MD5: 1e098dc6ef83586fd05b2b3780e28423
SHA1: 4dd86978354398157650d320a0fddf166774db5f
SHA256: babafe7015fe84adb4e7b0202be2a71699cd8037aa5a82873d5082e933708ed8
SSDeep: 12288:uMhalZMvRhoVYmd4FrFeFdFKFGF7FjFwFvFwxC7pxG5r7I58K65L7sLjqQrJc/QI:uMQlZMveKxOzi2hpgtiC7pxG90SzPymL
Size: 762593 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2007-04-26 09:56:30
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

mstsc.exe:1216
spoolsc.exe:828
ieLock.exe:2548
1210828.exe:720
qqz.exe:1912
misse.exe:1928
%original file name%.exe:512
lasrse.exe:2444
lasrse.exe:3460
mstsv.exe:596
NOTEPAD.EXE:2604
secie.exe:2300
regsvr32.exe:3836
dkdez.exe:2308

The Trojan injects its code into the following process(es):

kisse.exe:2240
serverc.exe:676
svchost.exe:1588
svchost.exe:1884
svchost.exe:3688
svchost.exe:3568

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process ieLock.exe:2548 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (745 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk (763 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DF4379.tmp (0 bytes)

The process kisse.exe:2240 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\QQNews\QQNews.exe (58 bytes)

The process 1210828.exe:720 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\rasman.dll (1529 bytes)
%System%\rasmanOrg.dll (61 bytes)

The process qqz.exe:1912 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\1210828.exe (601 bytes)

The process %original file name%.exe:512 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mstsc.exe (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kisse.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\alg.exe (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mstsv.exe (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope12.bat (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\secie.exe (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lsass.exe (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spoolsv.exe (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\svchost.exe (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\services.exe (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\serverc.exe (1686 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\misse.exe (278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\explorer.exe (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winlogon.exe (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qqz.exe (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dkdez.exe (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spoolsc.exe (28 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ope3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\opeA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\opeE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\opeB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\opeF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\opeC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\opeD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope6.tmp (0 bytes)

The process secie.exe:2300 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Helps\ieLock.dll (69 bytes)
%WinDir%\Helps\ielock.ini (72 bytes)
%WinDir%\Helps\ieLock.exe (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ope15.bat (44 bytes)

The Trojan deletes the following file(s):

%WinDir%\Helps\ope13.tmp (0 bytes)
%WinDir%\Helps\ope14.tmp (0 bytes)
%WinDir%\Helps\ope11.tmp (0 bytes)

The process dkdez.exe:2308 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\lasrse.exe (31 bytes)

Registry activity

The process mstsc.exe:1216 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 1C 2C B0 06 09 55 FC 98 E1 8D 18 78 9D AF 58"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

The process spoolsc.exe:828 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D8 B7 F2 11 5A AC 22 7F AE 12 43 80 BD 30 F6 BE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

The process ieLock.exe:2548 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
"Flags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
"Flags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
"Flags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
"Version" = "*"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
"Version" = "*"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{2BA1194C-8219-4C38-93DA-2E57F1308DBD}" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
"Version" = "*"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B 7A CA 93 70 EB 77 FD F6 CD 3A 15 9E F5 DB DB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu]
"{871C5380-42A0-1069-A2EA-08002B30309D}" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2BA1194C-8219-4C38-93DA-2E57F1308DBD}]
"(Default)" = "RisingBHO"

The process kisse.exe:2240 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A D4 A3 56 8B F3 6F C0 24 46 20 F3 DB C8 7F 9F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"QQNews" = "%Program Files%\QQNews\QQNews.exe /r"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 1210828.exe:720 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 B0 5C 85 AB 43 01 AE 5F 07 32 03 22 E8 11 9D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process qqz.exe:1912 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 2F D6 52 EC 6A 7A B4 BF 0D ED 45 F2 79 9E E6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process misse.exe:1928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 97 60 15 17 28 6D 19 EE 91 EB 81 3D 2E 9F 16"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:512 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"SERVICES.EXE" = "services"
"lsass.exe" = "lsass"
"mstsc.exe" = "mstsc"
"ope12.bat" = "ope12"
"alg.exe" = "alg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"secie.exe" = "secie"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"serverc.exe" = "serverc"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"mstsv.exe" = "mstsv"

"dkdez.exe" = "RavCopy Module"
"kisse.exe" = "kisse"
"misse.exe" = "AdSpirit"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 7C 1F 4C 28 C8 0F 43 6E F7 F2 4E 8C 06 00 35"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"explorer.exe" = "explorer"
"spoolsv.exe" = "spoolsv"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"qqz.exe" = "qqz"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"svchost.exe" = "svchost"
"winlogon.exe" = "winlogon"
"spoolsc.exe" = "spoolsc"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process lasrse.exe:2444 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 A5 63 9B AF 7C 10 D7 54 8C 65 76 8F BA 5E 6D"

[HKLM\System\CurrentControlSet\Services\lasrse]
"Description" = "lasrse"

The process lasrse.exe:3460 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 16 E5 74 2B CC E1 67 C1 97 C8 7F 2D 6C 73 C1"

The process mstsv.exe:596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 DF 74 F9 9A 41 3D E3 DE 2D C0 8A 06 06 BB DB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

The process NOTEPAD.EXE:2604 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 24 09 52 AB F6 FF 07 A6 7E 49 95 0A 42 D1 99"

The process secie.exe:2300 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9E 4B F5 4D 89 E5 7F 3F 1A A7 0D E3 F5 61 F6 04"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"ope15.bat" = "ope15"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%\Helps]
"ieLock.exe" = "ieLock"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process regsvr32.exe:3836 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A BF 0A EB D6 1F 62 CD 34 8D 40 1D F8 9F C1 11"

[HKCR\CLSID\{2BA1194C-8219-4C38-93DA-2E57F1308DBD}\VERSION]
"(Default)" = "2.0"

[HKCR\CLSID\{2BA1194C-8219-4C38-93DA-2E57F1308DBD}\InprocServer32]
"(Default)" = "%WinDir%\Helps\ieLock.dll"

[HKCR\TypeLib\{937BD1EA-BDEB-4720-B8BE-A0D54EE71FD9}\2.0]
"(Default)" = "ieLock"

[HKCR\Interface\{82C7B3E8-D8EB-456F-A6E4-1DDFBBCDC6EE}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{937BD1EA-BDEB-4720-B8BE-A0D54EE71FD9}\2.0\HELPDIR]
"(Default)" = "%WinDir%\Helps"

[HKCR\Interface\{82C7B3E8-D8EB-456F-A6E4-1DDFBBCDC6EE}]
"(Default)" = "_Class1"

[HKCR\CLSID\{2BA1194C-8219-4C38-93DA-2E57F1308DBD}\ProgID]
"(Default)" = "ieLock.Class1"

[HKCR\CLSID\{2BA1194C-8219-4C38-93DA-2E57F1308DBD}\TypeLib]
"(Default)" = "{937BD1EA-BDEB-4720-B8BE-A0D54EE71FD9}"

[HKCR\TypeLib\{937BD1EA-BDEB-4720-B8BE-A0D54EE71FD9}\2.0\FLAGS]
"(Default)" = "0"

[HKCR\CLSID\{2BA1194C-8219-4C38-93DA-2E57F1308DBD}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ieLock.Class1]
"(Default)" = "ieLock.Class1"

[HKCR\Interface\{82C7B3E8-D8EB-456F-A6E4-1DDFBBCDC6EE}\TypeLib]
"Version" = "2.0"

[HKCR\ieLock.Class1\Clsid]
"(Default)" = "{2BA1194C-8219-4C38-93DA-2E57F1308DBD}"

[HKCR\Interface\{82C7B3E8-D8EB-456F-A6E4-1DDFBBCDC6EE}\TypeLib]
"(Default)" = "{937BD1EA-BDEB-4720-B8BE-A0D54EE71FD9}"

[HKCR\CLSID\{2BA1194C-8219-4C38-93DA-2E57F1308DBD}]
"(Default)" = "ieLock.Class1"

[HKCR\Interface\{82C7B3E8-D8EB-456F-A6E4-1DDFBBCDC6EE}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{937BD1EA-BDEB-4720-B8BE-A0D54EE71FD9}\2.0\0\win32]
"(Default)" = "%WinDir%\Helps\ieLock.dll"

The process serverc.exe:676 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 84 A5 A5 95 7D 93 D2 B7 48 0E 9B A9 96 81 18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://1.rwdns.com/zztj/yeshe.html	103.24.95.182
hxxp://1.rwdns.com/GetData.asp	103.24.95.182
hxxp://1.rwdns.com/SetData.asp	103.24.95.182
hxxp://www.a.shifen.com/s?wd=南京华扬太阳能维修
hxxp://124.248.254.82/web/click_log2.asp?ad_url=47556mqqu?**rrr+lq==0+fjh+fk*r`g*w`b*lfdvqZ470Z4+dvu&cr=yes
hxxp://www.a.shifen.com/
hxxp://yd.ecoma.glb0.lxdns.com/
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=4690803&web_id=4690803
hxxp://www.a.shifen.com/img/bd_logo1.png
hxxp://www.a.shifen.com/img/baidu_jgylogo3.gif
hxxp://1111.ip138.com/ic.asp	183.238.101.232
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/jquery/jquery-1.10.2.min_f2fb5194.js
hxxp://2c20bdadcc004a3d.cdn.fhldns.com/xc.txt
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/global/img/icons_b5457670.gif
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=4690803&t=z
hxxp://oz.cnzz.com/stat.htm?id=4690803&r=&lg=en-us&ntime=none&cnzz_eid=1728210536-1429193417-&showp=1916x902&t=&h=1&rnd=316818665	198.11.132.200
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/global/js/all_async_popstate1_0c1233e7.js
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/home/js/nu_instant_search_fb92f064.js
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/global/img/quickdelete_9c14b01a.png
hxxp://flow3002.6299.cc/ClientAPI/flowtaskAPI.aspx	218.85.133.70
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/sug/js/bdsug_547e5a10.js
hxxp://www.a.shifen.com/favicon.ico
hxxp://passport.n.shifen.com/passApi/js/uni_login_wrapper.js?cdnversion=1429193425851&_=1429193425101
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/baiduia/baiduia_b45d552b.js
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/plugins/every_cookie_09fe94e0.js
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/baiduia/JSocket_9a52fc3e.swf?0.05
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/plugins/env_5202315f.swf
hxxp://suggestion.a.shifen.com/su?wd=&zxmode=1&json=1&p=3&sid=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498&cb=jQuery11020564010697925782_1429193425102&_=1429193425103
hxxp://124.248.254.82/web/reg/icast_125_1.asp
hxxp://suggestion.a.shifen.com/su?wd=Ä&zxmode=1&json=1&p=3&sid=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498&cb=jQuery11020564010697925782_1429193425102&_=1429193425104
hxxp://base64.wshifen.com/img/pc.gif?_t=842
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=132663274	42.120.219.171
hxxp://t1.n.shifen.com/ps_default.gif?_t=1429193428632
hxxp://t1.n.shifen.com/ps_default.gif?_t=1429193428648
hxxp://t1.n.shifen.com/ps_default.gif?_t=1429193428663
hxxp://bcs.jomodns.com/public03/pc.gif?_t=1429193428632
hxxp://cnzz.mmstat.com/app.gif?&cna=0rC2DWbMLVwCASU5EL1qq92F	42.120.219.171
hxxp://n4cs.gccdn.net/a/20150405/40098172_1.shtml
hxxp://n4cs.gccdn.net/base/jQuery/jquery-1.9.1.min.js
hxxp://yd.ecoma.glb0.lxdns.com/ifeng/sources/inice_v1.js
hxxp://yd.ecoma.glb0.lxdns.com/ifeng/sources/region_v1.js
hxxp://region.ifeng.com/get?format=js&callback=setRegionCookies	211.151.175.10
hxxp://n4cs.gccdn.net/commonpage/1130/F-RequireJS.min.js
hxxp://n4cs.gccdn.net/314bd925cdd17196/2014/1203/pc.css
hxxp://n4cs.gccdn.net/a/2015/0311/fa.min.js
hxxp://n4cs.gccdn.net/commonpage/1210/comment.number.min.js
hxxp://n4cs.gccdn.net/commonpage/1129/v1/all.png
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://n4cs.gccdn.net/commonpage/0709/d_07.png
hxxp://n4cs.gccdn.net/e01ed39fc2da5d4a/2013/1205/health.gif
hxxp://yd.ecoma.glb0.lxdns.com/0f56ee67a4c375c2/2013/1106/indeccode.png
hxxp://n4cs.gccdn.net/commonpage/0304/arrow.gif
hxxp://n4cs.gccdn.net/cmpp/2014/12/24/07/1d2544d2-0a9e-4b12-87b8-30facc8dd482.jpg
hxxp://pagead46.l.doubleclick.net/tag/js/check_359604.js
hxxp://partnerad.l.doubleclick.net/gpt/pubads_impl_59.js
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-2/html/container.html
hxxp://n4cs.gccdn.net/e01ed39fc2da5d4a/2014/0317/sharebg.gif
hxxp://x.gslb.jdcache.com/exsites?spread_type=2&ad_ids=552:5&location_info=0&callback=getjjsku_callback
hxxp://n4cs.gccdn.net/base/origin/F-amd-1.2.0.min.js
hxxp://mapdx.icast.cn/hdt-cookie/ck?n=preViewCookie_35&v=bye&t=0
hxxp://mapdx.icast.cn/hdt-cookie/ck?n=force_preview&v=FT1504130011-4493-CT150407010&t=-1&turl=http://adm.icast.cn/nortb/hdt-ifocus/request/?id=PM1304281078&be_retarg=RE141201001
hxxp://admdx.icast.cn/nortb/hdt-ifocus/request/?id=PM1304281078&be_retarg=RE141201001
hxxp://www.a.shifen.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860
hxxp://t1.n.shifen.com/it/u=194142598,852924299&fm=58
hxxp://t1.n.shifen.com/it/u=3488912159,3986088090&fm=58
hxxp://t1.n.shifen.com/it/u=2394089844,1505224976&fm=58
hxxp://t1.n.shifen.com/it/u=3537516083,882981865&fm=58
hxxp://t1.n.shifen.com/it/u=3263161068,3203223156&fm=58
hxxp://t1.n.shifen.com/it/u=602776483,2047304585&fm=58
hxxp://wwwstatic1.wshifen.com/r/www/cache/static/global/js/call-bdbrowser_97c84903.js
hxxp://passport.n.shifen.com/passApi/js/uni_login_wrapper.js?cdnversion=1429193460319&_=1429193460101
hxxp://t1.n.shifen.com/it/u=1288538148,116491288&fm=58
hxxp://t1.n.shifen.com/it/u=4267047014,3229650163&fm=58
hxxp://s.a.shifen.com/w.gif?q=0‡20ˆ30†60„80†30„90ˆ50Š70ˆ00…00ˆ50‹00‡20‰50ˆ20…10ˆ40‰7&fm=se&T=1429193454&y=B776A7CF&rsv_cache=0&rsv_svoice=0&rsv_pre=0&rsv_reh=63_83_63_83_63_83_63_63_103_63|304_387&rsv_scr=1895_1242_110_0_902_1916&rsv_psid=6483934B3F9915C4C4DEE385E7300A12&rsv_sid=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498&cid=0&qid=8ec273590001dc81&t=1429193461944&rsv_iorr=1&rsv_tn=baidu&rsv_ssl=0&path=http://www.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=%C3%84%C3%8F%C2%BE%C2%A9%C2%BB%C2%AA%C3%91%C3%AF%C3%8C%C2%AB%C3%91%C3%B4%C3%84%C3%9C%C3%8E%C2%AC%C3%90%C3%9E&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V%2BD3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860
hxxp://static.n.shifen.com/v.gif?pid=201&pj=www&fm=behs&tab=baidu_browsershow&path=http://www.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=%C3%84%C3%8F%C2%BE%C2%A9%C2%BB%C2%AA%C3%91%C3%AF%C3%8C%C2%AB%C3%91%C3%B4%C3%84%C3%9C%C3%8E%C2%AC%C3%90%C3%9E&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V%2BD3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860&wd=0‡20ˆ30†60„80†30„90ˆ50Š70ˆ00…00ˆ50‹00‡20‰50ˆ20…10ˆ40‰7&rsv_sid=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498&t=1429193461194
hxxp://www.a.shifen.com/cache/fpid/ielib_0108.js
hxxp://c.e.shifen.com/c.gif?t=0&q=0‡20ˆ30†60„80†30„90ˆ50Š70ˆ00…00ˆ50‹00‡20‰50ˆ20…10ˆ40‰7&p=0&pn=1
hxxp://www.a.shifen.com/cache/fpid/o_0108.swf
hxxp://s.a.shifen.com/w.gif?q=0‡20ˆ30†60„80†30„90ˆ50Š70ˆ00…00ˆ50‹00‡20‰50ˆ20…10ˆ40‰7&fm=inlo&rsv_psid_page=0&rsv_psid1=6483934B3F9915C4C4DEE385E7300A12&rsv_psid2=8C833062B6F97482CA56473B4B36B66F&rsv_psid_type=2&rsv_psid_dev=010&rsv_sid=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498&cid=0&qid=8ec273590001dc81&t=1429193465210&rsv_iorr=1&rsv_tn=baidu&rsv_ssl=0&path=http://www.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=%C3%84%C3%8F%C2%BE%C2%A9%C2%BB%C2%AA%C3%91%C3%AF%C3%8C%C2%AB%C3%91%C3%B4%C3%84%C3%9C%C3%8E%C2%AC%C3%90%C3%9E&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V%2BD3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860
hxxp://s1.bdstatic.com/r/www/cache/static/home/js/nu_instant_search_fb92f064.js	185.10.107.168
hxxp://i9.baidu.com/ps_default.gif?_t=1429193428648	180.97.33.30
hxxp://y0.ifengimg.com/314bd925cdd17196/2014/1203/pc.css	37.29.0.93
hxxp://fashion.ifeng.com/a/20150405/40098172_1.shtml	37.29.0.105
hxxp://t12.baidu.com/it/u=4267047014,3229650163&fm=58	180.97.33.30
hxxp://s1.bdstatic.com/r/www/cache/static/global/img/quickdelete_9c14b01a.png	185.10.107.168
hxxp://y0.ifengimg.com/a/2015/0311/fa.min.js	37.29.0.93
hxxp://s1.bdstatic.com/r/www/cache/static/baiduia/JSocket_9a52fc3e.swf?0.05	185.10.107.168
hxxp://t10.baidu.com/it/u=1288538148,116491288&fm=58	180.97.33.30
hxxp://c.cnzz.com/core.php?web_id=4690803&t=z	195.27.31.248
hxxp://s1.bdstatic.com/r/www/cache/static/global/js/call-bdbrowser_97c84903.js	185.10.107.168
hxxp://y0.ifengimg.com/commonpage/1129/v1/all.png	37.29.0.93
hxxp://t12.baidu.com/it/u=3488912159,3986088090&fm=58	180.97.33.30
hxxp://s1.bdstatic.com/r/www/cache/static/global/img/icons_b5457670.gif	185.10.107.168
hxxp://s1.bdstatic.com/r/www/cache/static/plugins/env_5202315f.swf	185.10.107.168
hxxp://y2.ifengimg.com/e01ed39fc2da5d4a/2013/1205/health.gif	37.29.0.20
hxxp://i7.baidu.com/ps_default.gif?_t=1429193428632	180.97.33.30
hxxp://suggestion.baidu.com/su?wd=&zxmode=1&json=1&p=3&sid=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498&cb=jQuery11020564010697925782_1429193425102&_=1429193425103	123.125.114.101
hxxp://y0.ifengimg.com/base/origin/F-amd-1.2.0.min.js	37.29.0.93
hxxp://partner.googleadservices.com/gpt/pubads_impl_59.js	173.194.113.205
hxxp://map.icast.cn/hdt-cookie/ck?n=preViewCookie_35&v=bye&t=0	122.225.81.63
hxxp://y0.ifengimg.com/commonpage/1210/comment.number.min.js	37.29.0.93
hxxp://t10.baidu.com/it/u=3263161068,3203223156&fm=58	180.97.33.30
hxxp://adm.icast.cn/nortb/hdt-ifocus/request/?id=PM1304281078&be_retarg=RE141201001	122.225.81.41
hxxp://i8.baidu.com/ps_default.gif?_t=1429193428632	180.97.33.30
hxxp://www.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860	180.76.3.151
hxxp://www.baidu.com/	180.76.3.151
hxxp://t10.baidu.com/it/u=2394089844,1505224976&fm=58	180.97.33.30
hxxp://y2.ifengimg.com/e01ed39fc2da5d4a/2014/0317/sharebg.gif	37.29.0.20
hxxp://ecma.bdimg.com/public03/pc.gif?_t=1429193428632	180.97.66.39
hxxp://pcookie.cnzz.com/app.gif?&cna=0rC2DWbMLVwCASU5EL1qq92F	42.120.219.171
hxxp://www.baidu.com/cache/fpid/ielib_0108.js	180.76.3.151
hxxp://y0.ifengimg.com/commonpage/1130/F-RequireJS.min.js	37.29.0.93
hxxp://s1.bdstatic.com/r/www/cache/static/baiduia/baiduia_b45d552b.js	185.10.107.168
hxxp://t12.baidu.com/it/u=3537516083,882981865&fm=58	180.97.33.30
hxxp://www.baidu.com/s?wd=南京华扬太阳能维修	180.76.3.151
hxxp://m1.ifengimg.com/ifeng/sources/inice_v1.js	203.130.61.92
hxxp://www.baidu.com/img/bd_logo1.png	180.76.3.151
hxxp://www.ip138.com/	203.130.61.92
hxxp://c.baidu.com/c.gif?t=0&q=0‡20ˆ30†60„80†30„90ˆ50Š70ˆ00…00ˆ50‹00‡20‰50ˆ20…10ˆ40‰7&p=0&pn=1	123.125.114.64
hxxp://passport.baidu.com/passApi/js/uni_login_wrapper.js?cdnversion=1429193460319&_=1429193460101	180.76.2.35
hxxp://www.baidu.com/favicon.ico	180.76.3.151
hxxp://www.it885.com.cn/web/click_log2.asp?ad_url=47556mqqu?**rrr+lq==0+fjh+fk*r`g*w`b*lfdvqZ470Z4+dvu&cr=yes
hxxp://www.googletagservices.com/tag/js/check_359604.js	216.58.209.194
hxxp://y1.ifengimg.com/commonpage/0709/d_07.png	37.29.0.79
hxxp://s1.bdstatic.com/r/www/cache/static/jquery/jquery-1.10.2.min_f2fb5194.js	185.10.107.168
hxxp://t11.baidu.com/ps_default.gif?_t=1429193428663	180.97.33.30
hxxp://www.googletagservices.com/tag/js/gpt.js	216.58.209.194
hxxp://h2.ifengimg.com/ifeng/sources/region_v1.js	203.130.61.92
hxxp://passport.baidu.com/passApi/js/uni_login_wrapper.js?cdnversion=1429193425851&_=1429193425101	180.76.2.35
hxxp://www.it885.com.cn/web/reg/icast_125_1.asp
hxxp://s1.bdstatic.com/r/www/cache/static/sug/js/bdsug_547e5a10.js	185.10.107.168
hxxp://t10.baidu.com/ps_default.gif?_t=1429193428648	180.97.33.30
hxxp://b1.bdstatic.com/img/pc.gif?_t=842	185.10.107.147
hxxp://t11.baidu.com/it/u=194142598,852924299&fm=58	180.97.33.30
hxxp://t12.baidu.com/ps_default.gif?_t=1429193428663	180.97.33.30
hxxp://s1.bdstatic.com/r/www/cache/static/plugins/every_cookie_09fe94e0.js	185.10.107.168
hxxp://y0.ifengimg.com/base/jQuery/jquery-1.9.1.min.js	37.29.0.93
hxxp://y0.ifengimg.com/commonpage/0304/arrow.gif	37.29.0.93
hxxp://h2.ifengimg.com/0f56ee67a4c375c2/2013/1106/indeccode.png	203.130.61.92
hxxp://www.baidu.com/img/baidu_jgylogo3.gif	180.76.3.151
hxxp://map.icast.cn/hdt-cookie/ck?n=force_preview&v=FT1504130011-4493-CT150407010&t=-1&turl=http://adm.icast.cn/nortb/hdt-ifocus/request/?id=PM1304281078&be_retarg=RE141201001	122.225.81.63
hxxp://t11.baidu.com/it/u=602776483,2047304585&fm=58	180.97.33.30
hxxp://wangbao.6299.cc/xc.txt	222.216.190.83
hxxp://s1.bdstatic.com/r/www/cache/static/global/js/all_async_popstate1_0c1233e7.js	185.10.107.168
hxxp://y3.ifengimg.com/cmpp/2014/12/24/07/1d2544d2-0a9e-4b12-87b8-30facc8dd482.jpg	37.29.0.41
hxxp://www.baidu.com/cache/fpid/o_0108.swf	180.76.3.151
hxxp://tpc.googlesyndication.com/safeframe/1-0-2/html/container.html	216.58.209.193
hxxp://s6.cnzz.com/stat.php?id=4690803&web_id=4690803	1.99.192.15
hxxp://suggestion.baidu.com/su?wd=Ä&zxmode=1&json=1&p=3&sid=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498&cb=jQuery11020564010697925782_1429193425102&_=1429193425104	123.125.114.101
3544.myzmnet.com	122.224.18.16
formi.baidu.com	61.135.169.120
3599.myzmnet.com	222.186.32.156
3522.myzmnet.com	122.224.18.16
mfp.deliver.ifeng.com	223.202.39.26
3577.myzmnet.com	124.173.125.131
cnzz.9ycj.com	98.126.11.190
x.jd.com	58.83.212.161
3588.myzmnet.com	124.172.139.29
eclick.baidu.com	123.125.115.164
nsclick.baidu.com	115.239.211.92
3511.myzmnet.com	122.224.18.16
3555.myzmnet.com	122.224.18.16
3500.myzmnet.com	122.224.18.16
3566.myzmnet.com	122.224.18.16
myhm.mybmnet.com	122.224.18.16
sclick.baidu.com	123.125.115.95
3533.myzmnet.com	122.224.18.16

