Trojan.Win32.FlyStudio_a28ce11b45

by malwarelabrobot on June 27th, 2014 in Malware Descriptions.

Gen:Variant.Symmi.25253 (B) (Emsisoft), Gen:Variant.Symmi.25253 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.IEDummy.FD, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: a28ce11b458b294086621deece330871
SHA1: 35a998033e84d0411d53c0d5d83ff054396243f9
SHA256: db72fa663811194373fc852b98c144894d37d523c62f5ff7cd288311c70588d9
SSDeep: 12288:imizRxd7wx G6krpWH32gjGeAdzwNK9GMxNY62EKoOOZxnkPsct:ipnd7OzJr8mgj7Adz6KcMDFPf49
Size: 477851 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MEW11SEv12, MEW11SEv11, UPolyXv05_v6, Mew11SEv12Eng
Company: firseria s.l.
Created at: 1970-01-01 03:00:00
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:856

Mutexes

The following mutexes were created/opened:

{1B655094-FE2A-433c-A877-FF9793445069}
__DDrawCheckExclMode__
__DDrawExclMode__
DDrawWindowListMutex
DDrawDriverObjectListMutex
CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex
¹Ù·þ
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
RasPbFile
ShimCacheMutex

File activity

The process %original file name%.exe:856 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\close[1].png (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\27IFKA1Y\6[1].htm (13145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\promimg[1] (1636 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\27IFKA1Y\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\bd5463690a93c57a1039c47e11ab0f97[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\1013v1403682187455450221[1].jpg (3568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WGXTV0YZ\firstpay[1].jpg (1842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\pixel[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\base_MIN_11.12[1].css (3277 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\1013v1403362989752327021[1].jpg (392 bytes)
%System%\drivers\etc\hosts (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WGXTV0YZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\AClick[1].aspx (744 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WGXTV0YZ\logo[2].png (826 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\1013v1402152081287210157[1].jpg (5073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\spacegif[1].gif (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WGXTV0YZ\CAG0BO5N.htm (2713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\logo[1].jpg (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (203 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (464 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\base_MIN_11.12[2].css (4429 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\b744ef7cf7616402b9cd75cd3b296755[1].jpg (3694 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\1013v1395126094590286213[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\2013.11.261[1].gif (3825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\stat[1].php (4285 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\promimg[1].htm (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\27IFKA1Y\6[1] (15358 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\a7e7de85243a438ba91ea4d3d8a017b2[1].jpg (612 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (249 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5056 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\1013v1402565661143534317[1].jpg (1591 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (149 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WGXTV0YZ\logo[1].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\base_MIN_11.12[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\bd5463690a93c57a1039c47e11ab0f97[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\27IFKA1Y\stat[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\promimg[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\AClick[1].aspx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\a7e7de85243a438ba91ea4d3d8a017b2[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\27IFKA1Y\2013.11.261[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\27IFKA1Y\6[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\close[1].png (0 bytes)

