>>

GET /p/2/1878/0/5.js?uid=14516&lt=18266&key=0&tid=3&0.2769682448994523 HTTP/1.1

Accept: */*

Referer: hXXp://g.4kt2.com/2/1878.html?uid=14516

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: g.4kt2.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Fri, 14 Aug 2015 17:48:49 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive
a..//success...0..HTTP/1.1 200 OK..Server: nginx/1.4.2..Date: Fri, 14 
Aug 2015 17:48:49 GMT..Content-Type: application/x-javascript..Transfe
r-Encoding: chunked..Connection: keep-alive..a..//success...0..

GET /app.gif?&cna=ERhVDkCWFB4CAcLyYNrWiH2  HTTP/1.1

Accept: */*

Referer: hXXp://lw.q1.com/zhuce/login_150722_v1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Fri, 14 Aug 2015 17:49:05 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=ERhVDkCWFB4CAcLyYNrWiH2 ; expires=Mon, 11-Aug-25 17:49:05 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Fri, 14 Aug 2015 17:49:05 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=ERhVDkCWFB4CA
cLyYNrWiH2 ; expires=Mon, 11-Aug-25 17:49:05 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /lw/images/login/login150731/top2_v1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://lw.q1.com/login/login_lianm4.html?radid=lm03_lw&rsid=14516&check=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.res.szgla.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 10 Aug 2015 09:17:39 GMT

Cache-Control: max-age=2678400

Content-Length: 72854

Content-Type: image/jpeg

Last-Modified: Mon, 10 Aug 2015 09:10:30 GMT

Accept-Ranges: bytes

ETag: "543199674cd3d01:24b7"

Server: Microsoft-IIS/6.0

access-control-allow-origin: *

access-control-allow-credentials: true

X-Powered-By: ASP.NET

Age: 1

X-Via: 1.1 quanzhou242:6 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<.....*hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-
c014 79.151481, 2013/03/13-12:09:15        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" x
mpMM:InstanceID="xmp.iid:C5F0DC273F3E11E59579FDE0EDEE85EA" xmpMM:Docum
entID="xmp.did:C5F0DC283F3E11E59579FDE0EDEE85EA"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:C5F0DC253F3E11E59579FDE0EDEE85EA" stRef
:documentID="xmp.did:C5F0DC263F3E11E59579FDE0EDEE85EA"/> </rdf:D
escription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r
"?>....Adobe.d.....................................................
......................................................................
......................................................................
...........................................!.1..AQa.q.."2...B...Rbr.#.
....3CS.....cTU...s.$4DE..%5............................!..1AQ..a.q...
.."2R.....B..b#Sr...3...C.$.c4s............?..HO... 6.Ou ......l..~.i.
~.._.Mqz..T|g..z.....B.{.=..l.0.../.........UO...$.%[email protected]
.X.....\...q..-wZvtWd....M..G..oY0M.<q..UO.......N...b..aY..s....^.
../?s...iP.E.....k.]..=j.. Gv|!/-0./..U;.F50...I....V..:.......o.{
<<< skipped >>>

GET /lw/images/login/login150731/body.jpg HTTP/1.1

Accept: */*

Referer: hXXp://lw.q1.com/login/login_lianm4.html?radid=lm03_lw&rsid=14516&check=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.res.szgla.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 12 Aug 2015 11:02:43 GMT

Cache-Control: max-age=2678400

Content-Length: 181948

Content-Type: image/jpeg

Last-Modified: Mon, 03 Aug 2015 07:39:53 GMT

Accept-Ranges: bytes

ETag: "6b94596bfcdd01:24b7"

Server: Microsoft-IIS/6.0

access-control-allow-origin: *

access-control-allow-credentials: true

X-Powered-By: ASP.NET

Age: 1

X-Via: 1.1 qzh243:4 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-
c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:53FEC53C375E11E5A89DD9
0A38C25D9C" xmpMM:InstanceID="xmp.iid:53FEC53B375E11E5A89DD90A38C25D9C
" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:425225D7375111E59A9CE7A6A2FC1BA9" stRe
f:documentID="xmp.did:425225D8375111E59A9CE7A6A2FC1BA9"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
......................................................................
.............................................!1A..Qa"..q..2..BR#....br
3.S4.....C.$..s..c%u.....DT5&6..dt.EUe......................!1..AQ.aq"
2.....Br3...#..Rb.....$............?...Sk.....@e5... ...5......dDI..6.
@....9....d9.C.dO2.C.....&DU...T.....P."....2....h..........4 ....K...
[email protected]..............................................................
...................................................!..........G.~.
<<< skipped >>>

GET /lw/images/login/login150722/zhuc_tit.gif?v=1 HTTP/1.1

Accept: */*

Referer: hXXp://lw.q1.com/zhuce/login_150722.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.res.szgla.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:31:56 GMT

Cache-Control: max-age=2678400

Content-Length: 6253

Content-Type: image/gif

Last-Modified: Mon, 03 Aug 2015 07:37:33 GMT

Accept-Ranges: bytes

ETag: "d67de642bfcdd01:24b7"

Server: Microsoft-IIS/6.0

access-control-allow-origin: *

access-control-allow-credentials: true

X-Powered-By: ASP.NET

Age: 1

X-Via: 1.1 qzh243:5 (Cdn Cache Server V2.0)

Connection: keep-alive
GIF89a.......*%'..9..2.h2...M:...2.{2.....0.b-.....C.}/cL#!....2)"...@
..A..=-%&.q-.e*..>$"#.Y,5 ,..C.}1'"#..>ZA.$!"%. 4&....P> #. )
#$..5I2%.a-=.!qV.8*.F1$.j).d&.e,..8..5..A5)...F...H.#.....3,'(..A...lg
hxL)..6.}/,((iL%"!"..<.n,.....5..=...^YZ..<..0!....6..4OJJ..5...
..5.i&5(...5&##&!"P:.?::..>*"#..<.....:.....1 . .w..}.# !.m*.|..
.=sY%L4(yss....q*..4,#$.q-". .l-)"#.d .{-...a@(.[ sZ&.p,% [email protected],..@..
?fP%.....>/&. !".d/....~-.g/..3.a u\'.v3>35@/#C.##!#!!".h.......
._ !.!t\'& !.y0:/1@;<$ .2')).!=*..* * !......7-....G3%'$$......,"#.
.......G............lgg..>..2.........$.......E..F.................
.mhh..B....~0leg..@..;......-)*...kee.....;PKK..G..AsX#.c0..4....g&.k,
@2$) !*!"[email protected]#|X'.d*.q0..6H5(.}0W?$aJ ..3.h).....7..7..=..?.
..tX#.n/....~/.~0..0........................!..XMP DataXMP<?xpacket
 begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x=
"adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/0
6-14:56:27        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/
02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="
hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0
/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid
:CCDC7640306511E5850DD91C7CD9AC6F" xmpMM:DocumentID="xmp.did:CCDC76413
06511E5850DD91C7CD9AC6F"> <xmpMM:DerivedFrom stRef:instanceID="x
mp.iid:CCDC763E306511E5850DD91C7CD9AC6F" stRef:documentID="xmp.did
<<< skipped >>>

GET /landingpage/images_0925/104506944.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:48:53 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:58:53 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 19743