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Suspicious User-Agent (WindowsNT) With No Separating Space
ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET TROJAN Generic Password Stealer User Agent Detected (RookIE)
ET MALWARE User-Agent (Mozilla/4.0 (compatible))
ET MALWARE User-Agent (Internet Explorer)
ET POLICY Outdated Windows Flash Version IE

Traffic

GET /ic.asp HTTP/1.1

User-Agent: Mozilla/4.0 (compatible)

Host: 1111.ip138.com

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:14:18 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Content-Length: 217

Content-Type: text/html

Set-Cookie: ASPSESSIONIDAASDCCDB=JIIPFKLDJJNPNBPDFLIHJJKL; path=/

Cache-control: private
<html>..<head>..<meta http-equiv="content-type" content
="text/html; charset=gb2312">..<title> ....IP.... </title&
gt;..</head>..<body style="margin:0px"><center>....I
P....[37.57.16.189] ............</center></body></html&
gt;HTTP/1.1 200 OK..Date: Thu, 16 Apr 2015 14:14:18 GMT..Server: Micro
soft-IIS/6.0..X-Powered-By: ASP.NET..Content-Length: 217..Content-Type
: text/html..Set-Cookie: ASPSESSIONIDAASDCCDB=JIIPFKLDJJNPNBPDFLIHJJKL
; path=/..Cache-control: private..<html>..<head>..<meta
 http-equiv="content-type" content="text/html; charset=gb2312">..&l
t;title> ....IP.... </title>..</head>..<body style="
margin:0px"><center>....IP....[37.57.16.189] ............<
/center></body></html>..

GET /hdt-cookie/ck?n=preViewCookie_35&v=bye&t=0 HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: map.icast.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR

Set-Cookie: preViewCookie_35=bye; Domain=icast.cn; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Content-Length: 0

Date: Thu, 16 Apr 2015 14:10:39 GMT

Connection: close

GET /e01ed39fc2da5d4a/2013/1205/health.gif HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y2.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:35 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1014.v0-mow ( h0-s1083.v0-mow), ht h0-s1083.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Fri, 13 Nov 2015 08:29:53 GMT

Age: 13326042

Content-Length: 2554

Content-Type: image/gif

Last-Modified: Thu, 05 Dec 2013 05:48:21 GMT

Connection: keep-alive
GIF89a.......n......([email protected].........
......e...~.......~..............q...S\..&>`m......................
....................................................................!.
.XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c
011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf=
"hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description 
rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef
="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns
.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:323D03B4FE57E31
191C0D8A7DFD06564" xmpMM:DocumentID="xmp.did:69D3F5335CBC11E3B8CCD83F1
40B66B2" xmpMM:InstanceID="xmp.iid:69D3F5325CBC11E3B8CCD83F140B66B2" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:333D03B4FE57E31191C0D8A7DFD06564" stRef:d
ocumentID="xmp.did:323D03B4FE57E31191C0D8A7DFD06564"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>..................................................................
................................................................~}|{zy
xwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9
876543210/.-, *)('&%$#"! .................................!.......,...
........@.P........dH.....HZ...S.M....xL...Q.z.f..............z....ei 
....}".j.Q.L|C..[P.L.......PK...ml.L... .Qr \K.p.c...d...........Q
<<< skipped >>>

GET /e01ed39fc2da5d4a/2014/0317/sharebg.gif HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y2.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:37 GMT

Server: PWS/8.1.20.9

X-Px: ht h0-s1014.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Tue, 12 Jan 2016 00:27:51 GMT

Age: 8170966

Content-Length: 7253

Content-Type: image/gif

Last-Modified: Tue, 18 Mar 2014 08:23:44 GMT

Connection: keep-alive
GIF89a$.r....].....K....ub.......*..T..........PS.....*.............[^
......\..=.....C.......2....59.....K..F4........7- ...:...{}..#L......
....J......u..j.....l.......k......d.....s..V.........PR.bc...........
...........%'..\..!.........RIG.....w.........y.....S.....[.....i.....
...d..V................{L.........qr.....................U..s.......C.
.....\TR..8.........#....b.VX.59......G...IL.....aA...................
......SM.............><....C}..x..F.......}.... $..v..........|}
............|..A.....A../.....7.......A.......................E.......
...... $......................NP.AB.57...g`]..... ..........JM.......0
4..f....~}...{...._........9...................mo.....B....>@......
..p......tmk.......................N.wx.................h....np.......
....................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begi
n="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adob
e:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:
56:27        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22
-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="htt
p://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0
/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:Or
iginalDocumentID="xmp.did:EA8EE28C0762E311AB3E9E2DFBFA4DE3" xmpMM:Docu
mentID="xmp.did:1F92F4CAAE7411E38A4CE4B2A51A9265" xmpMM:InstanceID="xm
p.iid:1F92F4C9AE7411E38A4CE4B2A51A9265" xmp:CreatorTool="Adobe Photosh
op CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.
<<< skipped >>>

GET /ps_default.gif?_t=1429193428632 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i7.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; BIDUPSID=8C833062B6F97482CA56473B4B36B66F; H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/gif

ETag: "4009727547"

Accept-Ranges: bytes

Last-Modified: Mon, 28 Jul 2014 10:29:03 GMT

Content-Length: 43

Date: Thu, 16 Apr 2015 14:10:26 GMT

Server: lighttpd
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Access-Con
trol-Allow-Origin: *..Content-Type: image/gif..ETag: "4009727547"..Acc
ept-Ranges: bytes..Last-Modified: Mon, 28 Jul 2014 10:29:03 GMT..Conte
nt-Length: 43..Date: Thu, 16 Apr 2015 14:10:26 GMT..Server: lighttpd..
GIF89a.............!.......,...........D..;..

GET /su?wd=&zxmode=1&json=1&p=3&sid=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498&cb=jQuery11020564010697925782_1429193425102&_=1429193425103 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: suggestion.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; BIDUPSID=8C833062B6F97482CA56473B4B36B66F; H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:22 GMT

Server: suggestion.baidu.zbb.df

Content-Length: 85

Content-Type: text/javascript; charset=gbk

Cache-Control: private

Connection: Keep-Alive
jQuery11020564010697925782_1429193425102({"q":"","p":false,"bs":"","s"
:[],"zzx":[]});HTTP/1.1 200 OK..Date: Thu, 16 Apr 2015 14:10:22 GMT..S
erver: suggestion.baidu.zbb.df..Content-Length: 85..Content-Type: text
/javascript; charset=gbk..Cache-Control: private..Connection: Keep-Ali
ve..jQuery11020564010697925782_1429193425102({"q":"","p":false,"bs":""
,"s":[],"zzx":[]});....


GET /su?wd=Ä&zxmode=1&json=1&p=3&sid=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498&cb=jQuery11020564010697925782_1429193425102&_=1429193425104 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: suggestion.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:26 GMT

Server: suggestion.baidu.zbb.df

Content-Length: 85

Content-Type: text/javascript; charset=gbk

Cache-Control: private

Connection: Keep-Alive
jQuery11020564010697925782_1429193425102({"q":"","p":false,"bs":"","s"
:[],"zzx":[]});HTTP/1.1 200 OK..Date: Thu, 16 Apr 2015 14:10:26 GMT..S
erver: suggestion.baidu.zbb.df..Content-Length: 85..Content-Type: text
/javascript; charset=gbk..Cache-Control: private..Connection: Keep-Ali
ve..jQuery11020564010697925782_1429193425102({"q":"","p":false,"bs":""
,"s":[],"zzx":[]});..

GET /cmpp/2014/12/24/07/1d2544d2-0a9e-4b12-87b8-30facc8dd482.jpg HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y3.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:37 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1030.v0-mow ( h0-s1009.v0-mow), ms h0-s1009.v0-mow ( h0-s97.p13-pek), ht-d h0-s97.p13-pek.cdngp.net

Cache-Control: max-age=31536000

Expires: Tue, 15 Mar 2016 23:22:54 GMT

Age: 2645263

Accept-Ranges: bytes

Content-Length: 106193

Content-Type: image/jpeg

Last-Modified: Tue, 23 Dec 2014 23:13:24 GMT

Connection: keep-alive
......JFIF.....H.H......Photoshop 3.0.8BIM....................48361963
3..(..MR & PR..P..Andrejs Zemdega..n..Getty Images/Vetta..s..Vetta..x.
&Couple in New York City's Central park.8BIM........hXXp://VVV.gettyim
ages.com...C..........................................................
..........C...........................................................
............R...............................................L.........
.................!..1."A.Q.2a.#Bq...$R.3...b...Lr....DS..'56cs......
.............................C.......................!..1A.."Qaq.....2
....#B.3R..b..$Cr...4..%c............?..K.....:I..Yg.q.e..c....VL8.Q .
..Y.oP..-..............X....x...k{.....X.P.f.LU.....<..-a..P.H.ZQ..
..Kh.T.}..%-[).w.[.\|).d.}..4....A.V....4.wh)...U.....)K..V...JS.q^...
...SD*.q......6.C~.;b......pw........d...{|.0......w...:..^....<..=
*...Q.......qd3U...W)..._}5..t..8 ......k.$HX........N......!.}.:.%p..
.2.AO...EKI...Q...<-...[..ZS.IN9.>t........68.-{*..YJ....1....c8
Q......E..F....JYpy...F...G<.....>...m|..a-.*Q.?..N......i[..K..
uR..mM.R...A?.N.....=%4........&...r@ q...R.....^S..U.=..Dg.-.6.......
c.......0.e/.....w.2...-D...?.V.....5[...0....beVUJ.%$.....Q.)j.p...db
K..9.w..G..>CE.,.(.8...!Z*w..d..}....j......Kk....8....,.IuU\...o*.
_u. W......i...Q8C....=V..T.Je-!.!.$.J.......6Sk...).%.#....gvlW.Z.c..
..5E5)3TR\.......Q.....t4....[q.6....0.S...W':.>.'7...,06$.."..H.I.
4.Hn8!....44.............*...h..mN..8.>5......yH...m..m...1.C..O...
".... %2...`.....:...{pr5.u;['L*..8...4..p.....=.....c..g......A..
<<< skipped >>>

GET /it/u=194142598,852924299&fm=58 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t11.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/jpeg

Expires: Sun, 17 May 2015 00:10:55 GMT

Cache-Control: max-age=2628000

Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT

ETag: 17d66862ff1498efe52f3a128c2d78f8

Content-Length: 1697

Date: Thu, 16 Apr 2015 14:10:55 GMT

Server: lighttpd
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................K.K.."......................................9.
.......................!."1A.Qa.2q..#R.....$Br.3S.....................
.....................................!1Q................?.......Y.(...
.st..Z....EiSS. ,....B.....h..I.`..1^.gfV.....m..y-.7\....3...g....;:.
y..0......}$.v*.|.[...?f...q.E.......q4).E..[QUhFH....L....g..T...e cV
.$.......hN....jU.n..c...Eq.j..h.C.X).w......'.YK.....2g..b.f..L.....d
|(..N).r.,...hW*ZB..9...2[\.....v..&.t.|....N.I..N.yw;....K.C.r.[=.s..
;..U.4..SG#q%G.:.Y.v.rv.?.k..^..F...4```m...?......;.=......<.0....
S...G.Ro."@.5.....q.....W/....Oe..F...3..3......Gv>..Ye..0...n.k>
;4XNGt..$.d~PD.H=.1...z..h........q.v...G.6..[......Yd\c..Z_.....OU3&g
t;T..1.5$.m..."...fH........j]..p..Y......U.V.....o.4...^.........7.i.
.Kmjm....v."c...:.hWV..t.......>lz...Z.!U. ..1.....B0WB...S...[....
...F..2.>..*m...)P....] Rn....9...a...Z..!s......,...o.T=>_.U%.S
.F..S.R...>b.\^x.F..$,.r[.zm..<....6I!...D..\....:...:..o...e.NZ
-.7..O..1.1..w6..]i.....}.j..U..5..&...C.p..>..@...~.G........\;f.E
..L....g..h..8.....i...........?:b..;..$.p3.J...9.cQ8h.....)...>.h'
:.H:...(..i6^cR.R..$...u....[=A.. ....v..........*.. z.O./.....P...O-.
..)P..A"...nI>.........K.v<.I#.y.A....]n.............0q.Sij.q..]
:.|........)....:.c .9..i......y?.X6.rV..w.....6:t=3.2~T... .......Yp&
gt;.5.....1x..Kki3(.#R%V,.9b...m.......aMz$*..}....^..O..zy._.....
<<< skipped >>>

GET /it/u=602776483,2047304585&fm=58 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t11.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/jpeg

Expires: Sun, 17 May 2015 00:10:55 GMT

Cache-Control: max-age=2628000

Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT

ETag: 790fbad8e667f4eea66df1e3d976786f

Content-Length: 2308

Date: Thu, 16 Apr 2015 14:10:55 GMT

Server: lighttpd
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................K.K.."........................................
?.........................!.1AQ..."2aq..#$...BRb......345CDr..........
.......................&........................!1..QR2.3ABq..........
..?.|o.x.............w.....~.n. .....QE~`.\p..5].?.Y.U?.M.._.o........
..x...Tf.l1..k.U,{n~.[..lE...(..*&.^UY..$Me.......l/S.<1.....y^..Gk
|R.O...../.....=`=......0...L.-..(.a.]$. ^.._D..Q...RD.r....6T........
%.......c...).[S"..... if...X6...5...Y..n/.........?...N.?....3..laB..
/E-?.UF..b....1...K...Y.7...:..E.....[..l........uQ.W..Z.8.EJ..d..wn..
.._X.....z..F..SM..M.:r....)...am..O.QuM.. .pG.......r......C!J*.....,
.,-..........m*r:..X..}.E..KS.Z..(..#...[P......m.>Wd.r.Y.c..YB....
:l..p..4......U.....N..9..ez...T..X.g.6=w.7....vK.J.%<...2.o.... I 
....MT4.........2..=b9..?..X...5k.*fi....../,r].?.A..c...E...u...A9Y.|
.e:.u...k......5D.H..Y._0.F.,E..=/.....fWIV3Yx.. #.R..UL`HWK..t.....=.
..)%;].E..,D.%B.^.."4&....j.>...-)xm&.mpw....~c.$..0......j...j.F..
t..al..QfC...7"z[.0>.S3.1k..........a~.<.*|.t..:u.L..T.........1
R.U$3......&.!..?7..#... [email protected]......#...^}...w..........F..o.c.
..Nzj.G5..K.6X...,B..l,I...\z..<.c.4....H....^.......<...3x..(hj
'.b.%...Xi]Z.v....X.[.*I a.2."..p*..mV.3.0'..........Z....1...=.g}...~
 ..$...F.6...`.D\.AP...YZ..U;f...I.{K.......P....!...C..fi.Tf..SS^.p.U
...... .y..tz...L.*C....i.`@..I....O.0|..2...0.-.....qq....f......
<<< skipped >>>

GET /ifeng/sources/region_v1.js HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: h2.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 16 Apr 2015 14:24:55 GMT

Date: Thu, 16 Apr 2015 13:24:55 GMT

Server: nginx/1.2.3

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Last-Modified: Mon, 27 Oct 2014 03:10:19 GMT

Cache-Control: max-age=3600

Content-Encoding: gzip

Age: 1

X-Via: 1.1 hnlywt60:8105 (Cdn Cache Server V2.0), 1.1 kf48:9 (Cdn Cache Server V2.0)