Registry activity

The process %original file name%.exe:856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 B3 08 4E 59 00 2E 49 6D F4 4D D5 51 30 92 F1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\MediaPlayer\Health\{DF737862-48FE-4800-B29B-C21EAB0406B6}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 1248 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1 www.cfyuanji.com
127.0.0.1 www.cfyuanji.net
127.0.0.1 www.cfyuanji.cc
127.0.0.1 cfyuanji.com
127.0.0.1 cfyuanji.net
127.0.0.1 cfyuanji.cc
127.0.0.1 www.cfyalan.com
127.0.0.1 www.cfyalan.net
127.0.0.1 www.cfyalan.cc
127.0.0.1 yy.cfyalan.com
127.0.0.1 cc.cfyalan.com
127.0.0.1 cfyalan.com
127.0.0.1 cfyalan.net
127.0.0.1 cfyalan.cc
127.0.0.1 www.cftianyue.com
127.0.0.1 www.cftianyue.net
127.0.0.1 www.cftianyue.cc
127.0.0.1 cftianyue.com
127.0.0.1 cftianyue.net


Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
MEW 4096 1806336 0 0 d41d8cd98f00b204e9800998ecf8427e
 1810432 536576 477339 5.30992 a24e4d9d8956ba3d28b026305a09949f

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://foshan.zcxsf.com/
hxxp://foshan.zcxsf.com/index.html
hxxp://c.myzwqwe12.com/AShow.aspx?AID=9842 115.236.16.240
hxxp://c.myzwqwe12.com/AP5Min.aspx?AID=9842&TID=1974&Auth=1D705CD055EE5F1DA0B198994432BDDABFD05BDEC4C1B2DBD592146C65F203BE&referer=http://www.cfmogu.com/&utz=1403774656442 115.236.16.240
hxxp://foshan.zcxsf.com/0.htm
hxxp://q1.xdwscache.glb0.lxdns.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
hxxp://c.myzwqwe12.com/AP5Min.aspx?AID=9842&TID=505&Auth=1D705CD055EE5F1DA0B198994432BDDA9802E06B2D9FD0B1A4732DC48A795461&referer=http://www.cfmogu.com/&utz=1403774659708 115.236.16.240
hxxp://c.myzwqwe12.com/AShow.aspx?AID=9756 115.236.16.240
hxxp://c.myzwqwe12.com/AP5Min.aspx?AID=9842&TID=1960&Auth=1D705CD055EE5F1DA0B198994432BDDA3917ED5FBEB46EB462D92AC5B17DDEC6&referer=http://www.cfmogu.com/&utz=1403774660520 115.236.16.240
hxxp://foshan.zcxsf.com/Ä¢¹½Í¼Æ¬.gif
hxxp://c.myzwqwe12.com/pic/spacegif.gif 115.236.16.240
hxxp://c.myzwqwe12.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A60AAB6420FBCFD38A7F6627464F0F92ABDBDDFF92A5BAD7034&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393 115.236.16.240
hxxp://c.myzwqwe12.com/AP5Min.aspx?AID=9842&TID=1961&Auth=1D705CD055EE5F1DA0B198994432BDDA01EC416CFBC47FB8F19D49E35E521FAA&referer=http://www.cfmogu.com/&utz=1403774663192 115.236.16.240
hxxp://www.you1ad.com/tuigoo/1.html?uid=14516 123.134.186.159
hxxp://c.myzwqwe12.com/pic/close.png 115.236.16.240
hxxp://c.myzwqwe12.com/AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F4733086193DA6C7674EE3CE64247F7ACDE395F580416FB00BA92BF05A&Url=&referer=http://www.cfmogu.com/ 115.236.16.240
hxxp://c.myzwqwe12.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A60AAB6420FBCFD38A74E8F7A85C55E29907E532FC72AB49DAD&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393 115.236.16.240
hxxp://c.split.cnzz.com/stat.php?id=4693566&show=pic1
hxxp://c.myzwqwe12.com/pic/logo.png 115.236.16.240
hxxp://js.union001.com/PClick.aspx?AID=15235&KEY=6FBCE2FEBE3F1F4B34035BDB1B9868C2CC3F7B0F77DABDE2 115.238.73.171