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
.M.........................!1.."AQ2Baq..#Rb.3r......C.....$4S....5...6
Ts%c..................................&.......................!..1A."2
Q..Ba............?.........y...Y..Z.7.S*..Nz...J.[6&Tbry....!Qa..j.K..
Q...`<...v...YU:...ru..>.I^[email protected]...{.Nyr.~O..HV'g.R
n.\.-.3.........7y..tH.....D....7..= ..ty.ijwx..~..?..8..%.P.a'5[....S
@.M......F.x*".../t9b....bJ....t...0...a..(R.9..P.N....#...X4nZmhp....
T...%..7.1&._.P...E..s._<...N.\.h.%.u..........iU...]../...&...>
o,.k.D..gw..m.h.Li.f<..hfd....F....h..B."av....A....*Q..d...(P.....
tf.$...2.....N;.L.....w-.....N...n...k.l..i.]..8..M.o...gAA.C...q.H.".
=9......}L2.o.'..t..70...#-.....h....vI..~.pt.8.S.Y..9..49../g..[..G..
0...~....QO9........k.2......P.o.F..iX..S4.6..m.....x..R}.........2cl.
.m.A2..J~.z.....4q.l.OJ.e k.......K.....n......2..D...Q9..|..a..JD..q.
..B.9..{..f.)JSf..<""...!..PLT..d ..f4......(YI7I.x...8..aX.k......
.*.%...m|......5,.6.F.<.....f.i.JUe6s..... ..}...........(8.j..V..N
C2A...X.5d..i.....Z.R.%..Pt...b.v....hu.t.......a.;.Z......(T....{.9..
Y...9f:.&.L......:I...I.$i{..#O8.fO..M..s...m..]...K.Y.r{......Z.uR...
.]O?.6RYoP........7d.._..^... [email protected]..
%Y}...6..\ @....6.F.!..nw...8u>.e..)...ql..4r....8..l.6R.J~(..v..4.
..2..;...G...g....3Fv....KW..#(v.<...{./%.. td!=2....yE.,N.r..q
<<< skipped >>>

GET /landingpage/images_0925/107493457.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:48:54 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:58:54 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 18980

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
J.......................!..1.AQa."2q....#B....3Rb..$r..4CS...5c..7s.D.
...................................)........................!..1A."2Qa
.#Bq.............?....Mj.a.."=....U6.)..jl.w..zn.X..G.....z5gZ..(.q..;
.;Wp9o]........YdT_...^...)...u.Ex..k.o.N.......}"mf..8p..l1....U-7...
q_.08x.f...8.;i<.^...(...%].......p.d..(..i......B~p....U.-....qKM7
...V.G.W....W....K....<#%.L.W.B.~.q..X.S..:.1.....Lm.0....^Z.._.* r
..m.) ........&j\.....I.1.....h|.\....W.J.E..E.I.....c..N...4.Y..c8".(
.Mf.Ei...A..q}%.m.6..^...I....0..;I....:..X..`f...n.m...6.-8(.B.1X....
..&.OFx.....&.YE^..r`.KH?*F[p6lr.fp<H..P....../[email protected]$.1X.
<;..5.EEf...!c....:.2..5PSG.. F.S.A..y ...Czi...._....DWfV......k.2
......)..T..M...H... ......UQ..6c...=.2;m...$=.,..u~:F..e...-......8?.
 ..GL..#.....DV6..s./...A.-Fo(.|..^y..R..t....<...Y.oZq.}@f.D.).L..
......8...I ..j.Y#[email protected]@.e)..g..z!>.....V..d|FzG..T..
A..bn.x..2_3V<.....JaK...n..u....{l..2........I..j4...J..SuUz.a!/(.
.1Z...f].( .'H..>..6..I..#.@._c.Y.QZ..Eu_d..J.F........f.m...k.f{.y
@._...J........R.....l l...]A...=jP....8........z.@............/....,.
.&..Q...V.. ..M=P`...^.....B..1SJ......aj."T.;..>u.......S;..S/6B..
'7..................(U..../..}yp.;#.K.....8..<.c.L6.EsD.L.%>.!q.
1!S...n.8.-1.3[Y([email protected](.Fe.'....wx..`>..u...T.;.....k.
<<< skipped >>>

GET /landingpage/images_0925/94636632.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:48:57 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:58:57 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 14537

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
C.........................!1."AQ.2a..#BqRr....b...$3C.......%4S.......
...........................,......................!..1A.Qa."2q.#3B.R..
............?..}..."... ......GM.....2..n..[p..W.!.$.7@. ..9......n...
.x..%.........>.i...}[email protected].....{.2.<Z....H(.ZYj.h
.....\8..`.'.e|....\\..K..kM...S..2..>j....h.mf..=.mV1..E......S.}.
k.....B.m5.....tR.p.9v........d6im....-........4.......2E ..........]&
lt;i.."..6...8..-..5....>.....w=...^...2.M4.W.^q..^..y"'B.s.l.h.i?.
C.o.t...)...$.s. [.....|...@.<...B...YW&F.r..{.. T.>...t.;..k.M;
&..&..OE!....Kgq.A..[(.i..GU....<[tN.......w.hW...........c..,...'L
\EL..ae...p..0m3..A..."*|&h.....z)=..D.....p.K...K...".n..Y2(ET=......
"..wW.7...q.E...)..Z...R....q..._0;.V.M......:..."|...Q.V..'..7K/(..y.
...../.Y.-,=...]^>=.7...Y....e....% .C.{..F.U..6....".[#..2.Uh.....
.b.....cI$tJ.c.ip....s^..v\.si........4.7,@...^]..x...5.m...\......e..
.J..... .{[email protected]*i/diR...D...i..f8.
k1...x.c..[9....W..rg.H_g...- -.l...L.....t....O...j...^3W.K.. .....q.
k.9.&..]./l. .U...^..E.b......\.....%SR.cr..uq6.....n...b.......z.....
..G=........y..N..7J....kZ.........i.A........(.vIR....Z.........]-..N
.;F.F.v.". x(-..T;......J....K.l,l.6....H.lP.....5F..X.*.......c....X.
...`..z283z'...X.Y*..M....r.u..cn.....,....%x...P.D._..~..n..Y....
<<< skipped >>>

GET /landingpage/images_0925/110523568.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:00 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:00 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 16647

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
G.........................!1..AQ"aq..2.#BR.....3br..$.....Lc.s.5S...
...............................&.......................!..1A."a.2Qq...
..........?..x$bHc{...H..E)..).....M!z...{"|.......2..^...^6.[!.!.....
..tc...../e....2.u....4..st.=3\...J..]]...0.....KU.O.v.......>.\4..
.zt. #).tLh.u..D..%6_0.t.......y9o.!v...0...Wk..#..&.@r>=>.Jo.q.
T..M....D......4..Z.....g.&.\...7.\.~.y... ....4...D..5E....,....G>
.........4...|...U.*......rk.~.....n...7..N..0.....0.u$.>(.l..w....
...... .O..'{.........h..i.m.{^<.o.)....14r`..2K.Lko..lO..P.,..g.3.
..0.R( $}F.HA....A.w.|....{c.fx*%..q.Z....4..W....,M...j..q7.. ..%....
.a}|.Y.....f....@ P...j....m..'.|...Fc.)...........C[^d.....Xt....,TT.
M<]J..^.E..N...E../Y.".O....>....z.....[& ^U...vXBKL/[email protected]..'..Q
F.4..M....a"...h..%...LK|Z;...Nm`...\}.ugN]..F........U......t..=.....
..o...OO.J^7 0.~...*.!..Q0...[..UqR..NE.=....w.>.#...q..{?.%..}..C.
m..~...}.3e......`l......o...bXt..l....GI.UU.....N.>kAx^.....|&Y..{
.. ......j.n..`..-.._...8))..5].Y1.......r..._...hL.o.....kn.......e./
u..&M....Xl.kK|N(....i.Z...K..:.7.X[eX8...M..H)..f..&..G...r.o..t.../%
L...F........ .Q.u>.......'.`.c.u...........#ap.1o.._.GF..qH.#.}p..
5.......N..'.....b..#...jQ....]..#M.V.g.4.....#m.:.zg\J.......O..p.o..
.S'6..o4..q..<...vdqq...>}...3] e...........H...a.N.db{lN...
<<< skipped >>>