Connection: keep-alive
3ad.............V.N.@.}N.........IQ..LUQTE.....P.........p ...zw}KB.~ 
.3g.gfg...........K...h".<.iC...H.4f...m.....sC84..U..j....O..P"/).
..h...S....Z..J...6F.i.'$.R...$.....G9.;iz..._d.R.Ghj.F.9..G../....3..
mHh.)..:C.`.?[..3.\.K....Vs.S.......KS-.{..`....6Uh.Z...O`.P....N.R.o.
.i..F.qL.Fn.8.&..s...>D....v........[.B$.. Tb.U......9.@....|......
.0U..e..2...\..._...F.651\.v8(#U.[.GH..Y........X..W.9...)8...M.NUR.0.
~.{C.(...JH.2...??.2....Xr.\..8C.^.?&.[...f.Ht..]7..on.....!l.......E&
lt;]G......G......98.6.=..9....c...j.....9Q..b.6.Y....@W.].b[.b."....~
......g....6...U>..*..pt....9.Ox..U.S..A..........h...h.../..#.Z.?#
B.p,.....;.v.....V.4..<.n...]..b...:../A#...T..|.....5..6.oI3p.."..
......8..ux..vY.E.ds=hZ-u..*.t..(gc...kK....l....-)\. ..:.b...K.!...0.
z;j*_...Y.....*...U1/[email protected]...
E..vg.m^......E>.k.SZ.:..;..f....~.....-.q......;i.Hz'{W.....: x.:.
Rf.{=M..b.S.=l.Cv>..kNdx%..E.6f.p...IO...v26._`.Tz......0..HTTP/1.1
 200 OK..Expires: Thu, 16 Apr 2015 14:24:55 GMT..Date: Thu, 16 Apr 201
5 13:24:55 GMT..Server: nginx/1.2.3..Content-Type: application/x-javas
cript..Transfer-Encoding: chunked..Last-Modified: Mon, 27 Oct 2014 03:
10:19 GMT..Cache-Control: max-age=3600..Content-Encoding: gzip..Age: 1
..X-Via: 1.1 hnlywt60:8105 (Cdn Cache Server V2.0), 1.1 kf48:9 (Cdn Ca
che Server V2.0)..Connection: keep-alive..3ad.............V.N.@.}N....
.....IQ..LUQTE.....P.........p ...zw}KB.~ .3g.gfg...........K...h".<
;.iC...H.4f...m.....sC84..U..j....O..P"/)...h...S....Z..J...6F.i.'
<<< skipped >>>

GET /0f56ee67a4c375c2/2013/1106/indeccode.png HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: h2.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 16 Apr 2015 14:29:23 GMT

Date: Thu, 16 Apr 2015 13:29:23 GMT

Server: nginx/1.2.3

Content-Type: image/png

Content-Length: 961

Last-Modified: Wed, 06 Nov 2013 07:42:21 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 hnlywt61:8104 (Cdn Cache Server V2.0), 1.1 kf50:4 (Cdn Cache Server V2.0)

Connection: keep-alive
.PNG........IHDR....................6PLTE.............VY.."..........r
u....dg.9>.... 0....GK...k......FIDATx......0...........I...Lj.....
....|.ma.....@ ...qR.........\p..n-./ ........Gq%..u...Z.....p_.......
.|....~;w....R.......c..........\p....RR.zp..g..g....Xo1.......\p..$W.
B...h......s.d.._........:c._......N^.x8r9$...c;...........c....k5Q...
..6......2w.M.r..#v...t.....V......LK.c[$wlXk)v.B71..q..H..n......N...
.. U..jn...._}..%_ w..-..W?=py....#....e....Z........(..-..3.k.....u..
\h..M.. n.. W..C1c'..z^n6L49{.i...Z..s3........_...... .....Z .[..=...
.;..m.....e......,2..%;...N.w..\.U......s......{.wX..hH?Cly......*....
l..O3.....KR=E_.5..mXjn...i.m.\..i.tU..nc....u..6S..C....8..._.m...5.P
...........p.r..n....'(...b..[..W.......w....I<.q...(..}....9.c.!Eq
\...WE.'_=.(..I..\).t.k.$.[....N.....k......9..\p.-..5..|1...<....'
.'u.......<...n.\.c......[...\p.....3.|....\p.. .. 4tp.....y.......
...r.).G...........|~`.a?..........@ ......N.9.........IEND.B`.HTTP/1.
1 200 OK..Expires: Thu, 16 Apr 2015 14:29:23 GMT..Date: Thu, 16 Apr 20
15 13:29:23 GMT..Server: nginx/1.2.3..Content-Type: image/png..Content
-Length: 961..Last-Modified: Wed, 06 Nov 2013 07:42:21 GMT..Cache-Cont
rol: max-age=3600..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 hnlywt61:8
104 (Cdn Cache Server V2.0), 1.1 kf50:4 (Cdn Cache Server V2.0)..Conne
ction: keep-alive...PNG........IHDR....................6PLTE..........
...VY.."..........ru....dg.9>.... 0....GK...k......FIDATx......0...
........I...Lj.........|.ma.....@ ...qR.........\p..n-./ ........G
<<< skipped >>>

GET /img/pc.gif?_t=842 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: b1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:26 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

Last-Modified: Mon, 28 Jul 2014 03:15:13 GMT

Expires: Thu, 16 Apr 2015 14:13:19 GMT

Age: 427

Cache-Control: max-age=600

Accept-Ranges: bytes

Ohc-Content-Crc: 85354799

Server: ld02-sys-jorcol01.ld02.baidu.com

Timing-Allow-Origin: hXXp://VVV.baidu.com

CDN-AGE: 1
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu,
 16 Apr 2015 14:10:26 GMT..Content-Type: image/gif..Content-Length: 43
..Connection: keep-alive..Last-Modified: Mon, 28 Jul 2014 03:15:13 GMT
..Expires: Thu, 16 Apr 2015 14:13:19 GMT..Age: 427..Cache-Control: max
-age=600..Accept-Ranges: bytes..Ohc-Content-Crc: 85354799..Server: ld0
2-sys-jorcol01.ld02.baidu.com..Timing-Allow-Origin: hXXp://VVV.baidu.c
om..CDN-AGE: 1..GIF89a.............!.......,...........D..;..

GET /ps_default.gif?_t=1429193428648 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i9.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; BIDUPSID=8C833062B6F97482CA56473B4B36B66F; H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/gif

ETag: "3950885796"

Accept-Ranges: bytes

Last-Modified: Mon, 28 Jul 2014 10:27:38 GMT

Content-Length: 43

Date: Thu, 16 Apr 2015 14:10:26 GMT

Server: lighttpd
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Access-Con
trol-Allow-Origin: *..Content-Type: image/gif..ETag: "3950885796"..Acc
ept-Ranges: bytes..Last-Modified: Mon, 28 Jul 2014 10:27:38 GMT..Conte
nt-Length: 43..Date: Thu, 16 Apr 2015 14:10:26 GMT..Server: lighttpd..
GIF89a.............!.......,...........D..;..

GET /web/click_log2.asp?ad_url=47556mqqu?**rrr+lq==0+fjh+fk*r`g*w`b*lfdvqZ470Z4+dvu&cr=yes HTTP/1.1

Accept: */*

Referer: 

Accept-Language: zh-cn

UA-CPU: x86

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50215)

Host: VVV.it885.com.cn

Connection: Keep-Alive

Cookie: 

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 1

Content-Type: text/html

Server: Microsoft-IIS/7.5

Set-Cookie: ASPSESSIONIDSARCDQTQ=EFDJJLFDDHIICDCDNGAGCINL; path=/

X-Powered-By: ASP.NET

Date: Thu, 16 Apr 2015 14:10:34 GMT
0HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 1..Content-T
ype: text/html..Server: Microsoft-IIS/7.5..Set-Cookie: ASPSESSIONIDSAR
CDQTQ=EFDJJLFDDHIICDCDNGAGCINL; path=/..X-Powered-By: ASP.NET..Date: T
hu, 16 Apr 2015 14:10:34 GMT..0..

GET /9.gif?abc=1&rnd=132663274 HTTP/1.1

Accept: */*

Referer: hXXp://1.rwdns.com/zztj/yeshe.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Thu, 16 Apr 2015 14:10:26 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=0rC2DWbMLVwCASU5EL1qq92F; expires=Sun, 13-Apr-25 14:10:26 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=6ad2cb4a; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=39c417cd7e058e8e1d6d038c_1429193426; expires=Sun, 13-Apr-25 14:10:26 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=0rC2DWbMLVwCASU5EL1qq92F

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Thu, 16 Apr 2015 14:10:26 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=0rC2DWbMLV
wCASU5EL1qq92F; expires=Sun, 13-Apr-25 14:10:26 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=6ad2cb4a; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=39c417cd7e058e8e1d6d038c_1429193426; expires=Sun, 
13-Apr-25 14:10:26 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=0rC2DWbMLVwCASU5EL1qq92F..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

GET /it/u=3537516083,882981865&fm=58 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t12.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/jpeg

Expires: Sun, 17 May 2015 00:10:55 GMT

Cache-Control: max-age=2628000

Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT

ETag: 819f875798157471454771e60fd4acbf

Content-Length: 1556

Date: Thu, 16 Apr 2015 14:10:55 GMT

Server: lighttpd
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................K.K.."........................................
2..........................!1a.AQ.R."2q.b............*........................AQ..!1q#3a.C.R..............?....N.
..%..h..H.u..)i>.K"m..).9L.A.....B..(.u....EcH.q"0 UY.]=....R...3..
[email protected]._X.8..u.g6...ff^A..O[ ..
......x.0d./[rQ...m]?Ag6^/xn.....I.n:p..|..$#..^E<|`k....WM7..$mxHH
."dx...xbm.Jt..i.\@....A.E?..JV.{...l...*....f.........LgI...Vy._p.B].
....d.Q.G U. X..1\.M98lT...n.$m._ks.TVi..x..........d....4..'..o......
7 ...!n?4...=./....$m..5..F...gTkH~y..6.v.@?./....q....En. Lr..S.4.p..
.5)...a..u...........e...X.hG..V..>.r........[.........^V....?(..~.
.U..T...xe X.......h.Q.N=....9*..lm.`..... ^ KZS.y....*E....e...[.*..'
...'.t..J...M.^.1I[.l2Y..'.y..5.}...|l;..@./U*.......JSN.u*)u...B.H..#
h.K.."^]!..>..b..b.....-s.c1Sw...esSsj.W&...t.. 2.x....z.|#.1[....{
...4...V..`"....M.\MJ.....I.S..j.x..jd.:I.iYt6....}.......~...........
...p.Dg).Ff....%S,...nW(R.*.M..F...jR].v.J.m!)H........8O.......GeUS.C
O.Sq...!D....!t.....P.t.z.0W2.?.&.....d.Q.9...1.=...TxJS.7nX8}.G.u...m
.S2M3Tz.....T\..h/;.Q..........."..jH...K.MvH.M.|.......k.O.=...[p...T
C...^`...bB......`fq.....,.{r.j.Yd.E.......r.a.>.....e....8.J.q:...
._..&.Z1.W.L9p.o.V....1$.]..A.t2.......(Q.........."#x......p.......".
i).Z..._........4.$.....F...&2........j...vdw.V...ol"7`w..Q.."{BI.
<<< skipped >>>

GET /ps_default.gif?_t=1429193428632 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i8.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; BIDUPSID=8C833062B6F97482CA56473B4B36B66F; H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/gif

ETag: "1721284351"

Accept-Ranges: bytes

Last-Modified: Mon, 28 Jul 2014 10:27:30 GMT

Content-Length: 43

Date: Thu, 16 Apr 2015 14:10:26 GMT

Server: lighttpd
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Access-Con
trol-Allow-Origin: *..Content-Type: image/gif..ETag: "1721284351"..Acc
ept-Ranges: bytes..Last-Modified: Mon, 28 Jul 2014 10:27:30 GMT..Conte
nt-Length: 43..Date: Thu, 16 Apr 2015 14:10:26 GMT..Server: lighttpd..
GIF89a.............!.......,...........D..;..

GET /it/u=3488912159,3986088090&fm=58 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t12.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/jpeg

Expires: Sun, 17 May 2015 00:10:55 GMT

Cache-Control: max-age=2628000

Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT

ETag: c1f96404bc7eb15018ded7ec078b8ef6

Content-Length: 1927

Date: Thu, 16 Apr 2015 14:10:55 GMT

Server: lighttpd
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................K.K.."........................................
3..........................!1A...Qaq."B...2Rr.........................
...........(.......................!1.A"2Q....................?....(.E
z....L.l..>k.b4v.....H.k.......V..@........ ..1.` ..n)Rd5..|.......
.G5.........R..Ti%KG........;.. ..^pL..fG.0..Cm....Ze.Tg8.....T.!C...n
.94.....9..s...I...\..^}.N.......H....2..Q!...n..>...}..1,..D'..F..
..G.N.w.W.Fjf...3 .p1RF.|.N.....rm.f....w..WT.|.....\....,..Y.<...L
..MM~J}?.R....a .....(...Rm..[: .......J.......n.....(;..VpV. .)#.U...
...O....Hoc.8.P.8............v.)].......Ck.\.2..-...JV.`...=..S..q..-.
.......K..@[N$.....j....v5e.p.X..Q.J.J..Gq.).D.....=5.oM`..Y......y. .
..<.D.Ge....r..J.....!..>h.cnMV..;k487...#.$...)........./..... 
.P7.J6....FWU[q.'.,g..z{...Nx......(.ix.|..#..(}.R<[..Q."4..2..-..A
C....=~a.t._.c.w...4.^v..e....ps....&.0....1.......?.d.T9Gr...8v.....n
..V..%...X....zr*.U1...0,..5..M..6.]Er.6Q...p....y .b.V4...FM....Q.$%.
.J.H.3......-..l....nC...D.Y..X.8.J...{.%jZ..l[..K3. .......*...h....s
.mS a.i<..g.....=.K`....Q..?.\.|&..y%......;..V....u..(R.....$6.~K.
....g..s..........nQI*......O.....).i..o....zL..X..p......JW.-#..Ec...
...t..L..i.J.\.. [email protected].....#.8..Xi.m..x..(..m^jU....{..A.8..5...[]..
....\.........1.O..7......b.iJ.....gZ...[.x.g.v..P.........G..... ..q.
...j6...c...i....I.^...".<..Z...Y}......R.P9'.zSU..x6..M.....z`
<<< skipped >>>

GET /it/u=4267047014,3229650163&fm=58 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t12.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/jpeg

Expires: Sun, 17 May 2015 00:10:56 GMT

Cache-Control: max-age=2628000

Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT

ETag: 10af7b2bac04b9fb6db7d3be74e2aac7

Content-Length: 3143

Date: Thu, 16 Apr 2015 14:10:56 GMT

Server: lighttpd
......JFIF.....H.H.....C..............................................
!........."$".$.......C...............................................
........................K.K...........................................
8...........................!1."AQa....2..Tq..#B..$RU.................
..................4........................!1..A.."Qaq.2R..#S....3B...
...........?..o.).k....K.e.Yq.\QR........I:.....n.J.....&M5J..........
[email protected]<.<....D5..:.&...J.Z....S.X.f?
........ .X.N.:hiq.....z..K>.}......s.S.O.Pw.....H..%..NGu.m|5. ...
...Jn$).V: ..#H J...-....%8...0.: ...&W.E"(B(B(B(B...).u vOz!.......n.
)i[%.e..I l.Z......X.... #.............}N...................J%i)......
nI.. N..-<..]W.i...zB......O>.dJ..T.r...5q......._[.........$.w.
..."s.U....I#_or.x..L[?..p".....b4..z).g..vd.....z.....n...6..<@...
..;...Z..5n.l.ym.L.*....6.I......za.....!.HjC.......(.......< ..!..
..omJ.s. ...GLVQB.B.B.V..M;.[.v.&.....[.7(.6T.Xk...#.Z.JQ.% .,u.......
........I;......E'k^...\>c.&}....v.....CC.........<.wg&.w.......
,s.i6.M.H..9o$...=..I.z..........$6.{cr....n.c.:.{.......9..eVS...O...
7......"d.....J.Ol..V.F..b.n.N,.#.C(BH\d..2.Ns.p.*...u....s_.\7..a..9.
3..7.J..R>%....e..d.d4.'..kR..5.T..GU.X..l.n:..}.n.F.J.......!^J.4A
H...d..XAmadd$...K...&V.* .2....$%.-..E4..n.u..z....c.....e...........
.SS..fZaP....n.....U./Sj..........[.....m6.m.PPA....sZ....$........f.|
.k.q....Qm5....Fk{|..vRl.x......}...(.eG.yt..P....{H.t..N.............
@...*[..`j....>...k.7..yCWq...>O.NY..{...S.07......,..\.....
<<< skipped >>>

GET /commonpage/0709/d_07.png HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y1.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:35 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1056.v0-mow ( h0-s1134.v0-mow), ht h0-s1134.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Tue, 12 Jan 2016 00:25:56 GMT

Age: 8171079

Content-Length: 1482

Content-Type: image/png

Last-Modified: Wed, 09 Jul 2014 10:08:51 GMT

Connection: keep-alive
.PNG........IHDR...(.........C.le....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:858F0949DFF511E39A2E92234F
E687DE" xmpMM:DocumentID="xmp.did:858F094ADFF511E39A2E92234FE687DE">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:858F0947DFF511E39A2E
92234FE687DE" stRef:documentID="xmp.did:858F0948DFF511E39A2E92234FE687
DE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>[email protected]. ..H../.Zg..'..>v.f..$.
ad....H....D.......IH.k.o!E..;.wz....."...% ..bQ..!T`mjsA^.r.x.......9
...x......i1......s...c.../.\Z"..[...>....`(.gW.R...........~.....c
.-.}D..g....\..b.9.m.=S5..O...b..re.......1.^!f..[.....Xs.f..n...rge..
.dd}=w.......g.h......o...Z..Z..s........x...C......7.!Nb.u....uI.....
............o..R.t3.{.9.)..].D.(I..G.....0.k..H..).v....n..$iI..z.\f(.
.^...Ax...,Gj..f}.._.Z85...!.2.n.e{......~P.`...M.!W#....76.c....4.M..
).ekl.P&...7.u.3......%-ql....$.....t...~....K.....s..0/.W.)={....X.5.
e......2...s..).v.....K=f......tj...|...3|..../....?....^:.A......
<<< skipped >>>

GET /hdt-cookie/ck?n=force_preview&v=FT1504130011-4493-CT150407010&t=-1&turl=http://adm.icast.cn/nortb/hdt-ifocus/request/?id=PM1304281078&be_retarg=RE141201001 HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: map.icast.cn

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Apache-Coyote/1.1

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR

Set-Cookie: force_preview=FT1504130011-4493-CT150407010; Domain=icast.cn; Path=/

Location: hXXp://adm.icast.cn/nortb/hdt-ifocus/request/?id=PM1304281078&be_retarg=RE141201001

Content-Length: 0

Date: Thu, 16 Apr 2015 14:10:39 GMT

Connection: close

POST /GetData.asp HTTP/1.1

Referer: hXXp://VVV.baidu.com/s

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; WindowsNT5.0; SV1; Maxthon)

Content-Type: application/x-www-form-urlencoded;

Host: 1.rwdns.com

Content-Length: 47

Cache-Control: no-cache

SN=ClientSetOnlineV6&SP='YSVC082501-2991731197'
HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 13:58:04 GMT

Server: Microsoft-IIS/6.0

Content-Length: 3

Content-Type: text/html; Charset=GB2312

Set-Cookie: ASPSESSIONIDAAARDQRC=DNBBGAEDALNLNGOAEMKOHIFJ; path=/

Cache-control: private
120HTTP/1.1 200 OK..Date: Thu, 16 Apr 2015 13:58:04 GMT..Server: Micro
soft-IIS/6.0..Content-Length: 3..Content-Type: text/html; Charset=GB23
12..Set-Cookie: ASPSESSIONIDAAARDQRC=DNBBGAEDALNLNGOAEMKOHIFJ; path=/.
.Cache-control: private..120....