hxxp://c.myzwqwe12.com/AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F4733086193DA6C7674EE3CE649E52CE4FD2CE9468122DFDCEF870293E&Url=&referer=http://www.cfmogu.com/ 115.236.16.240
hxxp://www.gm2468.com/68503.html?sid=10352 219.129.239.210
hxxp://z10.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=none&cnzz_eid=2026431406-1403774660-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=296133721
hxxp://c.split.cnzz.com/core.php?web_id=4693566&show=pic1&t=z
hxxp://115.236.19.58/xm/2013.11.261.gif
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=690083581
hxxp://icon.cnzz.com/img/pic1.gif 42.156.162.7
hxxp://pcookie.split.cnzz.com/app.gif?&cna=x9QyDBpdXF0CAcGK9OfjJSLK
hxxp://c.myzwqwe12.com/AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F4733086193DA6C7674EE3CE642079A95560F77388AFBC377673F7783E&Url=&referer=http://www.cfmogu.com/ 115.236.16.240
hxxp://www.you1ad.com/swfd/54/58/2629/index.swf 123.134.186.159
hxxp://c.myzwqwe12.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A60AAB6420FBCFD38A72810AD5C0AACB2F7E40D2EC3F9721B69&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393 115.236.16.240
hxxp://www.you1ad.com/swfd/54/58/2629/btn.gif 123.134.186.159
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=569172903
hxxp://z10.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=1403774660&cnzz_eid=2026431406-1403774660-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1211086617
hxxp://c.myzwqwe12.com/AP5Min.aspx?AID=9842&TID=667&Auth=1D705CD055EE5F1DA0B198994432BDDA07BB81A80E94952E8948A87D08F39E23&referer=http://www.cfmogu.com/&utz=1403774671270 115.236.16.240
hxxp://clc.gmhuowan.com/aa.php?cid=68503&sid=10352&ref= 59.34.148.194
hxxp://www.you1ad.com/swfd/54/58/2629/bg.swf 123.134.186.159
hxxp://q1.xdwscache.glb0.lxdns.com/lw/css/login/login_140618.css?v=2
hxxp://q1.xdwscache.glb0.lxdns.com/jquery/jquery-1.4.4.min.js?v=1
hxxp://myconf6room.dtwscache.glb0.lxdns.com/?src=tuiga834
hxxp://www.you1ad.com/swfd/54/58/2629/sp.swf 123.134.186.159
hxxp://myconf6room.dtwscache.glb0.lxdns.com/event/promimg/?src=pming393
hxxp://www.you1ad.com/swfd/54/58/2629/ren.swf 123.134.186.159
hxxp://oall.s1.cdndns.4399hhh.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p=
hxxp://flight.qunar.com/?ex_track=auto_52283dc6 59.151.61.62
hxxp://morecache.xdwscache.glb0.lxdns.com/qdlm.html?uid=14516
hxxp://morecache.xdwscache.glb0.lxdns.com/swfd/bd/4c/chuanqi86/index.swf
hxxp://www.you1ad.com/swfd/54/58/2629/ren01.swf 123.134.186.159
hxxp://morecache.xdwscache.glb0.lxdns.com/swfd/bd/4c/chuanqi86/reg_btn.gif
hxxp://www.you1ad.com/swfd/54/58/2629/ren02.swf 123.134.186.159
hxxp://txt.unionli.com/txlink.php?alid=40782&oid=7893&game=qs
hxxp://t.qunar.com/count/headerImage 211.151.112.25
hxxp://www.you1ad.com/swfd/54/58/2629/ren03.swf 123.134.186.159
hxxp://oall.s1.cdndns.4399hhh.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&p=
hxxp://qunarzz.com/flight/prd/styles/home-2014062503273402.css 59.151.16.173
hxxp://uimg.unionli.com/jsorigin/AC_RunActiveContent.js
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=312679588
hxxp://z10.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=1403774661&cnzz_eid=2026431406-1403774660-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1873693337
hxxp://myconf6room.dtwscache.glb0.lxdns.com/css/base_MIN_11.12.css
hxxp://cc00013.h.cnc.lxsvc.cn/imges/live2013/logo.jpg
hxxp://cc00013.h.cnc.lxsvc.cn/imges/pixel.gif
hxxp://counter.ztgame.com.ztinfoga.com/ref.php?ref=2343627&return_url=http://xx.ztgame.com/index_gc_ad7.html?ad=2343627 101.226.182.61
hxxp://cc00013.h.cnc.lxsvc.cn/live/2014/06/25/15/1013v1403682187455450221.jpg
hxxp://cc00013.h.cnc.lxsvc.cn/live/63/67/b744ef7cf7616402b9cd75cd3b296755.jpg