GET /landingpage/images_0925/107644834.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:02 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:02 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 14860

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
D.........................!1.AQ."2aq.....#BR.....3.$Cbr.....S.4.Dc....
...........................".......................!1.A."2Qa..........
[email protected] ..)'aA.S.........n'.....&.*}.<..Z.*/...s.....^..U...
/J..-....m:o..\..vE...YA.)...b.]...L..A.v.~.v(...FH.U.|Q...M. H...^5.Z
.Yn#l..HW.:...Wf\...........i .#oR.9...i...#.e..V...D.5..K...T.(...y.u
#8.r...#..$...;R..4..u.@...%i....).A....5\z!..;h}jL....S |..<3...&l
t;....YA..iE..........R>4.fx...2. ..(. DDF.O.a....v.r..t87".....2 .
.c.6N....E....h\g||....O..*..>j.T.....[Hj..K..j.K......G.=k...|.~.d
.).l ...%......G.......f.a:..h.n^0`.....:..L...y...w...........:...M.)
......]^u... .C.'T,...WDr..y.,[email protected]..(r.*...n
[email protected]..$..P.1.mD....U..VQ:..p..%3*&y..8.%:.4p<Tr...})..
,-....PT.*)30F.R...z.....J!.....O.gb.......b..D:..........vE0.za.)....
!...yP}f...\=.l2..........s........(.-W....[.e"'Z..va..0..N....i(..N..
%.}.V.....Q..hPe...#.L......2$m..Jr.S...s..r.....6.......m.P..D.k\....
.*C.B.>..[..B]..PN.o:.....RA....Vt:.q.T'Tb.......;(...........h3.A`
...........*.C.......P(.>..~@F..^B.U%].../.<ei..5.....R....T...(
k>t.S.x....*i....be...(.]........m].iR..PM.hv.. . m.R|.8.=."p.4.)q|
|....$. .}jh.fK..)..*g.n.u{kd.4{0...6.....{.$..!*qe...cz..qh.1...)]...
...N4......R.Z....../.T.L.......y......Dj.}. 2....T.,0...X<....
<<< skipped >>>

GET /landingpage/images_0925/108613721.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:02 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:02 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 13872

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
.I.......................!..1.AQ"a.2q.#B...R....3br......$45S...ls..
..................................#.......................!..1A.aq2Q..
..........?.w.}G.k]Qu^...F..t.0..[..d...q....R*.&.C.bd*...mE.........Z
......"K..>.0ez.9.p._.K..q.$.W...[.#..nX(.G..d.d.#....X.N. ....~.Q.
..8....,.%8.........|mO9.F.....%k......`..0.S......K....X.}4.*.{H0?.W.
V.jUci..G.. ......O......;.p.......>[email protected].. ..}D..8B.|.....%h).
.F......a.Ip;GeFL.$.Gc.QQdL..n.\.5...83)X......@..].O...<....'.....
..H.ec'.|.. .....%..T... 8...?U\.2.|..*..T....Dr..H=....._.........].s
Sw4.Bgwl%!B..MF.s.........:z....w..B..s^.W.:.*.%...... R.l..#.yDR..}N.
Z]AL..$-|...za...X..2w...H...\M'd4..=.iDm.B......W..Z9..I.k.O.UX%X...O
.Ti....#.......ce..9...}..H...C....i....`w.....D..K....m....|Q.)...w.%
T..2.....R.8-..*..{$.'.]!...pc....N.......6A ...`....3.......1.Bc..j~.
.".%DL..I("o?3...TC...>^J......It4..._4.Z.c..v...W..l...B.F....Z...
p.X.O....:.w.......tT....w.V/.kF.d.h........HS.....)....[....IZe.....G
.u?......z.gR....>..VM;[email protected]......._Y.Y.-x...d......jcdQ
.f]..I]...V} .9.....T/`...........J./#..@"[email protected]....`{..
..>?y^kO......?.....;Q....j?q....Wn.y.....{...........|c.....-z..QU
...-.&%i#>.h.9'........|"...D.t..T..A...(....1.g.....l.?.....BC_0|`
.1..!..g..Tp.........tG.m-...dLw.y@.$..<...q..|G.30"W..t..u.Q..
<<< skipped >>>

GET /landingpage/images_0925/111637032.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:03 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:03 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 20532

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
G.........................!1.."AQ..2aq#B...3Rb...Cr....$...4Ss..%.c...
...............................&........................!.1"A..2Qaq...
..........?...h.....p.8......Qp.]s.eT.oN...Z[.K~yz..NdR....DdJ...s.a.6
...S.......uy.../,4}...e.U....Z........^L......#.V2V.T......:...0.E~za
..f......K..&.x........8.K.8.i-.8..i.u(.....u.....Qs....e.-6G..2....v:
.3....:.............m!.I.*..fY.2........./x...K....n.3..AC.......v{g.m
`..2..R.g.#8....9.s..f....N..\.2n...._./.&n{U;AG[.S.u.G".oQ.)..k8....S
.q...H....x......qO$&a..c...*.E....).S..}.\(^.I0Z...Fi..&.RG2H..Lg.OL!
.^^..d. .......C.%<..'*[.N...../.az.].....u.c..I..F..|..'...1B...o.
....^.\...k98.....~J1.=y.o.J.uB.....)x=*....AW...hZ..8......J..<..&
...?8..0.WB.x.2.....2eR.(....s.!.b..Q.[[email protected]\..Kd.l!
Xa$:..RL......`R.......~.3A..Kn...c.......p9.....e..l>[email protected].....
oq......^7JA.....Bb....i.{G*....JQ...RE.....'Ms..]...f6i..rhrh&.q....^
C........!.Z..x.....<.w..~q.4.@.....,...`[email protected].
..L%d .X`..r......l.'h.U-6.....$q..yyF..|.Z......':.#.O.....%</}.i.
..~P.j]1.l.`n...o.n...1Px.2. x..A!....;..|........[..0....-6...(.5....
.qE.wkf....,..6.6....Li...J.....qBT......<<.... }gvn}.....e.Z...
.tH.&.E.&.!.....A(..C..k..8...rl.13...0..4.3.F\....,2.q.....m(.!.qs.E$
sZcIu.........'..M.../6..<@[email protected] 0....|9BVB..8.$..FH.y
<<< skipped >>>

GET /landingpage/images_0925/106730492.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:04 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:04 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 15181