POST /GetData.asp HTTP/1.1

Referer: hXXp://VVV.baidu.com/s

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; WindowsNT5.0; SV1; Maxthon)

Content-Type: application/x-www-form-urlencoded;

Host: 1.rwdns.com

Content-Length: 28

Cache-Control: no-cache

Cookie: ASPSESSIONIDCCCTAQQC=NIMLPLLDLNEFDIBOKBANKDIM; ASPSESSIONIDAAARDQRC=DNBBGAEDALNLNGOAEMKOHIFJ

SN=ClientGetV6ZiRanKey&SP=IE
HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 13:58:05 GMT

Server: Microsoft-IIS/6.0

Content-Length: 98

Content-Type: text/html; Charset=GB2312

Cache-control: private
577655[*]..................[*]VVV.yanghua37.com/[*]False[*]0[*]1[*]5[*
]False[*]False[*]True[*]TrueHTTP/1.1 200 OK..Date: Thu, 16 Apr 2015 13
:58:05 GMT..Server: Microsoft-IIS/6.0..Content-Length: 98..Content-Typ
e: text/html; Charset=GB2312..Cache-control: private..577655[*].......
...........[*]VVV.yanghua37.com/[*]False[*]0[*]1[*]5[*]False[*]False[*
]True[*]True..

GET /a/20150405/40098172_1.shtml HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: fashion.ifeng.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:28 GMT

Server: PWS/8.1.20.9

Transfer-Encoding: chunked

X-Px: ms h0-s1129.v0-mow ( h0-s1018.v0-mow), ms h0-s1018.v0-mow ( h0-s96.p13-pek), rf-ms h0-s96.p13-pek ( origin)

Cache-Control: max-age=600

Expires: Thu, 16 Apr 2015 14:14:12 GMT

Age: 377

Content-Type: text/html

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Thu, 16 Apr 2015 14:02:57 GMT

Connection: keep-alive
3103..............iw.I.0..9..C.....-.6.J6./.Xmvh...S.*-F.Z.......f16.b
.....l..cc.....U..O..nd-R.T..L.3.j..J....................X ..m..Y..9..
.b...X.5...I.}...^..b.....O..v[*...6.....H..!q.....d9.8.=...."=z'.^...
f....8.^|...Jcg.G-.?...G..$./H.......*@C...,..........a|4..#......,...
. &.x0..F#....Ei..<5.y...Ow........{i..??].~.#=].o....KS...........
....e..*...|w6.r....s.................|fL:.;...^g..J W.Q..U...^\......
.\. =~ ../..^DFyv$3.N..8......FN.....j...c..{x. g...2..Qh...Q. 6(z..1.
@..8.(*..Gcb<9.TI.C...d2..p..D...........;8...N.......,."=xK..Z%...
..mU.....x...=...I..I........).|..l..(.2<.....0f.%...4..0..K.g.P.'.
Vy....>.. .$..]..'.7.z.n.g..Hqv..(;.s1.. .'.k....2:..$BA..<...-[
~..G.........h<i(7....vA....]....#.d....<..........p*lz...?J%...
...#.....v.D*8.n.G...h..G.....0.lG3.....].z.0[.O.[....d.s..h..{..',n2T
..i^;.C.vm.._.......q.....1.\Bt..K..aG...f'Z.-D..eK...e.C..u..R...t.|z
....QXM.Z............p....g.......F......"....aO..E#.?b../.......bH...
x...J..........%.........6.\[email protected]._......F........
9..|.*..........6....._Lz...vhG.......!....A/.......-.....~lU..Bm..).w
D|.C...n@..@.(..*.t.....P......j,4.^...&............k.OD#....<....d
<%..k.N....?..L.x`.D....b".J6af..(..R...o.T...(..nA8...E..A1..6m*.t
...>..g......X )D..`B............ .h...d...4........./p{......1..e.
b.Po.A,.....M-\[email protected]@~.5...........2.?m....>W..0S........
p=.....pG.}?Z1....."6/[email protected]..[...q.x......
~m...d.f.Qb`.........i.f...... ...x...@?...K....~... z.FY ..A.....
<<< skipped >>>

GET /web/reg/icast_125_1.asp HTTP/1.1

User-Agent: AutoIE???

Host: VVV.it885.com.cn

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 977

Content-Type: text/html

Server: Microsoft-IIS/7.5

Set-Cookie: ASPSESSIONIDSARCDQTQ=HNGJJLFDAAEKEEHGBNLOPKOH; path=/

X-Powered-By: ASP.NET

Date: Thu, 16 Apr 2015 14:10:47 GMT
..<?xml version="1.0" encoding="GB2312" ?><autoie>..<wh
ile>..<clearwindow>0</clearwindow>..<browser>Mozi
lla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.
0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)</browser>
..<url>hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml</
url>..<htmlcontent><![CDATA[ <script type="text/ja
vascript" defer>document.write('opt<scr' 'ipt src=\"hXXp://map.i
cast.cn/hdt-cookie/ck?n=preViewCookie_35&v=bye&t=0\"></scr' 'ipt
><scr' 'ipt>b=\"hXXp://map.icast.cn/hdt-cookie/ck?n=force_pre
view&v=FT1504130011-4493-CT150407010&t=-1&turl=\";c=\"hXXp://adm.icast
.cn/nortb/hdt-ifocus/request/?id=PM1304281078&be_retarg=RE141201001\";
document.write(\"<scr' 'ipt src=\\\"\" (b escape(c)) \"\\\"><
\\/scr' 'ipt>\");</scr' 'ipt>');</script>]]></htm
lcontent>..<sleepopen>20</sleepopen>..<sleepfill>
5</sleepfill>..<sleepSubmit>5</sleepSubmit>..<hre
f cmd="submit" value="#" type="find" place="0">hXXp://</href>
..</while>..</autoie>HTTP/1.1 200 OK..Cache-Control: priva
te..Content-Length: 977..Content-Type: text/html..Server: Microsoft-II
S/7.5..Set-Cookie: ASPSESSIONIDSARCDQTQ=HNGJJLFDAAEKEEHGBNLOPKOH; path
=/..X-Powered-By: ASP.NET..Date: Thu, 16 Apr 2015 14:10:47 GMT....<
?xml version="1.0" encoding="GB2312" ?><autoie>..<while>
;..<clearwindow>0</clearwindow>..<browser>Mozill
<<< skipped >>>

GET / HTTP/1.1

User-Agent: Mozilla/4.0 (compatible)

Host: VVV.ip138.com

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 06:57:15 GMT

Content-Length: 16585

Content-Type: text/html

Content-Location: hXXp://VVV.ip138.com/index.htm

Last-Modified: Thu, 16 Apr 2015 04:00:16 GMT

Accept-Ranges: bytes

ETag: "76f8c4d8f977d01:ae6a"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Age: 25981

X-Via: 1.1 kf48:10 (Cdn Cache Server V2.0)

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..
<html>..<head>..<meta http-equiv="Content-Type" content
="text/html; charset=gb2312">..<meta name="mobile-agent"content=
"format=html5; url=hXXp://m.ip138.com/">..<title>IP........--
.................. | ............ | ............ | ...................
.....</title>..<meta name="Keywords" content="ip,IP....,IP...
.....,ip138">..<meta name="Description" content="ip,IP....,IP...
.....,ip138">..<script language="javascript">..<!--..if(wi
ndow.top!=window.self)window.top.location.href='hXXp://VVV.ip138.com/'
;..function checkIP()..{...var ipArray,ip,j;...ip = document.ipform.ip
.value;...if (ip.indexOf(" ")>=0){....ip = ip.replace(/ /g,"");....
document.ipform.ip.value = ip;...}...if (ip.toLowerCase().indexOf("htt
p://")==0){....ip = ip.slice(7);....document.ipform.ip.value = ip;...}
...if (ip.toLowerCase().indexOf("hXXps://")==0){....ip = ip.slice(8);.
...document.ipform.ip.value = ip;...}...if (ip.slice(ip.length-1)=="/"
){....ip = ip.slice(0,ip.length-1);....document.ipform.ip.value = ip;.
..}...if(/[A-Za-z_-]/.test(ip)){....if(!/^([\w-] \.) ((top)|(com)|(net
)|(org)|(gov\.cn)|(info)|(cc)|(com\.cn)|(net\.cn)|(org\.cn)|(name)|(bi
z)|(tv)|(cn)|(mobi)|(name)|(sh)|(ac)|(io)|(tw)|(com\.tw)|(hk)|(com\.hk
)|(ws)|(travel)|(us)|(tm)|(la)|(me\.uk)|(org\.uk)|(ltd\.uk)|(plc\.uk)|
(in)|(eu)|(it)|(jp)|(co)|(me)|(mx)|(ca)|(ag)|(com\.co)|(net\.co)|(nom\
.co)|(com\.ag)|(net\.ag)|(fr)|(org\.ag)|(am)|(asia)|(at)|(be)|(bz)
<<< skipped >>>

GET /stat.php?id=4690803&web_id=4690803 HTTP/1.1

Accept: */*

Referer: hXXp://1.rwdns.com/zztj/yeshe.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s6.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Thu, 16 Apr 2015 14:10:17 GMT

Last-Modified: Thu, 16 Apr 2015 14:10:17 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache47.l2de1[730,200-0,M], cache21.l2de1[731,0], cache8.de1[731,200-0,M], cache5.de1[733,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:7:235191043

X-Swift-SaveTime: Thu, 16 Apr 2015 14:10:17 GMT

X-Swift-CacheTime: 5400
29d..(function(){function k(){this.c="4690803";this.R="z";this.N="";th
is.K="";this.M="";this.r="1429193417";this.P="oz.cnzz.com";this.L="";t
his.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV
" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.l
a()}function g(a,b){try{var c=.[];c.push("siteid=4690803");c.push("nam
e=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));
c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userA
gent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.ran
dom()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}c
atch(d){}}var h=document,e=window,f=encodeUR..24b8..IComponent,l=decod
eURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{this.
U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(
),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da()
,this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i
 failed")}},oa:function(){try{var a=this;e._czc={push:function(){retur
n a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){t
ry{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;
b<a.length;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_ac
count="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.br
eak;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPagevi
ew=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined
"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=th
<<< skipped >>>

GET /safeframe/1-0-2/html/container.html HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: tpc.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/html

Last-Modified: Fri, 16 Jan 2015 15:36:52 GMT

Date: Wed, 08 Apr 2015 05:54:39 GMT

Expires: Thu, 07 Apr 2016 05:54:39 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 1877

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 720958

Alternate-Protocol: 80:quic,p=0.5
......n....W{s....?..0.........X.....i...h.v;.dC....Wc..=..Wr.wwv.u.&l
t;..yR.=.l.|.jj..D.;......F}..."..;l..;.t..F........%..B..&.<..{J!.
.o.$.G..p.R...e.K....7-.._...<bD...0....'1s.i......3G.X..D.....L3G2
.x8.......8.D...?M(.<".pd.dI...%b>dIO.N.Cz..`...q1......x$h.I.#.
..s&.<..|..m.Ke$..\G.a$.ZC..D..D..<...G..|)....v..~2...Vx..m.)8J
j.....e.^.#Y..."0.}....!.....n:......!.b~:j.a.........g.t..n.`O../...V
^...I.Z.*"..,.1-..c.qv.Ib]JA.l. ....R.;U...<.k......}..U.....L...&l
t;..o...3..ni.|ze.M]..._.k.]....~.J..z.Z............$.S.p..AV.1.X...G}
..I..S@b...>h<M.....!......\e.K..K....b.M......-~.C....p.:m....x
[email protected].... .)s.B!.v..t..q........1...O<.?..".u...'>.N.
....9}.... .{h..%...-DZV.k...t..<.!a...*uD.%6.t......n...^8..>JN
.E..<..Op..u.......=s.B..Q.U.6v...%.o....y(...].V!...>*....{8.|.
N......Y5 .0.......?.....`c..]..\Rvz.GY......c....-....C79_.9..5.3..Vh
^....`......8.T.@|%.....t.OrU<RJ.Y.9.".u:..\X.x.....G._q.?Q......}.
.k.Q..kF....n0.m...v..l.......I.%.L.R0.....i,.$..26..."Q...sK..X..|...
>.|SRq:.Bh...q....k.M.....V..G.O.x.C.,.Ho.Z.F2.R9r.Z.z.uR_b.J`.?p^9
...e.rDv...#.".NR..G....m.x.9".......H.Xo....Q...'..S"...b...JFm...y..
.r....$......-.}..)K~O......j..q....xF*nS.n.g......aJ'L;..(.lhBy.....|
..;..0....c.......ws.8-..Jq........K......D[.C..P..........8...0N,..a.
_).X.g..q....s..=..T;..M..l.B....Z[.o.\...c..z....a.-..{ ...S1f.t....y
.nv...T.........>8I.|.Sb.......:...{C..._.Nq..H....Z8-...MT.F...X.&
lt;.jM.........Tuj.$.4..2..HPM$...Na...^.1....e9....*Z.8=...}.Y..?
<<< skipped >>>

GET /it/u=2394089844,1505224976&fm=58 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t10.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/jpeg

Expires: Sun, 17 May 2015 00:10:55 GMT

Cache-Control: max-age=2628000

Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT

ETag: f6ed61310e214549a09cd93b53f0a02a

Content-Length: 2424

Date: Thu, 16 Apr 2015 14:10:55 GMT

Server: lighttpd
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................K.K.."........................................
.4.........................!...1A"Q.2aq..#..Br...%R...................
............ .......................!.1AQ".............?.L....$i.;.u"l
......5.R..d3DF.].ly.Ui............t1.gY.yFQ.TUV.1......}....i..#*...S
.fN....e..k.-bG......gu...r.....W.s%.E=9UE'...N. >1]..y..UjF.4(.e..
.....D1 .,q..o.J.Zr.\..29.l..D..DQ.....m....0.............#.....(....D
QB...a{.>.......\fr...y.....K..b...o.}p...6c...MQC.?.L.;.f.]...I...
bv.z..=.....S/...E..)%...;.S.....}].$.|t.....C.E...A.....5IuT7...1....
c.g..f4......,e]G......i...X.....d..c.^...7.2...X...DA.$\.../.N'...`E.
4..[.X.?Kb3 .W)..Z..Db9.R56..so.hK...w-..k.....7.S.....ao.L%<T..d..
..|m.........VH..2.cvOR^a.I....a7.b..r;t.`...Z.v|.e..jV.E1h...T.?6..M.
q.`.....rk....]F..F..f..a.pW.}...L.Q. ....>.X.X_J..U..Vb...ho....S.
?.<x..,.1.-........ .....Z.....I.k..-......c......pr....C....O.....
...<.[.O..{.f.h.z.G.U.k.q~.D.V._V.[....B%).....[..nr.!.>D(3^.=T7
jJ.~x[.;2.....|z.l..R;..#0.OA.g.TR..L:&..6..u<..3N..[C....|IWp.....
....^....2..<}...?.;.X.9.u.....][Wq..Z........V[.CA.E....$6........
..?....l..)..(.....H.K{(.n|ag.p.|PT."[email protected]...;[..*R..$...~.
....A...c.&..ib....$.....9&u.I..i.5h].......`.f....WP.i:.#.RN..o..=.f.
...uT.4T..T.\........P...........^K..^...bOrI...$U........_&...^f.S...
...G.>..L..."K;...J..)K,t..}."....59.A..W.U.$..".Q.........J...
<<< skipped >>>

GET /it/u=1288538148,116491288&fm=58 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t10.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/jpeg

Expires: Sun, 17 May 2015 00:10:56 GMT

Cache-Control: max-age=2628000

Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT

ETag: cd0125d8e7711ed21c061c16c3f1ce7e

Content-Length: 2142

Date: Thu, 16 Apr 2015 14:10:56 GMT

Server: lighttpd
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................K.K.."........................................
.?..........................!.1AQ.."a..#2qr....BR...$3Tb..............
..................................................!..1A.Q..."aq..2S...
............?...k1.;Q....mcS..O..7Y................m.....Z.s.%...G._*?
u..._SUoo...U.....a.....*.<E.....h5..A....$...NOV.c.....4P.}...B~..
(.V.3...mP.......?Z.L.8....x.c..J.....i.....5.e.lZA...5Z......w..?.Y.9
.}...xI.?-VZ>%.....O...._.W.c/.....j..r..i.....j...G.."E.hN..=.....
..1.......HC..:...$Q3Ph[.|F.p!.[.6t$].}[email protected].\ZYGl.
...].-.......W..2....:.t.../y.M....S...#W..;........=......u.......[[.
..R......-...Z..r.....Bm.D....i!Q#.6....../..2.....9~.r.h..J.....b. ..
:..Q.d...$...VI....(.G..4...W..I....^.{{[[email protected]
.........qy..{t.Z.p...P.z...EXW0.v.....6....Bl..k8....(9........v.).%.
.lfN......w.fK$..T\2..Q..z..D..... ..4.DU.2..L....8%.......:.K.Xd...L.
..}u.>..#\.......~...\.p..pMwpT{,..].k`.a...>:...n[g>.R..x8. 
.f....D.K..^xM...............<}..aIrt..($.......p...^... ...<...
t..y%[email protected]....|.Z. ....y.|.}&[.....t..5<..m.n...Vq..Z.. .........
[email protected]%F..=:.. ;K[b.o..0.".3sHI.5lr.....x.....(!
..k....".N...3ct..Z....N.h.E#...`..*.3.8c...I.0.........K.(.}6O.V....2
n.x......[........i..<p$K...#..-......PB.S......G....z...6fG. ....b
|.\..4x..gu...u.3.....0....4.T..&.."[email protected]...%....
<<< skipped >>>

GET /gpt/pubads_impl_59.js HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: partner.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Mon, 13 Apr 2015 16:58:37 GMT

Date: Wed, 15 Apr 2015 13:00:20 GMT

Expires: Thu, 14 Apr 2016 13:00:20 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 34320

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 90617

Alternate-Protocol: 80:quic,p=0.5
......n.....y_...0.?..t.P...M.6...BHB..@.....m...IfI....sf.H.Iz..y.m.4
3.}.....|.....v.].ts.&~..d...s..-..y:..........%..7.].......?....d.{..
...U.......B...9.d9..X. M..#..8.X^..{.D...<l'.Ejs.N.).....y:...!...
-.@W.`...$..\@OB...[..u.J-..d>...^....x......|...`.G.V...F.0^.....i
~w..A.q........-Q.......K9......dT.......*z...Z..,....9..(......(u./w.
.(j..,.5.RN.T.!q....Hy^....bWB.........h........J.K.....!1...NUy.h.8.[
>...u-Y.} .M.y._........GO.~..~3.p ........z.o...?..P...FM>...l.
..01..`gL..z<X.....;y?..l...4..@.....<..F>.=.8g...YV..=.... .
....W-5.d.A....,..p...Y.W[])fL....L......<....N{k]..j......=.......
f8..@t....}.y ..{..D.w...Y.P .......xa.u1.lF..V..o..4L..|.0.l....X...X
\|..PCH;..&M..8..U.|....u..?p..........L..JW..f..NXL.....o.Uy/.M....Li
.S.`.y.OS.C.....Y...q.....;wg.a}.....i..h8.....u^....Z..nx............
4.....7tyQ...C.D...}>............&...~...a.....63,..H.R....%W).8.x/
.........c......S<......Y>.S.EC.p...A.......-o]..`...YN.qVW..^..
F8....B?=..1...oW.l..W. ..{x.yq..-.F.....3k..g...... .3,=...?[).c.^]..
.....X..|Z[.O u_c..<|ZW....Z...>hQy5;K.r.w..4..}...........k...~
o...../......g.O..l..n!W'.c..o.,.t..bt.._..].m.M......waY...0.z.\.T@,.
..4UC.0.y...b|..hpm.w......`"..'~...x.%j;%.....b.5}...v...{.;..l.e5...
....6L. {...=g...y..I:..B....!.Y&...lM.....7>[email protected]|4
....b;.b5..~.....{.k....]4.........f..}..B.....o..;..<.8.u...m..^..
L...Q..:...|>.]5.au.#s...,...3...]7........9np..y...C....9l,:%.u~..
=t..c...=&.8...>....cN.9>......2........d.S2.,..l.'z..^.....
<<< skipped >>>

GET /ifeng/sources/inice_v1.js HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: m1.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 16 Apr 2015 14:11:27 GMT

Date: Thu, 16 Apr 2015 14:09:27 GMT

Server: Tengine/1.3.0

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Last-Modified: Thu, 09 Apr 2015 03:13:42 GMT

Cache-Control: max-age=120

Content-Encoding: gzip

Age: 1

X-Via: 1.1 hnlywt61:8107 (Cdn Cache Server V2.0), 1.1 kf50:2 (Cdn Cache Server V2.0)