hxxp://cc00013.h.cnc.lxsvc.cn/live/2014/06/21/23/1013v1403362989752327021.jpg
hxxp://cc00013.h.cnc.lxsvc.cn/imges/live/index/firstpay.jpg
hxxp://cc00013.h.cnc.lxsvc.cn/live/08/80/a7e7de85243a438ba91ea4d3d8a017b2.jpg
hxxp://cc00013.h.cnc.lxsvc.cn/live/2014/06/12/17/1013v1402565661143534317.jpg
hxxp://www.you1ad.com/swfd/54/58/2629/ren04.swf 123.134.186.159
hxxp://cc00013.h.cnc.lxsvc.cn/live/2014/06/07/22/1013v1402152081287210157.jpg
hxxp://cc00013.h.cnc.lxsvc.cn/live/2014/03/18/15/1013v1395126094590286213.jpg
hxxp://cc00013.h.cnc.lxsvc.cn/live/33/84/bd5463690a93c57a1039c47e11ab0f97.jpg
hxxp://cc00013.h.cnc.lxsvc.cn/imges/live2013/idx_share_mood_v1.jpg
hxxp://www.you1ad.com/swfd/54/58/2629/logo.swf 123.134.186.159
hxxp://wpa.qq.com/pa?p=1:1305643224:17 112.90.83.87
hxxp://wpa.qq.com/pa?p=1:494666586:17 112.90.83.87
hxxp://myconf6room.dtwscache.glb0.lxdns.com/js/LAB_0.1.js
hxxp://www.you1ad.com/swfd/54/58/2629/sound.swf 123.134.186.159
hxxp://myconf6room.dtwscache.glb0.lxdns.com/css/level_MIN_12.08.css
hxxp://cc00013.h.cnc.lxsvc.cn/live/69/59/eca1e2f901a17103ab05f7b46c358f6e.jpg
hxxp://www.you1ad.com/swfd/54/58/2629/reg.swf 123.134.186.159
hxxp://t.qunar.com/count/counts?t=1403774677630 211.151.112.25
hxxp://qunarzz.com/js/jquery/build/jquery-1.5.2.min.js 59.151.16.173
hxxp://www.you1ad.com/tuigoo/1.html.2.js?uid=14516&tid=1 123.134.186.159
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/flight_v1/bg_bao.png
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/home/hurryup.gif
hxxp://flight.qunar.com/twell/cookie/allocateCookie.jsp 59.151.61.62
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/flight_v1/postmk_wf.png
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/home/bg_bd_rex.jpg
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/home/bg_bd.jpg
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/home/bg_tabsel.png
hxxp://q1.xdwscache.glb0.lxdns.com/js/request.js
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/zhuanti/huodong/header0625.jpg
hxxp://simg1.qunarzz.ccgslb.com.cn/common/hf/header_v12.png
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/flight_v1/postmk_dc.png
hxxp://simg1.qunarzz.ccgslb.com.cn/common/hf/footer_v10.png
hxxp://simg1.qunarzz.ccgslb.com.cn/common/hf/arc.png
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/flight_search/bg_sephuan.png
hxxp://qunarzz.com/flight/prd/scripts/oneway_index_config-2014062503273402.js 59.151.16.173
hxxp://simg1.qunarzz.ccgslb.com.cn/common/hf/24h.png
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/2011/QN1CS1.gif
hxxp://qunarzz.com/flight/prd/scripts/home_pack-2014062503273402.js 59.151.16.173
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/flight_search/qn1cs1_disable.gif
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/home/ico_la_ie6.png
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/home/ico_la_yy_ie6.png
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/flight_v1/ico_arrsel.png
hxxp://www.huowan.com/js/reg_gg_rpc_nope.js 113.107.160.136
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/flight_search/btn_normal.png
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/flight_search/ico_a.png
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/home/img_qnkhd.png
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/new_main/tb.bg.gif
hxxp://oall.s1.cdndns.4399hhh.com/tpl/hw_ddsb0618/main.swf
hxxp://oall.s1.cdndns.4399hhh.com/tpl/hw_ddsb0618/an.gif
hxxp://ws.qunar.com/ips.jcp?callback=QNR.ips.callback&_=1403774681817 59.151.16.186
hxxp://ws.qunar.com/lowerPrice.jcp?&callback=DomesticLowPriceHome.showLowPrice 59.151.16.186
hxxp://flight.qunar.com/site/timetrack.htm?action=FH|domload|4.782&t=1403792673782 59.151.61.62