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
.F.........................!1.."AQa..2Bq.#R..3br......$C....4...%ES...
...............................1......................!.1.A."Qaq.2....
.3..#Br..............?..`\.E9.;...)2. m?.Ph..{t...~i.:X.fH.......B...D
..!i..;....J..FE!.hO..Y...6.....B.......yg.1...f*....7......*iiy>..
........}{w...>./|..RHZ...k.?.........9.3.N../7>M.t...5..!.u'.B.
..."J.vd}m-.A..!FM.d..UeW.h...r...Q$.fi....-...x....]M..'.4 .W...]...Z
a...a....~.x.....(7.8....M.=Nvo.47..4;U'5...V...M..9MV..m~`{...l.....7
.....S.N .8..v.........H.,m...-f..u).......:.0auo..G...'.K....1:w\yO..
q..|...8..<..GE..6.2]ZT..$K....$......@..&.a.|@.ZILQ...&...(a..YG.L
E.x....O*..:cx.L.....@..\.._.....;O...%]CIm.pV.|.xx...`qSS..j....r.<
;..l.b....J 0....wM....d.."..:.(..C.a.m...H.b.h..Z.....z.K.\.......L..
#%.....f.Z=...Z...S|M..'[..iu..].28K}}U...>...#k..O...E....-.FM...,
8H....K....fy9....T.|.T....OP..MX.p.0.Z......B...............Uv...g.i.
E..s..6..".k.:j..{tw.Y....U'....1g..G.U1o=.._64.};...........Cb5b(dy..
............yP_.. (k..Y...........)..dM....I...8p.r........4..nnN..h..
V..R ....W..}.!...u?..6c..5$%	)M...Z[..@b.^f..LrS....Na:-.d.J.T:...V
5.(.7.%.....]....f..?........O."'........n<....q..tm..^....u..qc. z
^..n...... ............S_...k.3Fh%:.....O.j.8..4..U..0.q..|...9....<
;5.[.&.D.u.....QT.=..?B.e.c.d...R3.....q."Q...A..t]..q.&.Q.......t
<<< skipped >>>

GET /landingpage/images_0925/106779355.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:04 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:04 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 12932

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
.E.........................!1.AQ."2aq..B.#Rbr....3..........$4S.C.Tc..
.............................$.......................!1..AQ."2Ba......
......?..B.J.../....A1...@$...!.S...A.R.}..h!.#...(.ll...K`6@*.N.E.huE
.{E.,..T2..{Yf..<N...q.8..._..J,"...B....p5....w.I~\...h.h......|dw
......].za...h\G....b3U<....>...G.}Gf.>*d..G{__.V.j).."...'..
......1.........X.......n..]:..cQ....}....z//.. ...m..g.T2...!....*.(.
`.t....vq..l..eS...1.Z...ji8&y...!..C......L. ..E.*0M|....i....t.GE .%
..S.o.wE.]a{.!..). A..b...5@b..@*...P...A....j../.aXU....Tt....YM.....
=9& ....{..K"....UL............)......G...c..jz..p.....'..e..'&.slC...
.9t.....PUi....s.'].OI. .s.:rT[[email protected]..'|R.F....J.c[...q?.@f..
.%3.'c.P.v..wd.....wq....oA...M.n'MQ.!Lb...\...........y........t.....
s.:..k!%.....Wf.My .....).qm..>...D$..........lF.K......U.;.k..QA37
.[%.~k.y...*.t.I..R.tB.L../....=3...vAh......A3p....'{.....t>i.6...
^...;,86....D.Al-w.. ..%..6.O..O.c..U..t.R.....C....Z.$].....%la.....O
.>....-a......%t.;1..).....g...mw..4....[.O.G..kK..-.=......p....y.
O......w.p.e<.eUD..KY....I..>'n\..X....{Y.j.(x...VK....9..].....
.|.q.].o.GET.O...Z........\... .gc,..0..e.~=.&[..G4ic...<,.K.5..@c7
-B...'s}..!.q#@..4..neA.......ko .@...,...<..P1.p..'.R<.b....])n
..(&f=....p ....njy.o..:...|?.D..G.M....k...I#..d..wsw..;...~.....
<<< skipped >>>

GET /landingpage/images_0925/58404730.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:05 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:05 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 18530

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
.I.........................!1."A.2Qa.BRq..#br....3........$....CSs].
..4................................)......................!...1AQ.a.".
.q#2B............?..b)Z.t.D..S.A...3.3./..*J..'9P.o*..E..aES..ZK.\J..b
3..'L..k..:...e@. ............d.Q..%R.>.S.../...F...OXH.U..5}/.....
|.Yz)...I|.t.LwG....&.o.F.M#.....#ewsRV.^......\{u....j..[.^.B..U(@I.&
lt;.. ..Zl)@.G...K.....)V.*{A.$$....{b|a....-4..X#i%_. ~.b...).4......
7js. J3..H..]8....w...J..S..).].?.Q[.\...{.*T...J6.#I..j..iY$L.....r&l
t;(T.U.......P.."o..e.8P..^.}..:...q.....$..I...'....s..Y....d....y!%'
10z...&.........t...x...Ioa...........F..k....\..*r.t."..>./$u....M
......u..4)s]..4q...\.S.^Z......J.J;..S...&A..6..A ....4W...e..V.i]...
.mC1P..n...|h7.T.....5..;vb..Z.X.S.J..q..I[e@i*.T..x..|....;o.........
............IR....@;}....`..x.DO.n^...."..(.......^.r... .2..}O.seT..%
D....Hu..q...!2u.....yU...N....hK.......<..../[......g...V-.0....[1
.s.bD.*...J..e.~P.....U..a..[.<.......O*0..Vp9Tr...........O. .....
1T...D.75<...N)..7I."...T.[....\....%Q..-y\.U...K..jfc1.W@...&..;S.
.12G.P...x).2...}U}.....8. *..~.-.,.t..X..-........(P...]w?.GLH....H.j
....9`........eL......bp.g..{...]o.....K.u... .M.C)..x.5.t....V....V.^
.b..:.Er.....e?({.BIJ.......q.).). .& ...p.o;..U`....O6o....^.fP.\,.'1
...Rd....Y.Q.;Q.=..[H....7....&..L.R..&fN.us.$...H...1......p.....
<<< skipped >>>

GET /landingpage/images_0925/106801898.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:05 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:05 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 14168

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
C.......................!..1.A."Qa.2q.BR...#...3br...$C.....S..%4.....
..........................$.......................!1..A.Qa."q.........
...?...a.....<.$...@Z$K.s)S...i.g.B....y.&!".>S..*. 7...L.^.....
..iP..O.q....p....*..5L`p0................#.6...s._..'p....^|...\.#.a'
..,..Y.j....A...... ;...[t...s\C..f .o_J.k.4.m.j5..1..&..'.*...M"MG=..
.......Q....ci....A..]3.w.[..4.#..=.......1..q.."7....@..#....eQ..H...
...... ....^h<..J...q...>Wv=.}CX...M..}[email protected].. v<
...2.H...G#.=....[...~H0....P......J...2.....e..J.?3.N... .j../#K.Z...
.........a....1..j.v[..(..}.."...a.....3>..r...p.....l.;.....P.0...
.....#..}v...V]3..W.1...\....<../..9.U.<....t|b.c....3`..Y.V....
t.....).N....Q`pd.q.Nh.k".m.O.= [email protected]...."AU*~*........d..>..b./X.
sV...k...3.....\j...u...8pWw...8}....-<.Z.9...#..)...FB`..,p .'H..'
mF.*).Z.q...TP.......XV].P....f."3.."..Lc$vE..*.D..KJ.h.g...k........I
. .........d...r`c.U.........Q.).F...\`L.F.K....@..>.D....b.K...P0.
..R...............z=..*Vl.........8i.OL..kj5."".=..OQ...!.~.v.9e.c..i.
5...F.|)<a..f..B.Q.[0..%i.m^.....E....[F..6'.TE..S..]I.)..r..-....2
...o\.#..q......%...U.|9.Ou3.KJ.B8....Ua.....#..t........M..6...|.2.]C
.5".M...Vg!@$.pB5E..g.:P...Bm. .1...B'$.r9..b"}.(.=..1.R. .\r.5.N..>
;...P.. ....J.........}..yo...fPy....;....h.I....F][email protected]..
<<< skipped >>>