Connection: keep-alive
da6..............Ko.... .A...dDQ..8.h.p.g# .S....v..9.&.8,.......C.EQ.
@o........b..3...OSJ....`..k..|.....H..a....z.t]4.}2.!......!..b../S.s
......{.Y8I.7:..0..&....`.......fc.....'$$...I2...M..\.....K.../..P...
5.`..}.@..`i%1..Zqs.]n.$..G.....~..6...f{h!d:..........D.....JJ..."Lc.
.....|)...hJI_.(I.X...l. ..J...k.$.&.V.RS......Pb..V....=g3..aN.siq..1
...\....5....Y...2...qC2k<.......I."[email protected](..M...Js..sAB.=$....
..B.....`...`.E..6|...P4...r..g.d.Y`{..W..D..{8".4G.F8..m........ .%.0
OE3N.,.ne.4.NC........C...ph.i..(.(z.r...n....K.M..*LBm..v..e.../.x...
'qn.....0m...x?... .J.8a...............sJ.vBxbd...R..:>=t.,"1^M....
n{H..l5M.xW...]G.@.=XG.P.=\G....777.z......f.^.>=<..m..8...:zvz.
....b6^....g'/..F#....k.y.......*..uB........W...|rz..q8.cFk$B.W......
..fI.I.3Z#dN..b..g,*f...&`.r....S.....}6.#<$.8....]_g|}..sb9.7....'
.....(<$....u.:.0.-..:.%.......Zz.".u......!.4*.ml.{..p......>..
....\..0......zt.q)O.:.p(.....ZA].fh.e?.$i.Ir......*.x.!KK*....Q.h..P.
.M..c.p....U..'`.7.....@.........^.........Hik..c.( .AR..&...U:...`C.J
5.\...hX/r..9... X..,...:......_.ze...!..0.G......|C...&9..1...Ff%...r
....?t.... m.$.R....\..6h.4...Z........;P...f.Y'.T.'...^h].....k....?e
.X]....YL......G,....0.IV.r..O.$....>.<..U......$.!.Q...6......z
...}P....!.....12z..N..n.i.......4.[.\ ...OD....,.. vk...y./.&.P7...W.
/..P.......|..&).7.c.b....5r..)..M.R.S).4...K.R."...*'=../...c....0.t.
ec..,.J.^..e...T.f'g5K. (...\s].(...B'.cZ.i...gg/.................$k.Y
...-.3...V...S$..k).O..Z..0K.Y....a...Pp.3..kKW.`e...Yy.....I.....
<<< skipped >>>

GET /it/u=3263161068,3203223156&fm=58 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t10.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/jpeg

Expires: Sun, 17 May 2015 00:10:55 GMT

Cache-Control: max-age=2628000

Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT

ETag: b91c3075ef4a019a8abd400465355071

Content-Length: 2263

Date: Thu, 16 Apr 2015 14:10:55 GMT

Server: lighttpd
......JFIF.....H.H.....C..............................................
!........."$".$.......C...............................................
........................K.K...........................................
2...........................!1.AQ.2.aq."#Cr.35BS......................
........../.......................!..1Aa"Q..2q....#B................?.
...@(......P..@(......P..@(....d.;}...u..k.... .....<.N.....x......
wY...a<[email protected]^ 1hSiq3.})`.D...:......6.:.......eD
}../2..8.6..;.~h.x.Ea..9&.y...i|.\I.t!_...?...b.h~.....7...K.CK./6....
.@?4.{*..O1k.......;..d.i..7.......c,[email protected].=.Z.2..$(...
P..........(...7../....}[email protected].......)H.=.]..L......$..p:....
...l..p.q....G..R..}b....H.i..>4...sI.(...6.....6.f..R.*.'0Yy.KQ.P|
....._n........|......L.....k.. .).t.C.........L...3.....KdX.l,,qn!...
l.-.w?v........0b8.......[oW .e.....C.I$..YP$h...h....?.,c..z....\a...
Bzd&..n#.m..?....>.....bM."..L}.....h.i!I.I...G......)]>.~...n.&
lt;n.b.. o.N.`.E\.........P.p.....w....... ?:C....Cz...#g.Go.....c.,..
.....[YS....@Sj.......|...:}...ly6.}.....x%....-\....@y........../..m.
..uE...R.<....F.}>.3...0....1Er.......|...7.j.......?..b...y2.&@
nJ..:..Z.."..~..`./t......k......7.....h.k..&46.......$%;'....`.@s.]g:
.U..m.,f.m...}...Q..R.ky@vPJN..}.*....3v...s.p./.\......_.....s..gv...
[......z.5RW...9...yo..R`.RWe./R..n.2i.J.:9.,.s..Q.r2.....u..nz..^e..m
........|....<...=f.C.PsX.n.g....o..y6..An..Ik....!^^.mZ..N...ZYq :
.i...S.>.._=.i.9...Y...t.y....O.Q..Eo.....)8.;=..w.g66.{.a..i..
<<< skipped >>>

GET /s?wd=南京华扬太阳能维修 HTTP/1.1

User-Agent: Internet Explorer

Host: VVV.baidu.com

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:13 GMT

Content-Type: text/html;charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Set-Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BIDUPSID=8C833062B6F97482CA56473B4B36B66F; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BD_CK_SAM=1;path=/

Set-Cookie: BDSVRTM=175; path=/

Set-Cookie: H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498; path=/; domain=.baidu.com

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Cache-Control: private

Cxy_all: baidu 9a92e15ebdbc324fb792b479f39dde19

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 3

BDQID: 0xc27f20810001a6fd

BDUSERID: 0
373e..<!DOCTYPE html><!--STATUS OK--><html><head&
gt;<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
;<meta http-equiv="content-type" content="text/html;charset=utf-8"&
gt;<meta content="always" name="referrer"><title>.........
.................._............</title><style data-for="resul
t"  id="css_newi_result">body{color:#333;background:#fff;padding:6p
x 0 0;margin:0;position:relative;min-width:900px}body,th,td,.p1,.p2{fo
nt-family:arial}p,form,ol,ul,li,dl,dt,dd,h3{margin:0;padding:0;list-st
yle:none}input{padding-top:0;padding-bottom:0;-moz-box-sizing:border-b
ox;-webkit-box-sizing:border-box;box-sizing:border-box}table,img{borde
r:0}td{font-size:9pt;line-height:18px}em{font-style:normal;color:#c00}
a em{text-decoration:underline}cite{font-style:normal;color:#008000}.m
,a.m{color:#666}a.m:visited{color:#606}.g,a.g{color:#008000}.c{color:#
77c}.f14{font-size:14px}.f10{font-size:10.5pt}.f16{font-size:16px}.f13
{font-size:13px}.bg{background-image:url(hXXp://s1.bdstatic.com/r/www/
cache/static/global/img/icons_2df80e9d.png);background-repeat:no-repea
t;_background-image:url(hXXp://s1.bdstatic.com/r/www/cache/static/glob
al/img/icons_b5457670.gif);background-repeat:no-repeat}.bg_tuiguang_br
owser{width:16px;height:16px;background-position:-600px 0;display:inli
ne-block;vertical-align:text-bottom;font-style:normal;overflow:hidden;
margin-right:5px}..bg_tuiguang_browser_big{width:56px;height:56px;posi
tion:absolute;left:10px;top:10px;background-position:-600px -24px}
<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; BIDUPSID=8C833062B6F97482CA56473B4B36B66F; H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498; BD_CK_SAM=1; BDSVRTM=175

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:16 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Cache-Control: private

Cxy_all: baidu 67ccdef43083557c671260226f905bc2

Expires: Thu, 16 Apr 2015 14:09:23 GMT

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 1

BDQID: 0xd53f9b580001b063

BDUSERID: 0

Set-Cookie: BDSVRTM=0; path=/

Set-Cookie: BD_HOME=0; path=/

Set-Cookie: H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498; path=/; domain=.baidu.com

Content-Encoding: gzip
6129..............{.cIv...D.;`P..U=x?.U.F.zzzv....{...^..pQu..Z\..{j*.
.0%Q.L)hKA......?l...az..".Yf.... .wN....7/.z....b...7.y.....o........
...f>.w..j....O?yR...V.....gq4.ww.o".....O....<^.6.bS..Z......7.
.M.*....u.o....zT.....O.T....h..fv#....MNc].4....Wi..........z..Ql.,^.
..lP.,....l.g.......z...&....k...\....U.d..q..k.o.f.f.u .....9.Q~U7.f.
......W?../...../........?.............w..n].y.n.y5.K.b......r..L.Yi:T
... UF.....89=...........<^Og....~..,.....j../W.4.$.E....?.O....<
;YT...../W.d.,N...f..S'..'...h....c.z.>..y...o^.M7...kT.`z.F.r...'.
^..l.".l.xF'.h}.,...M.Dw.8....%.I..n/.U.^.........l.....R.N..=..Q4~q.^
n....t:...Ue.\. .Ye.\..OdY...Y.n..a..r..J\eo:....fri-.,.n.....h....~.*
../g.u...._E.hL...M..W..J..V.yt.....>[email protected].....(...o=.
.I.......Oj.......u....f&.N..v..n..;.5j....&7.l..m.8......` .p....J...
........'.$]..W.d...WG........\4...}P.xBpa.q=.dx.&.T].a..^..:.%.2..5^.
.?....r:.....cR........].Iz.|.=.....k.*A.epIeo......7Z....$...9.6.....
[email protected]\.,/...ml...p;G........T..=_/...b..MZ....V\......{..RT
...Jm.YT.f/.#V.....$.J........]..A...b..A...........%.A....9.C.AF{....
.....V.`...c.?..:(.0'.I.'4J....d.][email protected]$K...............D....,.%x2.'.
ItI.s'O.3.........-Y.v.......U...FpP..O.....a...z....0..g.....L7....P.
&\..U...T..^...... ..txxH.K.H..z.<]j4m..Z......;?...q...........E..
...-..i.B......A..[....d.V.....k.51.....0..B..&..k...1.C.. c...h...LJ{
G.....ZGM...I[.:..Si..d."|..m-. .1.h.y...9...v..:T=WS......}....r..9.V
.q...f.zQ.7>r.W'..F}.t...]M..r.>..3x.xMs.Pq....hG...q....d..
<<< skipped >>>

GET /img/bd_logo1.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; BIDUPSID=8C833062B6F97482CA56473B4B36B66F; H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498; BD_CK_SAM=1; BDSVRTM=0; BD_HOME=0

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:06 GMT

Server: Apache

Last-Modified: Wed, 03 Sep 2014 10:00:27 GMT

ETag: "1ec5-502264e2ae4c0"

Accept-Ranges: bytes

Content-Length: 7877

Cache-Control: max-age=315360000

Expires: Sun, 13 Apr 2025 14:10:06 GMT

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR................8....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; BIDUPSID=8C833062B6F97482CA56473B4B36B66F; H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498; BD_CK_SAM=1; BD_HOME=0; BD_UPN=1121314151; ISSW=1

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:13 GMT

Server: Apache

Last-Modified: Tue, 26 Feb 2013 07:44:26 GMT

ETag: "1636-4d69bd3a62a80"

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 1092

Connection: Keep-Alive

Content-Type: image/x-icon
...........X.hSW......;.Z;.#....N.)2..!... ..C...(..@[email protected]|0 >
..(". ...`....mc......6m<...MLnnz.&.0.....9.|...?..P.z!.....L...Q..
R...X..y9.k.Qa...~k..p.$D._C..r......#h<..:...-.P...........55.~.6.
n..-.n...............h...b.f4.......QW..C....o..~.P..T......!.j9..W.._
.g.-h...O........7...-B.g....ut4.#.f%j..F,.B..q.N.@.._.%^...U....I.0&l
t;.\\...p..y....?...H.....l....\n.....-}z\...K.,uZ.zc.90u.._..1..V.l..
>.....%c|c....x.#.z....FQ.M.>d.....o....h.R.=Jy;.g.}U..J.H.....E
..'....!.o.8.......}..u._...Dt.K......qIpK..=.r.....g:x...<.%....o.
M.....s...m-yMG..S..rG7..VK......$_..[7i.y.{..K.........j..9.Kn/.w.\..
.{.....=.......R#e./.V...6.z.b7......-5\N....O........,..R.......7~...
1.[.....x.q.l..{.Fu../r..\.....R...........CK_.5?.[z.4......:.|.'..<
;.=....\..-=..>....f..W~'..^..cN..'#7...EH....._....GK.$....a.6....
.-}Xb...... ...%........q....S..._....n._5.]W.l@;H..'....fH...;W......
.o..>...{...7).3..y...%.....\.......X..Jo..q...P....a.@. x.{.i.W[.:
v$m?.cw......L.N3.&....w.g.)..(Ny.....Lw......o......S......5......T..
...#Q..G.j.|.....&.m.^O..p..K.....f..!...7z.d.."?..79..K..k........96.
..HTTP/1.1 200 OK..Date: Thu, 16 Apr 2015 14:10:13 GMT..Server: Apache
..Last-Modified: Tue, 26 Feb 2013 07:44:26 GMT..ETag: "1636-4d69bd3a62
a80"..Accept-Ranges: bytes..Vary: Accept-Encoding,User-Agent..Content-
Encoding: gzip..Content-Length: 1092..Connection: Keep-Alive..Content-
Type: image/x-icon.............X.hSW......;.Z;.#....N.)2..!... ..C...(
..@[email protected]|0 >..(". ...`....mc......6m<...MLnnz.&.0.....9
<<< skipped >>>

GET /cache/fpid/ielib_0108.js HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12; BD_CK_SAM=1; BD_HOME=0; BD_UPN=1121314151; ISSW=1; H_PS_BBANNER=1; H_PS_645EC=3c70RzuHf3OnguuWgstPA6+cKl7trAD7CLhsdbMb/ukLv2VuYggcyzNSbIA

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:48 GMT

Server: Apache

Last-Modified: Tue, 27 Jan 2015 06:20:20 GMT

ETag: "ad20-50d9c3fccd100"

Accept-Ranges: bytes

Cache-Control: max-age=315360000

Expires: Sun, 13 Apr 2025 14:10:48 GMT

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 22164

Connection: Keep-Alive

Content-Type: application/javascript
............{....-..>..;W&B4U..*R.N..bg.$..I..J~ ....2II~H...Z....)
Y.....dcww=.c.]...g.....:..8}..........359...:>..O?.{..N.WGg.......
v..zuq.p}q.....w..6._.v.5..O..............f;....W...v\=8....r...O...-.
......./..;.....|2{.|1.[.}...}..f.o....w..[.G.......W....5{.T....9..O.
...|..y....O.&...dy=..[.?.k<..Z...}...kO.>..:...o....Z=or|..9Zy.
....-&..>..m)..n.\..........m..7..~..........x....{6...t4..,d....jo
q3e............=[,....#.=.)m..u.i.?_,.F"..1.O.#.....?_.....;....,i.>
;.h..5..n.......7W.G./w...N.U..f.1.......[......7_39..6{~J..Sm..'....=
.:...nOO....v/..{l....0N.'/.:X....N........&?L.........([email protected][...
....hr1.ar9..._l...M~....8x1....*.:.z.g.. $..x[..h3.lL.v>B..H.f.P.@
"LjUk..Nc.x.5<......c&.*....[....b.I;t...1......m.RQ9sO;jiG....j...
..iI.|P>E{.....!(e....G..C'N.s:.m.VCC.Q......F...Sx....m...h.l..=.b
..8..j..i.[..W.4c...-^.......Il..vS^L<.R..j..[.....{....W...-Y^....
..Mjg..A..,7..V(.X......VxiEP.C......z...&(N.f..=E...V.D.g.~...l.Sp.!.
x.....ut.]..4...B..y.....;4C.`k.j}..Q..1..b..=Sb.9qhG...w[b.!^C=......
...Lz...m.U.......`..2.:.....y.F.q."....o...$&.6z...2P@..^........M...
5..&e..E.A./....5./.V%......9.....6..1.h.6...=..AA...y....=.QC{.J.@U;u
o.,[email protected]..&..$..}MI28h..........5...}...3[^.
.A...R7.ypK.98)..G8.6..v....X[.{bc.oi0..f`.........N.......>....o..
T.....Bz....w....6.JC`.....s..D.Z.....m...a..i...nC...n....t..2......$
w........./..!VZ.a ......7............ ......<x.-F......Ow[..!.....
. .hHC.}.....x.....&\....U{_.........0..S3........C.....h.........
<<< skipped >>>

GET /nortb/hdt-ifocus/request/?id=PM1304281078&be_retarg=RE141201001 HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Cookie: force_preview=FT1504130011-4493-CT150407010

Connection: Keep-Alive

Host: adm.icast.cn

HTTP/1.1 200 OK

Server: nginx/1.5.8

Date: Thu, 16 Apr 2015 14:10:53 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 0

Connection: keep-alive

Set-Cookie: ic5=206fb9d40de09d96556900040cdace1f; domain=icast.cn; expires=Mon, 30-Dec-2999 16:00:00 GMT; path=/

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR

Cache-Control: no-store
HTTP/1.1 200 OK..Server: nginx/1.5.8..Date: Thu, 16 Apr 2015 14:10:53 
GMT..Content-Type: text/html; charset=utf-8..Content-Length: 0..Connec
tion: keep-alive..Set-Cookie: ic5=206fb9d40de09d96556900040cdace1f; do
main=icast.cn; expires=Mon, 30-Dec-2999 16:00:00 GMT; path=/..P3P: CP=
CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC N
OI DSP COR..Cache-Control: no-store..

GET /ps_default.gif?_t=1429193428648 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t10.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; BIDUPSID=8C833062B6F97482CA56473B4B36B66F; H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/gif

ETag: "1792798031"

Accept-Ranges: bytes

Last-Modified: Mon, 28 Jul 2014 10:27:32 GMT

Content-Length: 43

Date: Thu, 16 Apr 2015 14:10:27 GMT

Server: lighttpd
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Access-Con
trol-Allow-Origin: *..Content-Type: image/gif..ETag: "1792798031"..Acc
ept-Ranges: bytes..Last-Modified: Mon, 28 Jul 2014 10:27:32 GMT..Conte
nt-Length: 43..Date: Thu, 16 Apr 2015 14:10:27 GMT..Server: lighttpd..
GIF89a.............!.......,...........D..;..

GET /ps_default.gif?_t=1429193428663 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t12.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/gif

ETag: "3881534169"

Accept-Ranges: bytes

Last-Modified: Mon, 28 Jul 2014 10:27:56 GMT

Content-Length: 43

Date: Thu, 16 Apr 2015 14:10:27 GMT

Server: lighttpd
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Access-Con
trol-Allow-Origin: *..Content-Type: image/gif..ETag: "3881534169"..Acc
ept-Ranges: bytes..Last-Modified: Mon, 28 Jul 2014 10:27:56 GMT..Conte
nt-Length: 43..Date: Thu, 16 Apr 2015 14:10:27 GMT..Server: lighttpd..
GIF89a.............!.......,...........D..;..

POST /ClientAPI/flowtaskAPI.aspx HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible)

Host: flow3002.6299.cc

Content-Length: 167

Cache-Control: no-cache

parems=3B6D427D39170CE5008F14C41F3933E7777ED11BE4AC5DE49967D124D13CEF98EF810CC1EC1C4239C27CCA4BBE161DF1A4F24C5DCF9EADA34220123F0C9A51B4183C709F4C234C79F447E3000E375424
HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 96

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 16 Apr 2015 14:10:20 GMT
32A45B4F6626435761CCBF7971D304AB3076C5A18E5564FC35BC8069371D182A7DDA4F
0F0924FF9486B9213262CCB928HTTP/1.1 200 OK..Cache-Control: private..Con
tent-Length: 96..Content-Type: text/html; charset=utf-8..Server: Micro
soft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date
: Thu, 16 Apr 2015 14:10:20 GMT..32A45B4F6626435761CCBF7971D304AB3076C
5A18E5564FC35BC8069371D182A7DDA4F0F0924FF9486B9213262CCB928....


POST /ClientAPI/flowtaskAPI.aspx HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible)

Host: flow3002.6299.cc

Content-Length: 167

Cache-Control: no-cache

parems=3B6D427D39170CE5008F14C41F3933E7777ED11BE4AC5DE49967D124D13CEF98EF810CC1EC1C4239C27CCA4BBE161DF1A4F24C5DCF9EADA34220123F0C9A51B4183C709F4C234C79F447E3000E375424
HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 96

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 16 Apr 2015 14:10:34 GMT
32A45B4F6626435761CCBF7971D304AB3076C5A18E5564FC35BC8069371D182A7DDA4F
0F0924FF9486B9213262CCB928..

GET /public03/pc.gif?_t=1429193428632 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ecma.bdimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Thu, 16 Apr 2015 14:10:28 GMT

Content-Type: image/gif

Content-Length: 43

Connection: close

ETag: b4491705564909da7f9eaf749dbbfbb1

Last-Modified: Sun, 14 Sep 2014 02:49:30 GMT

Expires: Fri, 17 Apr 2015 03:50:13 GMT

Age: 210013

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

x-bs-version: 4B3EE93785952E7D0ACF51FC91505D34

x-bs-request-id: MTAuMjE0LjM5LjQzOjgwODA6MjkzNjQ3MjQ4MTozMC9Ob3YvMjAxNCAxMTo1MDoxOCA=

x-bs-meta-crc32: 85354799

Content-MD5: b4491705564909da7f9eaf749dbbfbb1

x-bs-client-ip: MTE1LjIzMS40Mi4xOTU=
GIF89a.............!.......,...........D..;..