hxxp://ws.qunar.com/js/ga.min.js 59.151.16.186
hxxp://c.split.cnzz.com/stat.php?id=1360447&web_id=1360447
hxxp://ws.qunar.com/airCoPromote.jsp?airCoList=CA,SC,CZ&num=5&callback=AirLineDeals._parseData 59.151.16.186
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=flight_float_layer 59.151.61.62
hxxp://ws.qunar.com/history/newhistory.html 59.151.16.186
hxxp://flight.qunar.com/site/timetrack.htm?action=FH|search|4.969&t=1403792673969 59.151.61.62
hxxp://flight.qunar.com/site/main.swf?20090107 59.151.61.62
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=homeadSy 59.151.61.62
hxxp://a.qunar.com/vataplan?framId=topicLinkR&f=s&cur_page_num=0&rep=1&tag=99&vataposition=QNR_Zjc=_CN&vatacon=&rows=1&qtype=js&vataframe=bannerDefault&callback=QNR._AD.topicLinkR&ab=b&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://a.qunar.com/vataplan?framId=topicLinkL&f=s&cur_page_num=0&rep=1&tag=99&vataposition=QNR_ZTc=_CN&vatacon=&rows=1&qtype=js&vataframe=bannerDefault&callback=QNR._AD.topicLinkL&ab=b&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://ws.qunar.com/f?utmwv=0.1&t=0.39666333071942056&utmsr=1276*818&utmr=-1&utmp=http://flight.qunar.com/?ex_track=auto_52283dc6&utmhn=flight.qunar.com&s=249 59.151.16.186
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/airlines/CA.gif
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/airlines/CZ.gif
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=flight_active_dynamic 59.151.61.62
hxxp://c.split.cnzz.com/core.php?web_id=1360447&t=z
hxxp://ws.qunar.com/lpisearchd?callback=jQuery15208817795147039577_1403774679880&from=&to=Hot&month=All&cachefrom=&cacheto=&type=ow&source=fhome&_=1403774683911 59.151.16.186
hxxp://ws.qunar.com/lpisearchd?callback=jQuery15208817795147039577_1403774679881&from=&to=Hot&month=All&cachefrom=&cacheto=&type=rt&source=fhome&_=1403774683926 59.151.16.186
hxxp://a.qunar.com/vataplan?framId=ifmRightTextlink&vataposition=QNR_OA==_CN&tag=99&rows=14&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightTextlink&ab=b&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://a.qunar.com/vataplan?framId=ifmRightFlightOwner&vataposition=QNR_ZTU=_CN&tag=99&rows=1&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightFlightOwner&ab=b&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://z11.cnzz.com/stat.htm?id=1360447&r=http://www.gm2468.com/68503.html?sid=10352&lg=en-us&ntime=none&cnzz_eid=1627145524-1403774678-http://www.gm2468.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1353530233
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/airlines/SC.gif
hxxp://txt.unionli.com/_reg.php?tpl=1403085104&game=qs&dirtype=0
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/flight/home/ico_arr_ad.png
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=couplet_load 59.151.61.62
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_middle 59.151.61.62
hxxp://a.qunar.com/js.ng/framId=homeadSy&chan=flight&pg=home&pos=right_top&site=qunar&size=230x200&type=Tear_angle&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://a.qunar.com/vataplan?framId=ifmRightFlightExt&vataposition=QNR_NmE=_CN&tag=99&rows=1&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightFlightExt&ab=b&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://a.qunar.com/js.ng/framId=flight_active_dynamic&chan=flight&pg=home&site=qunar&type=dynamic_skinned&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_bottom 59.151.61.62
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top 59.151.61.62
hxxp://a.qunar.com/js.ng/framId=flight_float_layer&chan=flight&pg=home&pos=top&site=qunar&type=floating_layer&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://simg1.qunarzz.ccgslb.com.cn/imgs/201103/29/66Iba26Dsd1_IiKO6720.jpg