GET /landingpage/images_0925/111659089.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:07 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:07 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 12967

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
G.........................!1AQ.."2aq.#B....3Rb...$r...Ls....56STct..
...............................".......................!1...A2Q.......
......?..x..O.*3..W../..u..&.*.....m8..>...&.`.....^:'...v[._]..(..
f..b.*.......R....*......R.Uq.rw<..V.. .IWUS&.........{.Q|K $....KF
t.Y...g.x!.j....(Kfc..o.m.......)..k..S....j.dJ...,...q...YE\NE.6.....
..eE...n...U/..>3.M[.5Q.D.....0.0...T.]fK.........|X.#.mK.....4.|1.
....A..|.o.g.T.&Gv .g.3R...t..<........_z-Q.\K..;5...~....q..yLn.4v
.C.......gb..>.S.....*.[..6i.j..........,.6p.x..[yy....Kolr.=F.....
.N....-U.e..#....l6\>.zY..T.0i...I..P5.......1.....C\....t.M.~.....
..I.@F...>@......Z|.......:.Q..4...tSK....~...^K....O.<x........
>#ih.....R...\...TV.7...O....$_P..dKYSk.e.~..~MUq..s.2j..,n.KV.....
}k..3..1^[email protected].=.fY....J...0.w]..A........4{:.e..b&l
t;.T......`Z......v.m..S5...?S.q.S..rq5.*g...7K..h..[8/.aSKas.....GN..
U;5......Q...Fau...fQw..?G^/......j/t..hWG)......l...].......pWw.6-.D.
..t.)[email protected].)FrsG.....t. ..o..H..A.%@3.XN...p..!P......I
 *..i. .}..GV._..T..*..dp.T..(..f..l......#8.}gp.H$c....y..s?k6.Sj..~.
......kh.C....(U%[email protected]..;...**...?...&.J.=.j...&t...g.{I.Q.
..Ew.........M....p......... U.....S......Z....E.......=....7.M2.e)HG}
...X..tQ.[.e...CiY...u...A#y....}.....v7W.%/TM.t.......qW.TWq...&.
<<< skipped >>>

GET /landingpage/images_0925/95230235.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:08 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:08 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 18640

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
.L.........................!.1.."2AQa.#Bqr.3Rb..$....4..CS...Dcs...%&5
E....................................*......................!1..A."2Q.
a.#Bq3..............?....{...-..#.lgv...J....#..K.um.9.UN3..o....I...|
S.%f..Qy9/..gd..2<. \.G.G..R([email protected]}...*`B..^.0$...x.2.S[.....?}..H.
H.R..%........j.b....b.M-\.n....H...U....\E..!n.a..../.q.C|[email protected]>
....-.TQ1....:.,|Z....t1D..b...|.>...Q...... g.K....<.....k.7.=.
..3.J..zo.S....."hR.v.&k.&,../.[o.C ......'.F'.....T.6.n..p.f...F.&l.n
[email protected].._.......p..6.H....[....O...1.G..3.Y.z.1..b.-n..3.j..<..?ch.
...V...v.)u.B....;GA.....O?...C........].Z...f..w.....:.,#JX].sIO...f.
.y..D8Y....%0.x.Q.C... .a.2%.%)..TA..J<*n.KO_nc.;.\.Ns....&T.$:x..W
K-u....oW ..#.[.W....r..J.1.i.N...0......2t.>...n.6X...1...X(}.o.sA
 ..[az.....|/........".CG......sL...d.$$.I..2\../-....d....tO~...9... 
.vFww._.|bT.Z....`.....5.H.I...).H.1.v...U..A.... V.P....O..2....-4..#
...'q.N|]...b..|..q...gw'.`.e.*.....C...f..e....r|T.e9a. ..k.=...../.C
....:8.....O%.... u..'L.....e!.....-.;[.>.....68....z....e}..0j.L9D
.'.....Z.3f..R.....ay...n.~d.....3..\....4T3f?.,.W..D4.H.....V.d.[...-
....Y.7...VA...Z!..,,i?.j .c.."...*!|..SVS..hs..Z|..3Z.Y]q/F...n.....s
....k..>~<..14R.a.U...t...[Or..:}..O..../oTc.s.!...g{M6p.%..]7%.
.P.YKi/..T5.....Su})\.igf......o.b3...0.<.C...A........&.X.&.:v
<<< skipped >>>

GET /landingpage/images_0925/108020309.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:09 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:09 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 21327

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
K..........................!."1..2AQa#BRq..br....$3C.....4.....%5Sc...
..&................................/......................!.1.A.Q"2aBq
.3..Rbr................?....y...,)\A.....k..K...r.......,.....\.LI..3(
U.)......X.Z...q.Zw..pe....0^iM.....^.(Q6...^Q...R..... &............c
h...]/.......t.!...^.4..........o..4N.zy...A.....X.v..O....N.`..q.l~S.
...)I..$]]/hM`[email protected]!...f...$.c~..'.N.g..-.k...).y.>.4..hk$.
...0<.y`..n6...}"-B..H..[..h6.....I.!7....S...> * .....!......&l
t;...%!-...-.qM..&...m6.... ..Wm...De..Y...m22-...}.g.=Ly...4-1LL.9;X.
s~.......x-lN..*p..O.s....V....:F.-h.YVSX%..m......p.<..`.w......Gn
B....Jm.kG..No?..W....:.O.o.v..j.N.0....,..Lo.$,...j..96.Y*.cq.FX.kL&l
t;.......&dT.|.<.'..9.....iKa.........5ZmTa....z..L.s.._...s.*;.Z..
X.g.ABL....x.[a.C......[{...^X"...A...ltrZ\()J6..Z.qIe...oq..;k12...._
..E.$s%$..1.Ii9o{.ll?tM..fQ..........c.m"k....l..^..3.....'..k.u.Tk...
8..R....6.....X.{......n..../...$)X./-...)C.A..._L.o;...v.....R..v'hYV
........S........g..&Y.M.`.....?.Tsrv..}..i...s..<..S..6h.<..!.n
...1.?.].-.-s.AU..z^..c.A....q,....*Rb.. .. s&.....y..TL.....Hn..$dG..
;.~8R.R.....ZLt..5.u..x.%h.y..9....cENi...C. .W......tb.BGO0c...9t..*.
.7.:t.!:z{..0.m.. M8.d.x[T...V.9H.....f..&=,W,.p..Q....]..-m.!((.o.o .
..l.@<....U.N2.SIRS.@#.3.k....q..i ,.......:EZ.(.......Q....*%1
<<< skipped >>>

GET /landingpage/images_0925/105280318.jpg HTTP/1.1

Accept: */*

Referer: hXXp://shangmen.fzyol.com/yjm/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images9.baihe.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_Appimg_HY