GET /r/www/cache/static/global/js/call-bdbrowser_97c84903.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:55 GMT

Content-Type: application/javascript

Content-Length: 1006

Connection: keep-alive

ETag: "7d3-51204ce9b32c0"

Last-Modified: Tue, 24 Mar 2015 08:45:39 GMT

Expires: Sat, 22 Mar 2025 04:55:10 GMT

Age: 1934145

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Ohc-Content-Crc: 978273652

Server: ld02-sys-jorcol01.ld02.baidu.com

CDN-AGE: 1
...........U.o.D...W$.*...q.n.T3Z%i.*v.....V.............=q.#G...'8...
.....y...c9.C...~.y.Y...%y.k..YQ......Y.1.S7b....(..........A..9 .....
p.J.#=u....%[email protected]*...../......p.|.e.*H....i.....E....gp,
Y$..n.u."mXV.......|.em............J)g...._...(.G...B0/....xMB..BDg...
...aW.Q6ke..)bfB.ynQi9.X...O0.....M..l..~J./..drq:.p..T2?.M.G]D.......
z.I.2!................?.....n....._.>......am9".......9..Vb.3..R.2.
!.3..W....2..P.r...)..J)$D.W....KZCPY../go.%.I.Z7C.u.D.h~.DQ.&...L.T=Z
.*..F1l .64<t.Y...?:[email protected].^^...`. .Z4r[.Kxv....-.....5w]...Dyyl
..............J..<........2>..=.?........^.>1.;P}R..l..a.....
.....D..0q.dV......u6i....k&..h.wG..^.S..e.4..Z.oe.....6%O.Y.Wi..m..o.
&...j...*...8...........mEg1.gvzR...9R...a.l;X._l..A..,^F.\r...G....j.
.u.>9.................u... ^...1..5.......J5%v`.^.}-..d...7.qo.tsL.
.....Q...8...R.\Q.?b.......G."....C.-<.....N.Vz..s....D....us..0 ..
..S....|.TC.).Z...*......l(T...@..!..c.H|..K...6Hb........VcU.a.n].[.a
"....T..".t.R...y.5.. ..v`C5...y._.\7..1.!.......

GET /passApi/js/uni_login_wrapper.js?cdnversion=1429193425851&_=1429193425101 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: passport.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; BIDUPSID=8C833062B6F97482CA56473B4B36B66F; H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498

HTTP/1.1 200 OK

Content-Type: text/javascript

ETag: "4219043308"

Accept-Ranges: bytes

Last-Modified: Wed, 08 Apr 2015 05:56:32 GMT

Expires: Thu, 16 Apr 2015 14:20:21 GMT

Cache-Control: max-age=600

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1420

Date: Thu, 16 Apr 2015 14:10:21 GMT

Server: apache
......$U...Wmo.F.. [email protected].\[..r...Nj..}.l....4......,64.T....<
..3.....R..i.........&.V#........ZD.&I".%<..,.1....6(b"x..h..M.....
.`..Sw.b..2..2.....(......4MR.?.k....9..-.x*`.F...2..._.iB.5...@f..!.~
..........;`..%.R..`...'....#....,g.....>.........v ./sC.$..s.,....
.L....B.%.2...#9I.i...=N."[email protected]...;=...XyF ^2K...........53@(...
.~.P...^.<..1O..O...f.u.C......,......S.^Y.>0.t..(.VynK.U('....z
.g...e..M...<..|...J..`0..4KDB......sx.{.u{j.n... ../G..g.H.&.,.B93
..~r.3,U..7E..(Y.x...?...).8.}..9......a#..p3..C..~@<B=g.F. ......'
.l.LO0...,|..Q{.P.....`......"f.`....E.\%q..8E5:.............g.b#J.?."
..R..)...1.....).?......)!t..r........#.....;...|.....TR.>...=u..|B
.1.h...O.....1s....^.LI.p.zfG...xJ<<c.>....K..2-d7{@.8......~
.(MW........F.C...|.G..O....Fps|..\.Bb..O...l<....;v..Q.H.H..tT#:.p
....0..F...i.Q.8..a6&......m{H.0.....Q.s.%-.n..$ ............c..'SG..{
.[..C.y.)...=.s..:.9%.3..5V.3...... ......Qj...\.7..F...........Yi..T.
 ..P......P...>..;......L.>..\...'.Y.S..;..F..A|.=.N....J.>.~
d..d.....zJxl.C?.....M.&...bY.....S..?Ra......V.B..l...\...Xw.2.pu..#.
?K~H%Q. ..[...1...N.UfR.f,.L..<[email protected].".>.I&.P.r9&2
.._.4..Smh1....n.Q...ss...yp...[.....E.F.Y..e.,.5._.u.E..sE-.$V.... ..
lk.>._.m@[email protected][email protected].=.M...X....E..2....I.,......
^w.....ub.(..#.;.\....T...G.T.S...DH....`p.DheHR..a.d[..FkUZ......d.cX
..w..P.....)/.%dY5.e.'[email protected]_....{...9.Z.....gZk.M.\6.D.<[email protected]
8.#......
<<< skipped >>>

GET /app.gif?&cna=0rC2DWbMLVwCASU5EL1qq92F HTTP/1.1

Accept: */*

Referer: hXXp://1.rwdns.com/zztj/yeshe.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Thu, 16 Apr 2015 14:10:29 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=0rC2DWbMLVwCASU5EL1qq92F; expires=Sun, 13-Apr-25 14:10:29 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Thu, 16 Apr 2015 14:10:29 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=0rC2DWbMLVwCA
SU5EL1qq92F; expires=Sun, 13-Apr-25 14:10:29 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /r/www/cache/static/jquery/jquery-1.10.2.min_f2fb5194.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:18 GMT

Content-Type: application/javascript

Content-Length: 32986

Connection: keep-alive

ETag: "16df0-51204ce9b32c0"

Last-Modified: Tue, 24 Mar 2015 08:45:39 GMT

Expires: Sat, 22 Mar 2025 04:54:58 GMT

Age: 1934120

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Ohc-Content-Crc: 396873407

Server: ld02-sys-jorcol01.ld02.baidu.com

CDN-AGE: 1
............kw.F.....B.x ...('.3...q..f....I2.................S..h....
.y.:...4...T...r..w..w...;[email protected].
yqu.LgIV&...>...l.z~....]\.e.PiT...|qT.<J..|&..t3.g.U.U..b{..2..
%U.>..]>V..~...d...'...<Z.fyF..k.\o.kuE.%z.Vt.f.......f.*.].i
v....u\~{..*.uRTw.2Z...J.F...I.)..,.9..,2j0..D..N.D....t........6....f
.|6..t..N.e.).Co...... .<:.erQ^l>..../n....m..1U{I..t...drqs....
.L~9.>........ x|..R.O...~@U/N....'...g.[<...6U.....>....)U.e
.nU ......3.....]\\.^....n7..y|.xv.....]@.~.N../.S\d.'..*6.v./.d.m....
LI...\.....Uyr...NO|...Sz../......aM..<.....w.^p...x>......iY%YR
l..2..^......`.....JP...$.....*[email protected]....~.?...7?...*..4.}....<.
..e..d...U.,PIwu..T.Bjs.T... .^.q.J.qv.gW.UES.Z..........E^..ut/.6\(.-
%-.....V..Cg.i...MU>z...^R..uZ... y.....MU.8..Od.........z.."B.IvU]
...3ss.}8..h.}.~...Ar..hIU/.n{..lz|......6....>...`A..^....3F?...w4
.....(.Zq6..n..d8.3Z.UR\%>...u\...o....T.uc......|....Z...sQ..X..A.
......k.....|........YE]......zpD.........t......N..W....d.k-KN.|.....
.Ws...i..........u.~>H..(..fZ.;Q.1Y..LqG..(w..9...*....L...;J..TM..
....F.z.cA...$..zK.....o..*.....K..`b...W...YQ.w.|.[...z....CU.\-t....
.`./..qz.&>tQ.!.............s).8c.'S^.I2%2Gt.p..m.Q..*r!.........."
y'..s......U.TBH$.....<....G;...5T.5.sV).3Q.,..fxPL.;..{c.._...zy'.
.. .Y.>..(.C.$.....e.`.B;4..;&.Y..E.......zF.......qu..y.'.t.NhW.U.
..........V.T....]...`..'.......n....` ..^.2/*.....\.....v.28..@.= `..
...v..Yd...p....Y;...-.nK.......,.......<_&qV...6.,*.........y.
<<< skipped >>>

GET /r/www/cache/static/global/js/all_async_popstate1_0c1233e7.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:20 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

ETag: "2d3a7-513d41fbc9380"

Last-Modified: Thu, 16 Apr 2015 09:31:10 GMT

Expires: Sun, 13 Apr 2025 10:27:18 GMT

Age: 13382

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Ohc-Content-Crc: 3035242708

Server: ld02-sys-jorcol01.ld02.baidu.com

CDN-AGE: 1
2e4f..............{...u ...O...)BD..7I..^..#[.h....... A6.I....n..?;7;
^;N.d.I..M.l.?...l...K.]vG......s.*.@.....}.w.M.P.S.N.:..9.N...z..k..c
..M....h.*.&.N....k.01.g.}. .N.....U...5..........Mz|...-.egl9G\.3.w..
o........O..u...{e.j..m...3..'.>.I...............?....*...7....`kj(
X9...X.T8.F.x.......ti.M...a.......y.....7o?..p..7pb..[zpo...FA.......
..... p...cs..@...?*...a...7.G.....^'.u...!(...PG.;....v.:.&...9..<
'|...`..{....X.?...j.^..I....`./....c/.`....^.n.-.:......L1......v..!.
..e1?G8?...'...x.4...<N-...r..L.....6.aqG.N...<..1.1/;.~...D..HL
..&.......:.Ql,..e.P F...9.@#.7.j..?.4.9a.9.:n..k....v......C=....r..j
0...<;;.>.c..=z.......=xt..w......e.$,.....1.F.aV.%s...E.'\..0/1
...3.....O.....G..._.....#......I..d.$...y..)...bM...O...SX.........&l
t;*..Ag2.Fq..c......a.,..a....].i...2.;.{[email protected]..}/..C9w
.{e.....X. ~..3e.NS.`.....s.L.N}....DM$2N'......x.V.a7.$.rI.........x.
..~...G&...G..2$. U,..`.....X..r...... 5..3........N..qgGgg;...a...8..
...Aw2..=9.{.}g/.........A4.....{..KR...W.E......1....2..}L..8}......B
.......7...3..*.$..W.WI..-m..!\es...#'...a....R..l-...|.A).UCo<p:^.
V...^-..F..{W..............M.T W......o..VL.j...A. ..=.J]1.*.n..v.Z_.=
......E.........$.(W@...~....%[email protected]..&NK..;L.}..z.4|..5..d..
5.6.c.. .(...V.R..4J....y..H.8..SnBt..,6.T...7.q"jS....EU6...C..c..6&F
[email protected].$.L.m.[o#f...C3..mX........yZ....y........3...>.$...C.
...c.^.....3...2...K8M.d...|.2...!..M-....PB.oo.. ........A..e..T..g..
[.l.%fKPV....%...Fo#.&I7..,..........&O...i8#.mZ...^f%.3.33..m.7E.
<<< skipped >>>

GET /r/www/cache/static/global/img/quickdelete_9c14b01a.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:21 GMT

Content-Type: image/png

Content-Length: 1100

Connection: keep-alive

ETag: "44c-51204ce9b32c0"

Last-Modified: Tue, 24 Mar 2015 08:45:39 GMT

Expires: Sat, 22 Mar 2025 04:55:01 GMT

Age: 1934120

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Ohc-Content-Crc: 2409199083

Server: ld02-sys-jorcol01.ld02.baidu.com

CDN-AGE: 1
.PNG........IHDR..............so.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:C67CB478534911E4B686C574
72C4EC9E" xmpMM:DocumentID="xmp.did:C67CB479534911E4B686C57472C4EC9E"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C67CB476534911E4B6
86C57472C4EC9E" stRef:documentID="xmp.did:C67CB477534911E4B686C57472C4
EC9E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>I`r.....IDATx...... .E...rCB,.}..5......".!
w..u..IL...*>...`}[email protected]...#:}.w]W...1.
u...%`..y...{.........RJJ).h..y..CJ.Z.#.t5...I|[email protected]...
..c.~..K.q..D..ax.0....H7.......IEND.B`.....
<<< skipped >>>

GET /r/www/cache/static/sug/js/bdsug_547e5a10.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:21 GMT

Content-Type: application/javascript

Content-Length: 8936

Connection: keep-alive

ETag: "7a8c-513d41fbc9380"

Last-Modified: Thu, 16 Apr 2015 09:31:10 GMT

Expires: Sun, 13 Apr 2025 10:27:20 GMT

Age: 13381

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Ohc-Content-Crc: 907061286

Server: ld02-sys-jorcol01.ld02.baidu.com

CDN-AGE: 1
...........}k.#.q......5.m.`.....==...i.MR:[email protected]....<...|...
m....w..a;hY.8Q..............Y....K...i.tgeeeeeeefU....l....i].y.f....
.l....q......N}... .4...m.(..unO8...;i...b..2{..0.x.c...}bG...Q_..]rrB
...''..;a{..^?.....S......U..-.)l..(.%.4:.K.A.{..1..,.f.70H'H.{5wi.@..
F..ug.0..c7q....8...h...Y...(..Cb]............s...F..9I.$....d<..E2
.|.%.l...........KRZ.H.........7..D.\r..`3.mN........^6.h....sYyfV.d..
..{4i.. r{.......t....u=v....g....I.b.QRc..(..PG.o3..*...4.6...h.Z..5.
@.V.jc.j..?*..S..EI.i^......?.g....3........S.Q|..3....>...4.2.....
.%{.c..H..(.m4.......:......MD.......66..:!?.v....?mo8|..xgA.0j.....1r
g...........O.A.$.l....'.3jG..|..y.d~....$....D..........`..`n......A.
..c.g.`....P..0J} ~...6-H.:..}g......e>.I...3"fi......h>m.......
>.....o$.w...(..\..0..mX!....)7....y{1K'.(k......x..&A8D.X.t.....-.
.....C/.....7l.,....4..f.v..2...9..f...........O.~s......E...3G.od`...
...m.~........Jk0.}.\..... .....S..T.......a3P..............&. .:...m.
..........Z .2'm.W0..r......~.u.I.....!..%.`...sf..? L.<..<.....
[email protected]..."....B. 4r0..O.I..G..y........P.4......0.&5...
.;p....l....?x. ....g3.'q..s.4.....].L.a.q...... .[Uuo..w.....x..7kY.6
.7.........$.3.o.F..X.1.....v....2?.y.....r)|Jg.....F.;.../.C.o.......
\.....?....i..Y........SV.O.^..O.4.NX.zW8S.........n.K..l.={.$..5.h].}
..&....h.3/[email protected]..<.E.....i.0..;.("p)..Y..U..(
.\oW{^...e^...y.<:.. ...%..<.8...e...V.....r.......A_.I...-.P..I
..e...,.`....I..vv.... .`..D..d...|g....a..`v.4.a.v....;....}.}...
<<< skipped >>>

GET /r/www/cache/static/plugins/every_cookie_09fe94e0.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:21 GMT

Content-Type: application/javascript

Content-Length: 5015

Connection: keep-alive

ETag: "36db-513d41fbc9380"

Last-Modified: Thu, 16 Apr 2015 09:31:10 GMT

Expires: Sun, 13 Apr 2025 10:27:15 GMT

Age: 13386

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Ohc-Content-Crc: 980911912

Server: ld02-sys-jorcol01.ld02.baidu.com

CDN-AGE: 1
...........;iw.6... d4...MY.........3.&N:.*z=....E*"%......XH...v.y..L
^.......V.......k..P.....U.x.......Iv=.....}r.e....y.....q~5`..6_a..O.
b.........z.a..L....z'6...X^.9n..6O........D4.9.....,.8.....j.........
[email protected](s....t.f.O...CS.^..r.oQ.M./n.<.:....."
.x..7...._..}.....4|K..=g.4.\M.A'..sw...Y. ..^g..<.9.l'..EB. [.[c@.
i...w...V`....v.8>..c.~.......Y\T...]. .........[..q......g..>..
k.....}......J^..A.|^.....#..7vR?]%......R...4o2.........{..M..x>Y.
...bL.....<.............6..).N8{/...-h....J.....F|.............GGc_
p.2-,s..>.?.5....N..1.vp..|g........g.....R%.],zb.....G....i[C".{.*
...J.D...by#. .S..4&X.....%..?..............C..........\Ca....~...L.T.
....:.d..9..qY..k&...-</y.Z....!s..a.lf....a..i.g...p^.`=.....Q.h.n
..[....U...LW...j. .'.l.Hx..}{.w./.Ywx..\g...r4...9.f.6...R.mf..z.R...
..u..<.K).=..y...y....(....#.[...c....`..EQ.I$.X...d....R..K.2..;w'
4I8.=AQ)t.|._d.{[email protected]... ....d.%.E....V:..m...`....o....)...6.D...
}....~"Xw..U..`.......}o.:zz......."...>.._...(N..."...-..=........
p.y..r.7..O8.F....on....<.B......NB/....o.`...)."&E..!.m~.i4c......
....... ...q.V.._.Kv..\.i....Pb....t."9...)&......i..B...{.g=..W..{...
...hf.yC".Q.L.'..S.[Z..=..J...2.^.0...<..dj.6....fr3T..Q).03bHN...g
..%........v.X.q$..#.N...8.%.....4...1.jk...5yLf<B...".WA...?k.....
pweg3`..d....$O..........^.P.t2.)Ub.......J.b6.J..tv.50.w...^Af..9N.,.
3...H...d./)...........8.&...l.U.J.../p.5..@ j...8d.0...8?.^Y...m.E...
....0V."..#l...b.&G.&E<..bg...iHzk..j........I.x.A.f.{..$.S.@&l
<<< skipped >>>

GET /r/www/cache/static/plugins/env_5202315f.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.baidu.com/

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.bdstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:22 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 1168

Connection: keep-alive

ETag: "479-5133332f91dc0"

Last-Modified: Wed, 08 Apr 2015 09:31:43 GMT

Expires: Sat, 05 Apr 2025 09:51:53 GMT

Age: 706709

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Ohc-Content-Crc: 2642443121

Server: ld02-sys-jorcol01.ld02.baidu.com

CDN-AGE: 1
...........y...CWS.....x.}T.n.6.%%Y..;...i...M...e.)2,A.-..5X...0.....
([.,.....Yo...C...aW...... .{.]t...I6L......~.Hj....e....4. [email protected]..
.y.h..=..wX.A.K...i...:._...V.....MmsSe.5....U7\ .#.........%..m.O...S
W.xo...'.4..8.G\.j.j.......=L.......N..a.3....Q-...]mF..jS...L.MJM..K.
K{3}..).l....[&.....4?....r..U$>/..~...a..........3.s..`.]d......N.
wH...h.}?..S..?(}\)m...8...j..=E...Ac.Oq...o..}....../..C.=.....1...S_
`...-.".....p...".rZ...4...z.y........U..}...c?.)A!._..6.vx.8......u..
_c'...QHI/yL.>..2..ml.}^..!.k...#.e.........Q6...r..*..T].V.m../...
....x...c........$...l.....N.`......A.|.m...2.Ms.Y...<...'..#.`....
....8 .Q.;bP.%Y..{.".-.......I..............Cmw.B}w..._..q......h.$.y.
.....>!1q..L.M.q./...o.8..;.r.IXN?..OH.`. .b......=..(....".....C..
.~...2.... ..../_...U)..s.\.j.,....T.Y,.o.o........`RI.s....b....."...
d$!$%.. )..i...."9....W.\Fh..U..).!.. ..Rw....=..QNEB....t.........C..
 ..%E.PJ@v. ...B............8.?c....'c}|.ZJ%S..,.......J[..*..t.......
"el.8*.-@f#.9S[.f..a....|.Z.T....j......?...5.0..`<.....Hg......wb.
..9...).E...;....%..d.(*..Xo].. .>.^]y}:i..\.H....9..-O..p...w..~w&
...._9m.Q..dV...X'.....zkUo].[....~.......:.<.r.......T..>..n,y.
....
<<< skipped >>>

GET /xc.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible)

Host: wangbao.6299.cc

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:19 GMT

Content-Type: text/plain

Content-Length: 3

Connection: keep-alive

Last-Modified: Mon, 30 Mar 2015 10:37:27 GMT

Accept-Ranges: bytes

ETag: "ded23b84d56ad01:0"

X-Server: bmFubmluZzAxLWNkbjEz

X-Cache: pass
1:1HTTP/1.1 200 OK..Date: Thu, 16 Apr 2015 14:10:19 GMT..Content-Type:
 text/plain..Content-Length: 3..Connection: keep-alive..Last-Modified:
 Mon, 30 Mar 2015 10:37:27 GMT..Accept-Ranges: bytes..ETag: "ded23b84d
56ad01:0"..X-Server: bmFubmluZzAxLWNkbjEz..X-Cache: pass..1:1..