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top2 59.151.61.62
hxxp://a.qunar.com/js.ng/framId=couplet_load&chan=flight&pg=home&pos=right&site=qunar&size=120x300&type=couplet&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkL 59.151.61.62
hxxp://q1.xdwscache.glb0.lxdns.com/lw/js/sign_v3.js?v=1
hxxp://a.qunar.com/js.ng/framId=ad_home_leftAD_middle&chan=flight&pg=home&pos=top&site=qunar&size=728x90&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkR 59.151.61.62
hxxp://a.qunar.com/js.ng/framId=ad_home_leftAD_bottom&chan=flight&pg=home&pos=mid&site=qunar&size=728x90&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://flight.qunar.com/suggest/livesearch2.jsp?lang=zh&q=北京&sa=true&callback=top.XQS_1403774683926 59.151.61.62
hxxp://oall.s1.cdndns.4399hhh.com/tpl/hw_ddsb0618/bg.swf
hxxp://a.qunar.com/js.ng/framId=ad_home_rightAD_top&chan=flight&pg=home&pos=top&site=qunar&size=230x200&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://ws.qunar.com/crossdomain.xml 59.151.16.186
hxxp://a.qunar.com/js.ng/framId=ad_home_rightAD_top2&chan=flight&pg=home&pos=top&site=qunar&size=230x90&tile=14037746817393432272&city=北京 211.151.112.112
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/wns/20140625_red_4869_728x90.jpg
hxxp://q1.xdwscache.glb0.lxdns.com/lw/images/login/login140618/top_02.jpg?v=1
hxxp://oall.s1.cdndns.4399hhh.com/tpl/hw_ddsb0618/js.swf
hxxp://simg1.qunarzz.ccgslb.com.cn/site/images/wns/20140619_flighthp_tbut_230x200_4031.swf?clickTag=http://qde.qunar.com/event.ng/Type=click%26FlightID=114287%26AdID=209121%26TargetID=5800%26Segments=13,28,50,132,142,148,373,530,534,535,536,539,540,541,542,543,544,545,546,548,549,550,551,552,553,554,555,556,558,559,560,562,563,564,565,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586,587,610,611,621,651,844,978,1102,1143,1183,2587,3780,4054,4380,4493,4525,4548,4553,4605,4636,4648,4649,4650%26Targets=5302,29,208,1504,6877,7731,7675,6419,7678,5800%26Values=34,46,51,63,77,84,100,110,150,204,219,228,243,250,252,269,301,305,320,5402%26RawValues=%26Redirect=http://adclk.thinkmedia.cn/clk/pid=2468/media=quna/place=73gjp3/size=230x200
hxxp://ws.qunar.com/holidayService.jcp?count=2 59.151.16.186
hxxp://q1.xdwscache.glb0.lxdns.com/lw/images/login/login140618/top_03.jpg?v=1
hxxp://txt.unionli.com/_regload.php?tpl=1403085104&game=qs&dirtype=0
hxxp://ad.thinkmedia.cn/htracker/pid=2468/media=quna/place=73gjp3/size=230x200 211.103.199.107
hxxp://xnop012.tlgslb.com/qs/201406/04/a19b826ff7e2033f6886324a.jpg
hxxp://q1.xdwscache.glb0.lxdns.com/lw/images/login/login140618/top_01.jpg?v=1
hxxp://q1.xdwscache.glb0.lxdns.com/lw/images/login/login140616/body.jpg?v=1
hxxp://oall.s1.cdndns.4399hhh.com/tpl/hw_ddsb0618/top.swf
hxxp://oall.s1.cdndns.4399hhh.com/tpl/hw_ddsb0618/tc.swf
hxxp://q1.xdwscache.glb0.lxdns.com/lw/js/server.js?v=1
hxxp://oall.s1.cdndns.4399hhh.com/tpl/hw_ddsb0618/mu.swf
hxxp://xnop012.tlgslb.com/qs/201405/28/f307f21d8092f1d86886324a.jpg
hxxp://xnop012.tlgslb.com/qs/201406/25/abff041c31dd85546886324a.jpg
hxxp://q1.xdwscache.glb0.lxdns.com/lw/images/login/login140616/tab.jpg?v=1
hxxp://q1.xdwscache.glb0.lxdns.com/lw/images/login/login140618/right.jpg?v=1
hxxp://xnop012.tlgslb.com/qs/201405/08/f1f51d8b645559506886324a.png
hxxp://xnop012.tlgslb.com/qs/201404/25/f1f51d8b645559506886324a.png
hxxp://c.myzwqwe12.com/AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1DA0B198994432BDDA01EC416CFBC47FB8F19D49E35E521FAA&referer=http://www.cfmogu.com/&utz=1403774663192 115.236.16.240
hxxp://xnop012.tlgslb.com/qs/201406/16/69042343885abe176886324a.jpg
hxxp://flight.qunar.com/site/timetrack.htm?action=FH|load|17.688&t=1403792686688 59.151.61.62