Connection: keep-alive

Date: Fri, 14 Aug 2015 17:49:10 GMT

Cache-Control: max-age=600

Expires: Fri, 14 Aug 2015 17:59:10 GMT

Last-Modified: Tue, 04 Aug 2015 06:25:43 GMT

Content-Type: image/jpeg

Content-Length: 16989

X-Cache-Lookup: Hit From MemCache
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ......"."...........................................
O.........................!1..A"Qaq..2...#3BRb...r.....$..ECs...ESUc
....6Dt...............................$......................!1..A.2Q"
a.q............?...#l..'.:...}....^<....4...5iF=..gw.`i.,=....O}r.{
t.]').60j.BkO.....Q5..`.....\..@......}. ..#[email protected]@.lI.iBN
...".DY6..kH.M.1....d..r.U6..(.h:.T.M..*A_U....M.Q..a.`....ihN.P......
.@[email protected] ..YSN!....l9z...LM..H.3(./....X)_I.W#.[.h...].7..Z....
..8.C:T....g..c...X..(..T....FA....... h.H>U4...5..."u........nH...
5lt.....M..v..H...7j...8...".".....0U,&..L...9J...32;..s#...N'......9.
......:...>.g;...F..;..6........4]..6sdo@k8.:....z.[WS...O...I.J{L.
_.5....#5.v}_.i..Z.%[email protected].\... .....:.0j.L......jCA.4.
8i.N.(.....Dz.....!ofV..#S.(..xy.[d..V.pKV.y.=..{.......x.. ..U]..aj..
...f<k).w....g6...<=..Nb\RP.R.*.S...9.8>o.{kz..n9k.4...0D....
.f...1.c`)..Z.i.*D.q.......N........q...6.b.).n.o.:.........j..z.3.'M.
......{..j..gjR...S6..G.3.._.zU[V.t_.X..........iF.We^k..e4T..4.#....p
v...$..k...rll.a.&dVm17[g])e.....fET.i.M.n$.E.AM.PU.%T.A.o.d.mg'j. e..
..m..T..OH.|I.X_.Y% .q..(.:.e......q..{U.Q.o...r...)~3.(...H.|k.......
... ...F.)...(x...x...t..."....\\4.y3)R:.:..| <....9}...?.>K....
ql8K.=$fP....H......)f.A.5U.H.........>.C.Nu.'.....D.6.......J.,.a.
.E.N$)7,.....N..um............qF..u.j.K.,...u.R.. ;...g"&..R..&4.w
<<< skipped >>>

GET /mshow.aspx?AID=10851 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.sanyangbinggui.cn/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cc.zgunion.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Expires: -1

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

Set-Cookie: UnionIfrmADShowTG=1806; expires=Fri, 14-Aug-2015 20:48:37 GMT; path=/

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 17:48:37 GMT

Content-Length: 4317
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:...Y.^.>....u....i...].o.
...W..[,...v....|...E.L.....U..o5w~qq...6w..]...>:l...fLo..4.....w.
........>;........w..9..)..%...W.y^..../.v.a[_.....b9...m.....z./.q
YM3.5..../.......5.hqH....q.L.U.e.q...e....}.K~I0...;..l.....v.H.f..C|
.|../..0..>....a..2.J.fm~.|.|../\.?.6.."o.......6........U......"..
r.Y]....A../N...>...~&...'h..G.m}..;....l....v.(N..w,.c.9^0....;...
^*u.........1_..ey........r..Z.R.n.~..G....O..........;.'i.~ .t.......
s.A...EN.>"....[.....p..........i".C...../..n.byA...`*`.......~....
:.|..*..X. ._..j..., ...89.2D".....C..g...........>...2.d..b0..e.Kb
....".t...g.w.m..[.;#...G. ..>.}.;.._....O....A.......*g...R.3?...A
.............S...:......~.g...O<.. "....*.}.......3..|.. ...'.W...M
.u....<. ...w..................>...7&....e>. .=.-..&?[.[Q...|
.{.{......{...m...G.yF.t..B...G...y..~....(b..F\S..nl....9}.:;.."..Z..
_..:.?o.../.6{.f..)F.E....v^[email protected]..^O..,V..%F..j.
.b.m.6.$.[.9h.MH.h/..I.1i..2...P....6.......W....mZ.>..._.~....;.w?
%....QzU.H.}..Q:...y..N..i........>}.....|.w|.o...}..x{...}zo......
..C?Nv.....d..?....]...c.fo#6{..!....>ZUM...(.4U.&KW.......C2......
.o...|Z..G{O....{;.........@}..}..(..c..s...y..d.8..=.|V\2.og.....<
 .rV..-i....yU/...6i.t.....4..#.@4....~..3.i....}8)..[.P,W.6m.W..YO...
.. e...G........o..^ ......A#8........Fb\.?.3.[K...... [ _.#y.4.f.L\j.
Mk..9..v.^!...y..{...lj~}K.M~...7....q.a...W.....o.u).2.....U.,..B
<<< skipped >>>

GET /mshow.aspx?AID=10851 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.sanyangbinggui.cn/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cc.zgunion.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Expires: -1

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

Set-Cookie: UnionIfrmADShowTG=1037; expires=Fri, 14-Aug-2015 20:48:38 GMT; path=/

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 17:48:38 GMT

Content-Length: 4291
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:...Y.^.>....u....i...].o.
...W..[,...v....|...E.L.....U..o5w~qq...6w..]...>:l...fLo..4.....w.
........>;........w..9..)..%...W.y^..../.v.a[_.....b9...m.....z./.q
YM3.5..../.......5.hqH....q.L.U.e.q...e....}.K~I0...;..l.....v.H.f..C|
.|../..0..>....a..2.J.fm~.|.|../\.?.6.."o.......6........U......"..
r.Y]....A../N...>...~&...'h..G.m}..;....l....v.(N..w,.c.9^0....;...
^*u.........1_..ey........r..Z.R.n.~..G....O..........;.'i.~ .t.......
s.A...EN.>"....[.....p..........i".C...../..n.byA...`*`.......~....
:.|..*..X. ._..j..., ...89.2D".....C..g...........>...2.d..b0..e.Kb
....".t...g.w.m..[.;#...G. ..>.}.;.._....O....A.......*g...R.3?...A
.............S...:......~.g...O<.. "....*.}.......3..|.. ...'.W...M
.u....<. ...w..................>...7&....e>. .=.-..&?[.[Q...|
.{.{......{...m...G.yF.t..B...G...y..~....(b..F\S..nl....9}.:;.."..Z..
_..:.?o.../.6{.f..)F.E....v^[email protected]..^O..,V..%F..j.
.b.m.6.$.[.9h.MH.h/..I.1i..2...P....6.......W....mZ.>..._.~....;.w?
%....QzU.H.}..Q:...y..N..i........>}.....|.w|.o...}..x{...}zo......
..C?Nv.....d..?....]...c.fo#6{..!....>ZUM...(.4U.&KW.......C2......
.o...|Z..G{O....{;.........@}..}..(..c..s...y..d.8..=.|V\2.og.....<
 .rV..-i....yU/...6i.t.....4..#.@4....~..3.i....}8)..[.P,W.6m.W..YO...
.. e...G........o..^ ......A#8........Fb\.?.3.[K...... [ _.#y.4.f.L\j.
Mk..9..v.^!...y..{...lj~}K.M~...7....q.a...W.....o.u).2.....U.,..B
<<< skipped >>>