GET /commonpage/1210/comment.number.min.js HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y0.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:34 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1149.v0-mow ( h0-s1145.v0-mow), ht h0-s1145.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Tue, 12 Jan 2016 00:28:46 GMT

Age: 8170908

Content-Length: 579

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Tue, 10 Dec 2013 06:22:55 GMT

Connection: keep-alive
...........S]O.0.. ..U.ZiyM............2...8v...U!....T.......].......
.HSU.1.M....;rF.Y.h......E..r.(.t..~)..qB.......N...k..~..i.6.......Ij
...G.{.m.......|n..h. .qf..U..p(...P..Fg[R...75.|.Z........_..........
...b.\.n..t<.X....m.J....7. !kgtM....C<..0-............h.7J=....
a...L8..r..>..FJp.......A.....h7.H......|D..a3.G.f...L..e..5..}....
... z.....t.5.R....._Jxu=...........[.Of.&2......>.y>=f{]...X...
5.}.*.IO[...n.n"......V.._.M.<.X....6...=..h>..c....L.dB.N..(...
rN.....h..b....VP.q...vWCEX....h*.......c....C........G^z./.....x..M..
.wx.WH}. @.~k.'V..:)P.QM...|.....N......HTTP/1.1 200 OK..Date: Thu, 16
 Apr 2015 14:10:34 GMT..Server: PWS/8.1.20.9..X-Px: ms h0-s1149.v0-mow
 ( h0-s1145.v0-mow), ht h0-s1145.v0-mow.cdngp.net..Cache-Control: max-
age=31536000..Expires: Tue, 12 Jan 2016 00:28:46 GMT..Age: 8170908..Co
ntent-Length: 579..Content-Type: application/x-javascript..Content-Enc
oding: gzip..Vary: Accept-Encoding..Last-Modified: Tue, 10 Dec 2013 06
:22:55 GMT..Connection: keep-alive.............S]O.0.. ..U.ZiyM.......
.....2...8v...U!....T.......]........HSU.1.M....;rF.Y.h......E..r.(.t.
.~)..qB.......N...k..~..i.6.......Ij...G.{.m.......|n..h. .qf..U..p(..
.P..Fg[R...75.|.Z........_.............b.\.n..t<.X....m.J....7. !kg
tM....C<..0-............h.7J=....a...L8..r..>..FJp.......A.....h
7.H......|D..a3.G.f...L..e..5..}....... z.....t.5.R....._Jxu=.........
..[.Of.&2......>.y>=f{]...X...5.}.*.IO[...n.n"......V.._.M.<.
X....6...=..h>..c....L.dB.N..(...rN.....h..b....VP.q...vWCEX...
<<< skipped >>>

GET /commonpage/0304/arrow.gif HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y0.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:36 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1149.v0-mow ( h0-s1005.v0-mow), ht h0-s1005.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Mon, 12 Oct 2015 22:48:04 GMT

Age: 16039352

Content-Length: 1062

Content-Type: image/gif

Last-Modified: Tue, 04 Mar 2014 09:18:38 GMT

Connection: keep-alive
GIF89a..p.............................................................
......................................................................
.................................................................!....
.8.,[email protected].{....r.l:...tJ.Z.Xk`..z...xL.....z.n....|N...x/<
.....n.]._{.....u..[........_..0d.}.......w.\.....b.3.^.4z......(3.\.5
.\......'...6...........B....m. 7.......k. 2...p....[....z/.....q1..X.
#...s6,@.e.!.....1..0D..0.1. .=*.1.Io%O.L.r.K\-_.4.s.MK5o.T.s...?=....
t..9E.*e.t..3M.J..u...U.^..u*..O..]*v...f..M.s-..n... w&../..].w...~C.
.lq0a....K.......CN'y.7..,?%.Y.R..=.m.Z......N.w5..._..-.%...q........
~./%|8...q.N^.9sF.. B(.e...ncWI}.....t._x9yt...I.........#..........?.
4..w.{..g^.0...o...\....Z!.AR.C......d..a..z..A$.....eR.Q.<...#A"..
.~7.P..(....8c^....M-..".....L..8$.;:YN..%)c.XF...Vv.bm.>...yPY.iC.
...l....J....*t.....@../.......C....B.}.......... ....Vj...f....v.....
*...N.....s.........*....:j......^D.C...*....k.......R.0..." ...VKm.$.
...$8`.... n...`g.yB0C.....m.,....-P.....[ .0.. ...,...z ..!|@.../L..%
4,[email protected]..;HTTP/1.1 200 OK..Date: Thu, 16 Apr 2015 14:10:36 
GMT..Server: PWS/8.1.20.9..X-Px: ms h0-s1149.v0-mow ( h0-s1005.v0-mow)
, ht h0-s1005.v0-mow.cdngp.net..Cache-Control: max-age=31536000..Expir
es: Mon, 12 Oct 2015 22:48:04 GMT..Age: 16039352..Content-Length: 1062
..Content-Type: image/gif..Last-Modified: Tue, 04 Mar 2014 09:18:38 GM
T..Connection: keep-alive..GIF89a..p..................................
..................................................................
<<< skipped >>>

GET /tag/js/gpt.js HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: VVV.googletagservices.com

Connection: Keep-Alive

r.k..R.b..=.;...')ds....z..U."..|.=.*........|...y..E........k...._.u.
...Z.g -Us.f^!)6....|...g...(.. @k8.A8v-.-Y.....Iq..~.n.....V.)..m....
.{.IN|8..s_....!W:....Y..h......r:W..5...4.4.<=...Y<....8.B....;
;....Qy..U.Kqf....x.|%.[.q.L.n...{U......t..SR,.,y{5>.:..( (66|....
... .......hj.o.0...v.:JR>..n..m.x....\....6..)........b.3pG....,..
..d2.y..77....Z....^...........u`.v.cg../.wE.a...?..0...*.e,.2Vl......
.v~.....c.y1..k.-g..lOr=.#.....dd9..e..}.&.A#[email protected]*A......9...^.
.Y.m..@.>...$1P.Apk......J.e.f2.\.#.........m...g...]I`.....y.d....
.......g.....6.....<..dX ZI.tG..9.....V..e..zf.s....y.....W.i...u@o
.0........l....c?@K...>..s../S.B..]..(N....L.Pa.|..R..._..e.....*.R
.. ^.......J../T..|y./O..6!.'_...<.(.../.Sk~.....|......oY...i.E.=B
..|.^;./..K.B.../.....0x.:..u.d..[.O!.>....~...#.|JO..>p...$.#.W
Pj..B.}..Q.8.....b....<.$...=.2.. A.9R...Z.....f..*..{.YW...C..;.J.
....j.`U}...{[email protected]....]oU]A..`..`....I...Y.Z......B...>...Z.
.?......{.3....[o....{..T....CY........r.........T....e....vS..6...e~.
..c.......P...F...U>......8..b`}..............P.k.[...L...=... .4..
,g.....'.D.0..................z.....hQ]kb..~/dg .....9t|..............
..|[email protected]..,.>[email protected];'...on8..pY...[."./.".......Q.BG.#...
.PW.....A.\_...Pyw}..p...U..D.....S.)..R..Zv.Wi.Sx.....h...^.......>
;......X.............{........lm......7.9..S.:.j..~....&..d#u..T..n\5.
zg....r=.......#6...'8.$.....n.={..mll=....k...d=......kAk:..3.p&>.
.8.q.B..n mf..&.,..> .*....}[email protected]..,..A.,..8..
<<< skipped >>>

GET /tag/js/check_359604.js HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: VVV.googletagservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 10802316996441022840

Date: Thu, 16 Apr 2015 14:10:06 GMT

Expires: Thu, 16 Apr 2015 14:30:06 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 1878

X-XSS-Protection: 1; mode=block

Age: 31

Cache-Control: public, max-age=1200

Alternate-Protocol: 80:quic,p=0.5
..........M.9.e..D}.B*.*$.......g.$8.....rd....@..'.i...k......;......
..\......O..../.S...c{.E..t....]/9: 8..sg.g..7).n.....).R..[.0W#.]....
.e..`Y........&....c.=...A...b",........%B.Z.........O......sZ0J..wT..
:Z}.q..Z...3.jJ....dA.~..T...d|...-g.....Cm.Z..b.RV....m..#.S.....{l.t
.4..Tj..t....M.r.].V..XR...u]... /[..3......lp?5.......i...?..4..g....
..............sP_......y..a3sP.E.)...........9t!........fi..5.....s%..
]&...........ul.b.......xO.7..d1........1.#P.Jw.r.j......l..7..H.g.V..
..t.K...........U..(..4jm..tx....Y8,..7.PA.9W.Q.m....@w.`.hZ....l|?d..
|..H.no%.7.%k.V.. ..%..'......<...Sw.8.tz..u..Hh..../.;.7...^e.....
./[email protected].%S.a.N...H..F(....kC!^...S&..k.Av..i...%']......
..37LZ...)._.vrr(.y4..........6.m...*....*.._...jhCJ...9..8..3.>Y._
...q...i2..._..UY..v....mj:.,...k....5eDa.s.....i.rz...........d...D.n
..j....E.UU..t..x..y.`...nl......K...f6...8..d......uSj...9$).I.]`.e..
.d.%Th..z.G.....u.c.8..<a....}...Uz..M:a Q..zd./.|L......f[........
.........PPvf];..,........K../Lq.6.1.($~s.....h...../(`...t)E .....q..
A.r..W.hJ~...hf..'.|Y...b.).5....^.yfM.g..h<.....2O.....Z"....N.E..
X.r..ty...1:[email protected]..........\..md....5...V.G.3.....s<m..
....t...d."_1F.9..%Xb}.Qml*R...;...(.ZnT...U..f.]~M<...v..........2
..Sr.....F...3.pNu..?a9r.6...{`..Y.s..}..y._....w$..: .CojG.8Ae.x..v. 
....27....z....zEOy..| .......`.e}...< Y.....T...Qo.BG.%..%<g..]
'N.......B...Y..q......e......H..@.....3..Y.......F...3..e.........hD5
.........;(Yeb.t[%."!.hj..k8.....(. ./..S.e.R...([email protected].@.
<<< skipped >>>

GET /stat.htm?id=4690803&r=&lg=en-us&ntime=none&cnzz_eid=1728210536-1429193417-&showp=1916x902&t=&h=1&rnd=316818665 HTTP/1.1

Accept: */*

Referer: hXXp://1.rwdns.com/zztj/yeshe.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Thu, 16 Apr 2015 14:10:20 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /core.php?web_id=4690803&t=z HTTP/1.1

Accept: */*

Referer: hXXp://1.rwdns.com/zztj/yeshe.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 750

Connection: keep-alive

Date: Thu, 16 Apr 2015 14:10:20 GMT

Last-Modified: Thu, 16 Apr 2015 14:10:20 GMT

Expires: Thu, 16 Apr 2015 14:25:20 GMT

Via: cache18.l2de1[706,200-0,M], cache26.l2de1[707,0], cache10.de1[707,200-0,M], cache3.de1[709,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:7:158982743

X-Swift-SaveTime: Thu, 16 Apr 2015 14:10:20 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="4690803",c="",d="",e="on
line_v3.php",f="hzs9.cnzz.com",g="1",h="text",i="z",j="站长
;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0"
,n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f)
,o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.ca
llRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScri
ptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_
id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/
" c ".gif",p="<a href='" q "' target=_blank title='" j "'><im
g border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href
='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon(
[p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application/
javascript..Content-Length: 750..Connection: keep-alive..Date: Thu, 16
 Apr 2015 14:10:20 GMT..Last-Modified: Thu, 16 Apr 2015 14:10:20 GMT..
Expires: Thu, 16 Apr 2015 14:25:20 GMT..Via: cache18.l2de1[706,200-0,M
], cache26.l2de1[707,0], cache10.de1[707,200-0,M], cache3.de1[709,0]..
X-Cache: MISS TCP_REFRESH_MISS dirn:7:158982743..X-Swift-SaveTime: Thu
, 16 Apr 2015 14:10:20 GMT..X-Swift-CacheTime: 900..!function(){var p,
q,r,a=encodeURIComponent,b="4690803",c="",d="",e="online_v3.php",f="hz
s9.cnzz.com",g="1",h="text",i="z",j="站长统计"
,k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n=l "//online.cnz
z.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" 
<<< skipped >>>

GET /passApi/js/uni_login_wrapper.js?cdnversion=1429193460319&_=1429193460101 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: passport.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12

HTTP/1.1 200 OK

Content-Type: text/javascript

ETag: "4219043308"

Accept-Ranges: bytes

Last-Modified: Wed, 08 Apr 2015 05:56:32 GMT

Expires: Thu, 16 Apr 2015 14:20:56 GMT

Cache-Control: max-age=600

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1420

Date: Thu, 16 Apr 2015 14:10:56 GMT

Server: apache
......$U...Wmo.F.. [email protected].\[..r...Nj..}.l....4......,64.T....<
..3.....R..i.........&.V#........ZD.&I".%<..,.1....6(b"x..h..M.....
.`..Sw.b..2..2.....(......4MR.?.k....9..-.x*`.F...2..._.iB.5...@f..!.~
..........;`..%.R..`...'....#....,g.....>.........v ./sC.$..s.,....
.L....B.%.2...#9I.i...=N."[email protected]...;=...XyF ^2K...........53@(...
.~.P...^.<..1O..O...f.u.C......,......S.^Y.>0.t..(.VynK.U('....z
.g...e..M...<..|...J..`0..4KDB......sx.{.u{j.n... ../G..g.H.&.,.B93
..~r.3,U..7E..(Y.x...?...).8.}..9......a#..p3..C..~@<B=g.F. ......'
.l.LO0...,|..Q{.P.....`......"f.`....E.\%q..8E5:.............g.b#J.?."
..R..)...1.....).?......)!t..r........#.....;...|.....TR.>...=u..|B
.1.h...O.....1s....^.LI.p.zfG...xJ<<c.>....K..2-d7{@.8......~
.(MW........F.C...|.G..O....Fps|..\.Bb..O...l<....;v..Q.H.H..tT#:.p
....0..F...i.Q.8..a6&......m{H.0.....Q.s.%-.n..$ ............c..'SG..{
.[..C.y.)...=.s..:.9%.3..5V.3...... ......Qj...\.7..F...........Yi..T.
 ..P......P...>..;......L.>..\...'.Y.S..;..F..A|.=.N....J.>.~
d..d.....zJxl.C?.....M.&...bY.....S..?Ra......V.B..l...\...Xw.2.pu..#.
?K~H%Q. ..[...1...N.UfR.f,.L..<[email protected].".>.I&.P.r9&2
.._.4..Smh1....n.Q...ss...yp...[.....E.F.Y..e.,.5._.u.E..sE-.$V.... ..
lk.>._.m@[email protected][email protected].=.M...X....E..2....I.,......
^w.....ub.(..#.;.\....T...G.T.S...DH....`p.DheHR..a.d[..FkUZ......d.cX
..w..P.....)/.%dY5.e.'[email protected]_....{...9.Z.....gZk.M.\6.D.<[email protected]
8.#......
<<< skipped >>>

GET /w.gif?q=0‡20ˆ30†60„80†30„90ˆ50Š70ˆ00…00ˆ50‹00‡20‰50ˆ20…10ˆ40‰7&fm=se&T=1429193454&y=B776A7CF&rsv_cache=0&rsv_svoice=0&rsv_pre=0&rsv_reh=63_83_63_83_63_83_63_63_103_63|304_387&rsv_scr=1895_1242_110_0_902_1916&rsv_psid=6483934B3F9915C4C4DEE385E7300A12&rsv_sid=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498&cid=0&qid=8ec273590001dc81&t=1429193461944&rsv_iorr=1&rsv_tn=baidu&rsv_ssl=0&path=http://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=%C3%84%C3%8F%C2%BE%C2%A9%C2%BB%C2%AA%C3%91%C3%AF%C3%8C%C2%AB%C3%91%C3%B4%C3%84%C3%9C%C3%8E%C2%AC%C3%90%C3%9E&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V%2BD3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:58 GMT

Server: Apache

Cache-Control: max-age=315360000

Expires: Sun, 13 Apr 2025 14:10:58 GMT

Last-Modified: Thu, 28 Sep 2006 03:51:19 GMT

ETag: "19dc1a8-0-451b46b7"

Accept-Ranges: bytes

Content-Length: 0

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: image/gif

GET /img/baidu_jgylogo3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=8C833062B6F97482CA56473B4B36B66F:FG=1; BIDUPSID=8C833062B6F97482CA56473B4B36B66F; H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498; BD_CK_SAM=1; BDSVRTM=0; BD_HOME=0

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:09 GMT

Server: Apache

Last-Modified: Wed, 22 Jun 2011 06:40:43 GMT

ETag: "2c1-4a6473f6030c0"

Accept-Ranges: bytes

Content-Length: 705

Cache-Control: max-age=315360000

Expires: Sun, 13 Apr 2025 14:10:09 GMT

Connection: Keep-Alive

Content-Type: image/gif
GIF89au.&.....2/...Y`.....vt)2.......!.......,....u.&....x...0. J.0...
.`.UV!L...l...P....V..|.....4...H..(............t{....,w.|..B.Z.a.K.7|
M.Ph..%....n8FN&:@F..|V1~w.y....r.. .9.khlO.j.!.s.\...m..&.\...AZ.PQ..
~...yX..R..............WE.z85.'...............D.a...........,...L.....
.&..P..<.T..H...g.t..gj..4.. ....O1..>*HF%[email protected]...\.N...$
..(.'&3g..9(.r...9..D.,i.q l.;)4. 0.06`Z.fW."U.M...Ni....jC...X..x..m.
.............eK............n..BC[... `........_.:&.`.S.........../m...
Y...... .a....~........0.....p.!..i..6..f....y\<..{.f.[t...O'.S..A.
.. .\L.......`.....m.T52.D]P..U.a.}..H.=..~.Ux.m..d....e..Z$..#.r0!~.*
..W ...v..#.U.a..mf=..*L...<0.3...]..x...\y..2....).J.h..iH.t.....H
K&......D.K.....;HTTP/1.1 200 OK..Date: Thu, 16 Apr 2015 14:10:09 GMT.
.Server: Apache..Last-Modified: Wed, 22 Jun 2011 06:40:43 GMT..ETag: "
2c1-4a6473f6030c0"..Accept-Ranges: bytes..Content-Length: 705..Cache-C
ontrol: max-age=315360000..Expires: Sun, 13 Apr 2025 14:10:09 GMT..Con
nection: Keep-Alive..Content-Type: image/gif..GIF89au.&.....2/...Y`...
..vt)2.......!.......,....u.&....x...0. J.0....`.UV!L...l...P....V..|.
....4...H..(............t{....,w.|..B.Z.a.K.7|M.Ph..%....n8FN&:@F..|V1
~w.y....r.. .9.khlO.j.!.s.\...m..&.\...AZ.PQ..~...yX..R..............W
E.z85.'...............D.a...........,...L......&..P..<.T..H...g.t..
gj..4.. ....O1..>*HF%[email protected]...\.N...$..(.'&3g..9(.r...9..D.,i
.q l.;)4. 0.06`Z.fW."U.M...Ni....jC...X..x..m..............eK.........
...n..BC[... `........_.:&.`.S.........../m...Y...... .a....~.....
<<< skipped >>>

GET /s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«ÑôÄÜάÐÞ&rn=&rsv_pq=d2904f7a0001a2af&rsv_t=42818soSHCj6OJ1V+D3jINfqWBpwgbzcx03vVt65ADB0W8InvHUTnZY4ek0&rsv_enter=1&inputT=29860 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.baidu.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=13495_11077_1468_13464_13074_13382_12867_13322_12691_13411_10562_12722_12737_13439_13085_13325_13202_12835_13491_13162_8498; BD_CK_SAM=1; BD_HOME=0; WWW_ST=1429193458554

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:53 GMT

Content-Type: text/html;charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Set-Cookie: BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BIDUPSID=6483934B3F9915C4C4DEE385E7300A12; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BD_CK_SAM=1;path=/

Set-Cookie: BDSVRTM=7; path=/

Set-Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; path=/; domain=.baidu.com