GET /mshow.aspx?AID=10851 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.sanyangbinggui.cn/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cc.zgunion.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Expires: -1

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

Set-Cookie: UnionIfrmADShowTG=1135; expires=Fri, 14-Aug-2015 20:48:40 GMT; path=/

X-Powered-By: ASP.NET

Date: Fri, 14 Aug 2015 17:48:39 GMT

Content-Length: 4304
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:...Y.^.>....u....i...].o.
...W..[,...v....|...E.L.....U..o5w~qq...6w..]...>:l...fLo..4.....w.
........>;........w..9..)..%...W.y^..../.v.a[_.....b9...m.....z./.q
YM3.5..../.......5.hqH....q.L.U.e.q...e....}.K~I0...;..l.....v.H.f..C|
.|../..0..>....a..2.J.fm~.|.|../\.?.6.."o.......6........U......"..
r.Y]....A../N...>...~&...'h..G.m}..;....l....v.(N..w,.c.9^0....;...
^*u.........1_..ey........r..Z.R.n.~..G....O..........;.'i.~ .t.......
s.A...EN.>"....[.....p..........i".C...../..n.byA...`*`.......~....
:.|..*..X. ._..j..., ...89.2D".....C..g...........>...2.d..b0..e.Kb
....".t...g.w.m..[.;#...G. ..>.}.;.._....O....A.......*g...R.3?...A
.............S...:......~.g...O<.. "....*.}.......3..|.. ...'.W...M
.u....<. ...w..................>...7&....e>. .=.-..&?[.[Q...|
.{.{......{...m...G.yF.t..B...G...y..~....(b..F\S..nl....9}.:;.."..Z..
_..:.?o.../.6{.f..)F.E....v^[email protected]..^O..,V..%F..j.
.b.m.6.$.[.9h.MH.h/..I.1i..2...P....6.......W....mZ.>..._.~....;.w?
%....QzU.H.}..Q:...y..N..i........>}.....|.w|.o...}..x{...}zo......
..C?Nv.....d..?....]...c.fo#6{..!....>ZUM...(.4U.&KW.......C2......
.o...|Z..G{O....{;.........@}..}..(..c..s...y..d.8..=.|V\2.og.....<
 .rV..-i....yU/...6i.t.....4..#.@4....~..3.i....}8)..[.P,W.6m.W..YO...
.. e...G........o..^ ......A#8........Fb\.?.3.[K...... [ _.#y.4.f.L\j.
Mk..9..v.^!...y..{...lj~}K.M~...7....q.a...W.....o.u).2.....U.,..B
<<< skipped >>>

GET /1.htm HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.cfmogu.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:48:20 GMT

Content-Length: 5

Content-Type: text/html

Content-Location: hXXp://VVV.cfmogu.com/1.htm

Last-Modified: Thu, 13 Aug 2015 01:54:11 GMT

Accept-Ranges: bytes

ETag: "b8bfe1f26ad5d01:2e839"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET
4.7.6HTTP/1.1 200 OK..Date: Fri, 14 Aug 2015 17:48:20 GMT..Content-Len
gth: 5..Content-Type: text/html..Content-Location: hXXp://VVV.cfmogu.c
om/1.htm..Last-Modified: Thu, 13 Aug 2015 01:54:11 GMT..Accept-Ranges:
 bytes..ETag: "b8bfe1f26ad5d01:2e839"..Server: Microsoft-IIS/6.0..X-Po
wered-By: ASP.NET..4.7.6..

GET /index.php?action=Play&do=UpdateRoom&room_user_id=qq-grrqhbaotm&user_id=1439574551733&type=&islive=y&t=0.8944996767820068 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:04 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 14 Aug 2015 17:49:04 GMT

Cache-Control: no-cache, no-store, must-revalidate

Pragma: no-cache

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
f17..{"fanstop":{"roomFansNowTop":[],"roomFansWeekTop":[{"dou":4530198
,"user_id":"qq-hxqmxmkhmx","nickname":"\u7855\u5fc3\u4e0d\u6094","head
img":"http:\/\/uface.xiuimg.com\/photo\/68\/22\/qq-hxqmxmkhmx_56.com_.
jpg?412","grade":{"out":{"index_now":101720000,"rank_now":28,"name_now
":"\u8d22\u795e28","index_next":123720000,"rank_next":29,"name_next":"
\u5929\u738b29","step":2558125,"dou":"121161875","cfg":[{"rank":28,"na
me":"\u8d22\u795e28"},{"rank":29,"name":"\u5929\u738b29"}]},"in":{"ind
ex_now":360000,"rank_now":8,"name_now":"\u94bb\u77f33","index_next":50
0000,"rank_next":9,"name_next":"\u94bb\u77f34","step":31207,"dou":"468
793","cfg":[{"rank":8,"name":"\u94bb\u77f33"},{"rank":9,"name":"\u94bb
\u77f34"}]}},"roomid":"31455893"},{"dou":493332,"user_id":"qq-exiyyvra
lh","nickname":"value\u3001\u72ec\u9738","headimg":"http:\/\/uface.xiu
img.com\/photo\/60\/0\/qq-exiyyvralh_56.com_.jpg?722","grade":{"out":{
"index_now":5720000,"rank_now":17,"name_now":"\u5de1\u629a17","index_n
ext":8720000,"rank_next":18,"name_next":"\u603b\u776318","step":187229
1,"dou":"6847709","cfg":[{"rank":17,"name":"\u5de1\u629a17"},{"rank":1
8,"name":"\u603b\u776318"}]},"in":{"index_now":2000,"rank_now":2,"name
_now":"\u7ea2\u5fc32","index_next":20000,"rank_next":3,"name_next":"\u
7ea2\u5fc33","step":17375,"dou":"2625","cfg":[{"rank":2,"name":"\u7ea2
\u5fc32"},{"rank":3,"name":"\u7ea2\u5fc33"}]}},"roomid":"81684265"},{"
dou":295352,"user_id":"qq-cpctdygsqr","nickname":"\u6c89\u8ff7-\u795e"
,"headimg":"http:\/\/uface.xiuimg.com\/photo\/95\/53\/qq-cpctdygsq
<<< skipped >>>

GET /index.php?action=Play&do=getUserListPart2&room_user_id=qq-grrqhbaotm&user_id=1439574551733&t=0.7839964297304807 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:05 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 14 Aug 2015 17:49:05 GMT