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Cache-Control: private

CKPACKNUM: 2

CKRNDSTR: 90001dc81

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 3

BDQID: 0x8ec273590001dc81

BDUSERID: 0

Content-Encoding: gzip
56e3..............{.cGv'..>..l.2.H&..L.X.Ru..v..Z.n..TM\.....K|dV)E
`...v....cg..1......m....^...W.l....9q"nD....Z.`...".F..8q.....7....O~
.....v>{p..r..'.?.......\~p_.N.h...<.F..]...v.e....O...-..h..fq.
0\...b. >y..G..4.....W .ZK.....n.._mO....4Zo.mo....u.....*z.)...^P\
..x.....M....W.........._.........._../.3....................._}....w.
........T5.......Q.........f.b...z..f._.WI_J........l...5... ........s
4....h4J.....U.Z.v..z.,:..j.I..r.Y.3..2...E.*.m...ju.jO]....vT..j..~=.
...h..^w.u......9/-g...4KJ.Yi.-.F.i.:}.....%.m.g.Y,..>Y.v.k.dy.\..T
..`....((.......&...2X.G..J...x.2..<...o# K).O.UG..~;RS.....j.q...4
N&.m.v.`.s.!c_.#`....Z.G.. .)...r....X.xM]...6...Z=......U.z5.......L.
P...W....*Nt.n=....p_.....jM..eU..Zi..Tzf..S..a.5.l....*'.h.wv..1m....
.V..6[.|X..........a4.....t2[...)@..`#m......_.*.......:^...8".......V
..>kW .d|..4..v.Lv.b....W.x}.6J...j4...(.. ..v...%..,z.I..^..r..{..
..hV.f.d.a.R.....7.#......Ug..F.Bvsy.x.."...l..Ld.-k....2.l...6...1p.#
..v./.fU.3f. ....4.Gxa..0....JG..JG.%h..&...i.h.\nm.E.}e..,......5....
.z...Z&...=([email protected].....
Y.......=v.4.o...,.'3..^.'."..>._..5h..J.dTl....A.d.1v.., ..:.[.Q.(
..Gz.....^/.f.v..q.^.....O....k.;M.....WSP..f.......8.6.Ar...y9..~.._\
..v.(..C.4...]...'..q.,.l.Dvc..w......E...(.iQqg....g....4....}.o..,..
.T.......N....T..%E...(J.h.s4Z.UH.ZlI.He.q2..b..)C.F.....XG.(..GU.,f..
..X..k....Nt.G.!...Y...6X....`.p....5>..;.q.W.DS!.........'..'...^t
..w*....T..A|.C.=S.,.kd.Y.N....*c..3.G..v...R.o. ..BT...R..(....KG
<<< skipped >>>

GET /cache/fpid/o_0108.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&ch=&tn=baidu&bar=&wd=ÄϾ©»ªÑïÌ«Ã%

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.baidu.com

Connection: Keep-Alive

Cookie: H_PS_PSSID=11077_1427_13074_12825_13381_12867_13322_12692_13411_10562_12723_12735_13438_13086_13453_13325_13201_12835_13491_13162_8498; BAIDUID=6483934B3F9915C4C4DEE385E7300A12:FG=1; BIDUPSID=6483934B3F9915C4C4DEE385E7300A12; BD_CK_SAM=1; BD_HOME=0; BD_UPN=1121314151; ISSW=1; H_PS_BBANNER=1; H_PS_645EC=3c70RzuHf3OnguuWgstPA6+cKl7trAD7CLhsdbMb/ukLv2VuYggcyzNSbIA

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:49 GMT

Server: Apache

Last-Modified: Tue, 27 Jan 2015 06:20:22 GMT

ETag: "5f1-50d9c3feb5580"

Accept-Ranges: bytes

Cache-Control: max-age=315360000

Expires: Sun, 13 Apr 2025 14:10:49 GMT

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 1544

Connection: Keep-Alive

Content-Type: application/x-shockwave-flash
...............CWS.....x.}U.n.F......G.....FQ...e......JU....QQ/.E.-8"
G.c....l_.. ..7h.`.^.......}.....jlu.K@....|..9..j....0...G..c.LBh....
*......SZ.....F|.5..o.ZE..^..vJ}!..Z....z.Yu.^m}kk..n.66............R#
^. `[email protected]@e.5n....W[...&P..`m.......3......oL2.....u....6.
Z......5...G.l..........T.qSi#..6L!.),.h......?....M..!.N..G.....m..#.
9..7.)..r&.i...)......xc.U...<.C&x.%....."..i.M.z......C..n.f..S...
..W...FU.......S.|....V.6.A.O*.u.&.j.].....8.AF.'....t.....l._.-..q.k.
....l.........2..c[...n..G.M.. .5...._.....}...`k.C.......S.0..y....".
.<....1.Tw.#.S..=&....4..O=..-...3.&tFp.~.8.g.........f.....]S.TX.a
zC..&....F...."..l.... Gg...b.S!..gi....C.]...6w.L.^....&;.!p...,.>
>.Oh}...~&t.l$..o.,..c.......<......<....~Z.5#L;.g^....u...S.
k....[....Ur..}.u\r.O.1.F\.[.....D..=..C.`.J.u.i..vO..]0...... .k....'
....t..I..]N.16f..:.O.^k....3.T.IX..W.'...u.......'..".9..|..y.)..a.Q.
.s.L;..c.X:L?....1..#.H...<vL#..S\....w.4......5...V.."..<....sR
A*. .........=.,F?..._.7....h,.H.H.N.F1...X.$Bq....I.S..).Cq....Y..Pr.
..<.....)yHI...Q.D.O(Y..L.*%[email protected])....J>..3J.(.......%_P..d..|
I.]*.Qy..._..r...2....c$..~..9{...U..)..(.......^5r.G0..#.<$.P<.
O`$G....2B....o......H..>K_]...]v3.].l&..[9....uv..=....h.. .......
...).....5.|..,>9..N.^.I$...$y.!...`.f..|.I.........s..H$......te.]
..is.......o.......;.]ef..]t.n.l.]G....^..(.........Rm}...#DF.-....<
;..sc..X.^..?.VYL{P.l=..,4g.......r.........M9....wK....~....q...U>
...%....m?...Z$\..(,.....-...h?..#...C.\=......K...W..p},...z..=`.
<<< skipped >>>

POST /ClientAPI/flowtaskAPI.aspx HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible)

Host: flow3002.6299.cc

Content-Length: 327

Cache-Control: no-cache

parems=1D324DD136232748AEE70117BC7907152CAEB1A80ECED9C2B8D7009F8345C36730AD379D5D68E07A621D2F23DCF71A6E0FE18F5612E938E7F4D672C5EA006C5833C1ED508532AC014B123EAD16CC4A798EC9ADB57184EDBC7475DB7275C064883BA7817EA7E5840D27F92A61CB6ED28D2AFBF42935D897C3F3A56DC6CEFD654B293A60757F50D146EC6A3E2F8C3B845F823DA1DAD4A67919891041A6625577F3
HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 128

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 16 Apr 2015 14:10:17 GMT
D62863FAE68B8607704484A6A04125491C77642904F91F9D9403A3D6653CC634BD718A
92BB0F031A48F9B8942A7083006C6D6B1D918F78795FE9C19470E68ACFHTTP/1.1 200
 OK..Cache-Control: private..Content-Length: 128..Content-Type: text/h
tml; charset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.3
0319..X-Powered-By: ASP.NET..Date: Thu, 16 Apr 2015 14:10:17 GMT..D628
63FAE68B8607704484A6A04125491C77642904F91F9D9403A3D6653CC634BD718A92BB
0F031A48F9B8942A7083006C6D6B1D918F78795FE9C19470E68ACF....

POST /ClientAPI/flowtaskAPI.aspx HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible)

Host: flow3002.6299.cc

Content-Length: 167

Cache-Control: no-cache

parems=3B6D427D39170CE5008F14C41F3933E7777ED11BE4AC5DE49967D124D13CEF98EF810CC1EC1C4239C27CCA4BBE161DF1A4F24C5DCF9EADA34220123F0C9A51B4183C709F4C234C79F447E3000E375424
HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 96

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 16 Apr 2015 14:10:46 GMT
32A45B4F6626435761CCBF7971D304AB3076C5A18E5564FC35BC8069371D182A7DDA4F
0F0924FF9486B9213262CCB928HTTP/1.1 200 OK..Cache-Control: private..Con
tent-Length: 96..Content-Type: text/html; charset=utf-8..Server: Micro
soft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date
: Thu, 16 Apr 2015 14:10:46 GMT..32A45B4F6626435761CCBF7971D304AB3076C
5A18E5564FC35BC8069371D182A7DDA4F0F0924FF9486B9213262CCB928..

GET /base/jQuery/jquery-1.9.1.min.js HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y0.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:30 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1149.v0-mow ( h0-s3.v0-mow), ht h0-s3.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Tue, 12 Jan 2016 00:27:03 GMT

Age: 8171007

Content-Length: 32819

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Sat, 13 Apr 2013 02:11:16 GMT

Connection: keep-alive
............{{...7...."........o...v..q.[cg'-E..HPBL....RD....[kf0.Pq.
~.sNZ.....f......._..M...wg.?...vG.<8z2.........E...q...:z..GT.._.f
.....t.de.....uT..b.|.o6iv..._E..:.F.x...O..6..*?QUp....2U.4..6I.<.
T.%.E>....R1....4^..tIm...ZE.{5..3..<.....|4.3.D-.r.-o..]......4
[$....:Z...UUP_...........|....z.mF.r...f......Q..?..-3.0..F..^.F....l
.O........\..f.|1..t..NG2U.}tz.jxz.^G.o......./^\.>......#*........
../.../........|zp2{...N.3*....~.\../O'...g...g.;.~.M.Tx..,g.....).y..
w*@...i.^...]........2 ..n;.\.'..'/f....*.4:..oP...f..]Ul..2^.....V...
.....V.P.N....z......o3z.........aC..,.....K.\p...x......WiY%YR.v.*..^
.......<_oVI..a>*.xq....$8>....u%......n ..V?.Q.:..4....o.~.g
..Q...S_..Y.....G)..T.".......<......&...*..Z.t%[email protected].
h...X.*/. .H.....){4U.y...I`..&-.. y.....L.O....Lf..X<..1M.w.xD;;..
...3zgn...'S.....g.~3Jn.9-..... .....3..A..e#.....".-i.S..].9..3..=GE.
.,..R*.gs..j.M..0.._'.u......E.|.....K.Q'FY.H^..'.(.OK.\.-.T...8...Q..
..v||5J..Vq.}{.K2..K..z.R....o_..G..t.L....NF.W.}....."{.NLP|.T_......
..j..,P..q.Q..o..<.x...Q..t=..$nJ.%:S...,..N...*.......d.`....M...)
....T.7....|$...[......E..h.......`b.......iQ.w...-n>.=OIw..*......
..H...r.....h..V.Aj..&t..9M..is.j.t]~../...ik......l.p.....mT.=[E..7v.
...n./$...y=T.X.s...J......j.w.W.|.x..F..*..:....>K...d....f.......
...&...7./.2-..P......j.?X.p.....9u.Ae.0...D.....~f.......&...l6..3...
...i}.(.. m.Je.x...p5.:..d...gWz...G..@.*\.2/*..............>...g..
`...w....f.....\.D...#D...E.%.......G..s`K.*.WI...NI.......LeO...&
<<< skipped >>>

GET /commonpage/1130/F-RequireJS.min.js HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y0.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:34 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1149.v0-mow ( h0-s1064.v0-mow), ht h0-s1064.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Mon, 16 Nov 2015 08:43:18 GMT

Age: 13066036

Content-Length: 10772

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Sat, 30 Nov 2013 08:56:46 GMT

Connection: keep-alive
...........}{...u.....jJ...]S=.}H..b...6m>6.Y/...EM..."..Z.....H.(.
.. ..Vv. ..X. [..c#...YR.....;.>.Vw.!C......s.=..9.n..M.<.E.....
[email protected]!........8....H......skwow.......p...s.A^g..J
...3.:..p.vJQ..a...9O.ir6..D.T.......N&........,]..9...G..8.&.Y8.g...Y
]...B..y....PTh..n....7.......:..Y%.j.'C..9..k..N]M."r..b.;..".R...S8.
OI..gh.:.U..z6K.....yY.......\....x@..>>.=?..U... ..FL...[...#I.
.(.^..(J.3r..[.A...Q..(.<O..rP..*....K&T.{......0..G...?9.o...=O...
?P.......y.:..#x.i~.L.k..I.......Q.E..e....A2.z....=....A......j.NQ$W(
...pQ..H..O........I...yY....E8......N..S...t{...A...? D.b....|&..Z.u-
.Vw.z.m.g.]..$.GE>.. .....L..Si.2.....6.lo....=..u..N.9.f.t....4...
.............m..*0\Q.)S?[,...S./...\.#...]..n..OO...._/[email protected].
.4..(a...0.~.......3H....V...3....K.......w.....d&<W.w........0.-..
5.="w..-..o.;.r>M ..].......X.b.U3.Y.B./....>5..$R.....dj..M....
...]A..pR...r;..cICU..k...<?...T.q.d..^...q.%S.-.. m..Q..........z`
..|[email protected](*S.e.....aX...)W...B...........bRS.
;{.-n..8.".$...E..eP.I0... ...`..b.y....5....*..Y2.......c..{.....`..w
*o..\.b.U.S..:............7,[email protected]@W.k? ..i.n..9wO.........3
.p0....N.....".|l...G\>...Q...\._.grgz.|..%...q.X...uMe$.."/n..Z.&.
w{....)^..%~3,jq.S........F\..S..=t..U..TZ..`....2..IOI.%J..8.m.......
..P.S....9......lo..7..hj..x.0..F......n&./....4............D..i.7w*h.
..........9... ..b....l.]V\. ..'.\Z$U.<) ...C..?....$......v..Xc...
..8.....P.D~l...Z.".......jL\.=3IG.....5!lHAz.y.A.q.F..Y.#.}.U.\?.
<<< skipped >>>

GET /314bd925cdd17196/2014/1203/pc.css HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y0.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:34 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1149.v0-mow ( h0-s1090.v0-mow), ht h0-s1090.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Fri, 04 Mar 2016 00:07:56 GMT

Age: 3679358

Content-Length: 13049

Content-Type: text/css

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Wed, 03 Dec 2014 06:30:59 GMT

Connection: keep-alive
...........}k.c.u.w.......L..o....I3#.V........K..I.Mr..3="..`'.#...qv
7...6...be.H..e...3....:.....%.-.,!ib...V.:.:.:..`1z..M.4F...l.F..Yc1k
...I..D.I..$.I..d...h.....xZ.F..lL.....l.f......e.('.r.9.W'..Qp..G....
.uQ..Y..,V.b...f.|........z..U.....UO<..W.z....r..7.S..p1*....Q.6..
j1?..<.W..b^6...Yq4....cx....LJ.....l..M.U.yq|..('..8/..lz2?.......
 .....(..../....>`E..Q>...f.......W./.|.q.hy.1.........t}6o..i&g
t;kL........pV...:....b5......'...|ttm<....]...E....^.3.Ox...RhNB.G
....D.#j.&....IB...(gh._.....[9..b.X.b..<.G...>..[..b5.."...... 
H.N&.>....../$D.x.GY...a9}P..[b.yi.?....G...3./.^:.M..Y...6..Dv18F.
.Z..lZ>:.LG.b~|.......5........i>d...f7..<.1..F.._.J..#.a.V=Q
...j..y.Um.1'&.5..oE.&Q..#.!D.<.V....U!j..9.;R.fr^.W5!..5.b.s w....
. .T..wr.[.7W....UAP..%.e..vx.....#.d..3..a.TH....I..wtU...;...U....o5
....A....6r.[B._.t..u..3N....U.._1........R.bO....Xl.1<[.^......~..
..b~..Hk.8m.....2?).a.....v>......l.h..e..,`.$.."W<.)..Q..e.....
6..../..B..<..Dl]...F..]..7........Q9..Wl..&Y~V.4....M.e......r.GI.
.U1...:f.5......0../..k......B.......y)[email protected]&...}....4a.t.O...VX..
.......Y.X...@.=...!......CX..../..=1.. ...Qu........2#..j.=..?1..K...
..!..q.Zq......5u!. J.eq.O.*..:....!.s5.....n..\>..;....S.Iu...Nb.\
....K....x.dqV.!R..c)...'?._O..gO~......6x.>....|...~.]...)...p./7f
..Y ..&....n....-;...>Z...A.G.I.....Q..j{..@(V...<...dq5).f.1.o.
......G.....)cH.cz...2>v.....].v.G..r.........Z<.f..4.Yfr.......
.~.)..o..=.2.|....$l-....Y..g...&...p....U4....Z..r1.....n{.n...dg
<<< skipped >>>

GET /a/2015/0311/fa.min.js HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y0.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:34 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1149.v0-mow ( h0-s1131.v0-mow), ht h0-s1131.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Thu, 10 Mar 2016 07:04:01 GMT

Age: 3135993

Content-Length: 4640

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Wed, 11 Mar 2015 07:03:23 GMT

Connection: keep-alive
.............r...WthG!#....Q...q.;....}.u...S...E*.h;........(...Lonb.
X,.....L.$.<M..IwIr.:Bf<.$..Y...U.}.........8.xv|....<...=..x
~..h..q.....h4...?..._...xtAfR.F...t.o|>e........0.7A...t.Cr;.$.`.a
...'o.:..o..)...oC.........`...?............)../...;=.x.a...tD.'......
.?B.a....?....E..4..6....e..,..u.... V.O..U:p.(t.Z...0N#...,.2.s....3.
.0.y2a.'S..2!n...\.R..{y.......Cr.....b...C6f@_ .E.FL..]y7L..W...D.Kk.
f.......^..^.M..7.fA..b..i..(.0..a:_..K.c....4.....e....\..i..F1.U....
9........E%6.g..q......I...FH ..0.</.i...?~.C..G1...7..'...W...-...
.JX.....j.i..19.0..&.....[*..h...9n0/.......K..vA..LR.<..."F.....|!
.Y.?.u..3......Gc..)v..E.f.A.$=.V.<.>.$...E...t..........T...q.X
...q\./..S.8.OI.=....f'.p.5.........*J..).]!.-...|.....4x......?.iSz..
. ....d.~j..5..ZHX4W..j4BE..U.d.%...-..C.."[email protected].#......tNa...%..a
....?8....m........oa.KC0. ....,_,.L..`>jk...u....Z..R.P.8ip....DTQ
.....C&.........F...3.:.2..d....c6...E*8.....i.K.az;.W .......3x...8..
.6M3...q....O..]F.....7.. WOzY...`H*......dH:3.ofR}.@..[....../...yq.s
p....p.Mw............=.........}.J.b.. .;.2....Z....8W3w..|........pOz
)..`......&.!.76.f.......1z-P.X.\.....1K./w......t..(....W..~..[<.Z
.1<.U"..=......\.r.p..n.a.k.}q. ..3.L..9I.H...>...g....{[email protected]
.WN.!....b},BR............).2 ....f<.. ...S......B...3.......&.q...
..5......:.......]...z.B.&DX\..K.*C..\......H(K...z.j.R..\.g..y.1X.K&%
....zS.a..][email protected].......<.. .3.....|U6.6...........G......2....
.M...nr.M..5....A.3............ ........_....x....P..Y.kY&.g.....#
<<< skipped >>>

GET /commonpage/1129/v1/all.png HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y0.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:34 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1149.v0-mow ( h0-s1117.v0-mow), ht h0-s1117.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Tue, 12 Jan 2016 00:28:55 GMT

Age: 8170899

Content-Length: 11624

Content-Type: image/png

Last-Modified: Fri, 29 Nov 2013 07:36:01 GMT

Connection: keep-alive
.PNG........IHDR...U.................tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:C2B1CA99C758E311B5A0B81393D8CDF0" xmpMM:DocumentID="xmp.did:ABBD
44B558C711E3AF53EF931EB2F571" xmpMM:InstanceID="xmp.iid:ABBD44B458C711
E3AF53EF931EB2F571" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C2B1CA99C758E311B5A0B8
1393D8CDF0" stRef:documentID="xmp.did:C2B1CA99C758E311B5A0B81393D8CDF0
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>Iv.Q....PLTE........"....U].tz....>J....%5.(
=..................Vr.... R....Z......]...........6X....Jr&........*..
..........w...."..... [email protected].........
.. ..\...........................................................[Q&..
*.....f...........E..................d``... **........................
..................................................................fff.
..........tRNS........................................................
..................................................................
<<< skipped >>>

GET /base/origin/F-amd-1.2.0.min.js HTTP/1.1

Accept: */*

Referer: hXXp://fashion.ifeng.com/a/20150405/40098172_1.shtml

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; 360SE)

Host: y0.ifengimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 16 Apr 2015 14:10:37 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1149.v0-mow ( h0-s1088.v0-mow), ht h0-s1088.v0-mow.cdngp.net

Cache-Control: max-age=31536000

Expires: Wed, 09 Dec 2015 08:51:39 GMT