Cache-Control: no-cache, no-store, must-revalidate

Pragma: no-cache

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
1f08..{"manage":{"managerList":{"qq-hxqmxmkhmx":{"room_user_id":"qq-gr
rqhbaotm","user_id":"qq-hxqmxmkhmx","uid":"31455893","grade":28,"sday_
level":5,"rich_level":"5033.0","nickname":"\u7855\u5fc3\u4e0d\u6094","
isLiver":0,"isManager":1,"gradeInRank":8,"gradeOutRank":28,"isGoodNum"
:0,"isVIP":1,"phoneVip":"{\"green\":\"0\",\"red\":\"0\",\"blue\":\"0\"
}","userTag":0,"userExt":{"xiuCard":"1"},"ghBadge":{"id":null,"badge":
null},"hdbadge":{"status":1,"badge":[{"t":"244","title":"\u95ea\u4eae\
u670b\u53cb\u5708\u8fbe\u4eba\u7c89\u4e1d","css":"w_bgall hz255_v1","l
evel":"2"},{"t":"233","title":"\u70b9\u6b4c\u738b","css":"w_bgall hz25
1","level":"1"},{"t":"2","title":"\u95ea\u4eae\u6d6a\u6f2b\u738b\u5b50
","css":"w_bgall mv_002","level":"2"},{"t":"3","title":"\u8d22\u8fd0\u
4ea8\u901a","css":"w_bgall mv_003","level":"2"},{"t":"1","title":"\u5e
78\u798f\u516c\u4e3b","css":"w_bgall bgall_s5","level":"1"},{"t":"74",
"title":"\u7c89\u4e1d\u94f6\u8d28\u5956\u676f\u52cb\u7ae0","css":"w_bg
all hz118","level":"2"}]},"gradeBar":{"in":{"dou":"468793","g":360000,
"ng":500000,"step":31207},"out":{"dou":"121161875","g":101720000,"ng":
123720000,"step":2558125}},"map":0,"carid":"1045","officialSign":0,"se
ller":{"status":0,"url":""},"noble":{"severn":5,"name":"\u516c\u7235",
"icon":"<em class=\"ugvfix gr05\"><\/em>","chat_icon":"gz_
icon zg05"},"isGold":0,"is_ban_talk":0,"is_set_manager":1,"device":0},
"qq-exiyyvralh":{"room_user_id":"qq-grrqhbaotm","user_id":"qq-exiyyvra
lh","uid":"81684265","grade":17,"sday_level":5,"rich_level":"3022.
<<< skipped >>>

GET /index.php?action=PlayRoomApi&do=getRankFans&room_user_id=qq-grrqhbaotm&type=2&t=0.29743014459576555 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:09 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
40c..{"code":1,"data":[{"user_id":"qq-hxqmxmkhmx","dou":4530198,"roomi
d":"31455893","nickname":"\u7855\u5fc3\u4e0d\u6094","grade":28,"noble"
:{"severn":5,"name":"\u516c\u7235","icon":"<em class=\"ugvfix gr05\
"><\/em>","chat_icon":"gz_icon zg05"}},{"user_id":"qq-exiyyvr
alh","dou":493332,"roomid":"81684265","nickname":"value\u3001\u72ec\u9
738","grade":17,"noble":{"severn":3,"name":"\u4f2f\u7235","icon":"<
em class=\"ugvfix gr03\"><\/em>","chat_icon":"gz_icon zg03"}}
,{"user_id":"qq-cpctdygsqr","dou":295352,"roomid":"87603475","nickname
":"\u6c89\u8ff7-\u795e","grade":14,"noble":{"severn":4,"name":"\u4faf\
u7235","icon":"<em class=\"ugvfix gr04\"><\/em>","chat_ico
n":"gz_icon zg04"}},{"user_id":"qq-inqbcwgtzs","dou":101671,"roomid":"
85354774","nickname":"value\u3001\u671b\u5ae6\u5a25","grade":15,"noble
":{"severn":3,"name":"\u4f2f\u7235","icon":"<em class=\"ugvfix gr03
\"><\/em>","chat_icon":"gz_icon zg03"}},{"user_id":"csufku","
dou":26055,"roomid":"159998","nickname":"\u6e56\u5357\u5927\u5b66\u9ad
8\u5bcc\u5e05","grade":22,"noble":[]}]}..0......


GET /index.php?action=PlayRoomApi&do=getAjaxFreeBroadcastCount&user_id=1439574551733&t=0.26503781888000233 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:10 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
3b..{"code":"0","msg":"\u4e0d\u5b58\u5728\u7684\u7528\u6237id"}..0..font>....


GET /xapi/plapi.php?pl_type=xiu&roomid=1003 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; Hm_lvt_0d44710c272c2edcd40af46e2c0d6546=1439574558; Hm_lpvt_0d44710c272c2edcd40af46e2c0d6546=1439574558; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404

HTTP/1.1 200 OK

Date: Fri, 14 Aug 2015 17:49:11 GMT

Server: openresty

Content-Type: text/javascript; charset=UTF-8

Transfer-Encoding: chunked

P3P: CP=CAO PSA OUR

X-Via: 1.1 kf49:8 (Cdn Cache Server V2.0)

Connection: keep-alive
98f..{"1":[{"id":"471","title":"\u5b9a\u4f4d\u8d5b\uff0c\u5206\u7ec4\u
624d\u827a\u5927\u6bd4\u62fc\uff01","href":"http:\/\/VVV.woxiu.com\/hu
odong\/summerLeague","onclick":"setGoogleStat('Woxiu_GGS','GGS_471','g
gs_1_471');","src":"http:\/\/xiu.xiuimg.com\/upload\/mm\/woxiudatu\/24
\/60\/1439176691_plads1_.jpg"},{"id":"425","title":"\u5468\u672b\u79ef
\u5206\uff0c\u5e93\u5b58\u72c2\u7ffb1.5\u500d\uff01\uff01","href":"htt
p:\/\/VVV.woxiu.com\/announce\/140.html","onclick":"setGoogleStat('Wox
iu_GGS','GGS_425','ggs_1_425');","src":"http:\/\/xiu.xiuimg.com\/uploa
d\/mm\/woxiudatu\/24\/60\/1428995798_plads1_.jpg"},{"id":"472","title"
:"\u7b7e\u7ea6\u65b0\u4e3b\u64ad \u8d62\u53d6\u8c6a\u534e\u5956\u52b1"
,"href":"http:\/\/VVV.woxiu.com\/huodong\/unionsign","onclick":"setGoo
gleStat('Woxiu_GGS','GGS_472','ggs_1_472');","src":"http:\/\/xiu.xiuim
g.com\/upload\/mm\/woxiudatu\/24\/60\/1439274866_plads1_.jpg"},{"id":"
461","title":"\u5468\u672b\u5f69\u86cb\u7838\u4e0d\u505c\uff0c\u66f4\u
6709iPhone6\u7b49\u4f60\u62ff\uff01","href":"http:\/\/VVV.woxiu.com\/i
ndex.php?action=Activity&do=brokeEggs2015 ","onclick":"setGoogleStat('
Woxiu_GGS','GGS_461','ggs_1_461');","src":"http:\/\/xiu.xiuimg.com\/up
load\/mm\/woxiudatu\/24\/60\/1437104533_plads1_.png"},{"id":"426","tit
le":"\u6211\u79c0\u4e4b\u58f0\u7b2c\u56db\u671f\uff0c\u300a\u592a\u9b3
c\u626f\u300b\u603b\u8be5\u9057\u5fd8\u4e86\uff01","href":"http:\/\/ww
w.woxiu.com\/story\/15.html","onclick":"setGoogleStat('Woxiu_GGS','GGS
_426','ggs_1_426');","src":"http:\/\/xiu.xiuimg.com\/upload\/mm\/w
<<< skipped >>>

GET /index.php?action=PlayRoomApi&do=moreRecommendData&room_user_id=qq-grrqhbaotm&page=1&t=0.6627516678864604 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.woxiu.com/1003?p=20113164

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.woxiu.com

Connection: Keep-Alive

Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20113164; __x_sid=14516; __x_webpage=1; forever_={"uvisit":1}; uaid=1439574551733; Hm_lvt_0d44710c272c2edcd40af46e2c0d6546=1439574558; Hm_lpvt_0d44710c272c2edcd40af46e2c0d6546=1439574558; CNZZDATA4367119=cnzz_eid=703645937-1439574404-&ntime=1439574404