hxxp://q1.xdwscache.glb0.lxdns.com/lw/images/login/login140616/1.jpg?v=1
hxxp://q1.xdwscache.glb0.lxdns.com/lw/images/login/login140616/title.jpg?v=1
hxxp://q1.xdwscache.glb0.lxdns.com/lw/images/login/login131009/iconk.gif?v=1
hxxp://c01.i05.arnic.hadns.net/ad.html?cid=1012706&sid=14516
hxxp://xnop006.tlgslb.com/index_gc_ad7.html?ad=2343627
hxxp://c01.i05.arnic.hadns.net/public/js/jquery-1.7.1.min.js
hxxp://xnop006.tlgslb.com/images/v8/s_index/banner/3.jpg
hxxp://xnop006.tlgslb.com/images/v8/s_index/banner/1.jpg
hxxp://xnop006.tlgslb.com/images/v8/s_index/banner/2.jpg
hxxp://c01.i05.arnic.hadns.net/public/js/inc.js?555
hxxp://c01.i05.arnic.hadns.net/public/js/cookie.js
hxxp://xnop006.tlgslb.com/images/v8/s_index/banner/4.jpg
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&TID=1961&Auth=1D705CD055EE5F1DA0B198994432BDDA01EC416CFBC47FB8F19D49E35E521FAA&referer=http://www.cfmogu.com/&utz=1403774663192 115.236.16.240
hxxp://www.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p= 116.10.187.15
hxxp://img1.qunarzz.com/qs/201405/28/f307f21d8092f1d86886324a.jpg 116.10.187.203
hxxp://c.cnzz.com/core.php?web_id=1360447&t=z 42.120.219.6
hxxp://simg1.qunarzz.com/site/images/flight/home/ico_la_yy_ie6.png 119.254.26.35
hxxp://css.res.szgla.com/lw/css/login/login_140618.css?v=2 220.162.97.209
hxxp://www.qunar.com/suggest/livesearch2.jsp?lang=zh&q=北京&sa=true&callback=top.XQS_1403774683926 59.151.61.61
hxxp://img1.res.szgla.com/lw/images/login/login140618/top_03.jpg?v=1 117.27.241.117
hxxp://vi1.6rooms.com/live/08/80/a7e7de85243a438ba91ea4d3d8a017b2.jpg 103.224.232.67
hxxp://www.gm3579.com/tpl/hw_ddsb0618/main.swf 116.10.187.15
hxxp://www.gm3579.com/tpl/hw_ddsb0618/tc.swf 116.10.187.15
hxxp://simg1.qunarzz.com/site/images/flight/flight_v1/postmk_dc.png 119.254.26.35
hxxp://vr0.6.cn/imges/pixel.gif 221.204.21.34
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkR 59.151.61.61
hxxp://img.res.szgla.com/lw/images/login/login140616/title.jpg?v=1 125.78.240.189
hxxp://qde.qunar.com/js.ng/framId=ad_home_rightAD_top2&chan=flight&pg=home&pos=top&site=qunar&size=230x90&tile=14037746817393432272&city=北京 211.151.112.111
hxxp://www.cfmogu.com/ 121.12.125.78
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=homeadSy 59.151.61.61
hxxp://xx.ztgame.com/images/v8/s_index/banner/3.jpg 122.228.251.70
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&TID=505&Auth=1D705CD055EE5F1DA0B198994432BDDA9802E06B2D9FD0B1A4732DC48A795461&referer=http://www.cfmogu.com/&utz=1403774659708 115.236.16.240
hxxp://simg1.qunarzz.com/site/images/2011/QN1CS1.gif 119.254.26.35
hxxp://simg1.qunarzz.com/site/images/flight/home/ico_arr_ad.png 119.254.26.35
hxxp://vi2.6rooms.com/live/2014/03/18/15/1013v1395126094590286213.jpg 103.224.232.73
hxxp://simg4.qunarzz.com/site/images/zhuanti/huodong/header0625.jpg 119.254.26.35
hxxp://img1.res.szgla.com/lw/images/login/login140618/top_02.jpg?v=1 117.27.241.117
hxxp://t.tudou58.com/qdlm.html?uid=14516 8.37.231.19
hxxp://vi5.6rooms.com/live/33/84/bd5463690a93c57a1039c47e11ab0f97.jpg 110.249.215.42
hxxp://img1.res.szgla.com/lw/images/login/login140618/top_01.jpg?v=1 117.27.241.117
hxxp://www.gm3579.com/tpl/hw_ddsb0618/bg.swf 116.10.187.15
hxxp://simg4.qunarzz.com/common/hf/arc.png 119.254.26.35
hxxp://simg1.qunarzz.com/site/images/flight/flight_v1/bg_bao.png 119.254.26.35
hxxp://t.tudou58.com/swfd/bd/4c/chuanqi86/index.swf 8.37.231.19
hxxp://img.34wan.com/ad.html?cid=1012706&sid=14516 101.226.200.132
hxxp://img.34wan.com/public/js/jquery-1.7.1.min.js 101.226.200.132
hxxp://source.qunar.com/site/images/wns/20140619_flighthp_tbut_230x200_4031.swf?clickTag=http://qde.qunar.com/event.ng/Type=click%26FlightID=114287%26AdID=209121%26TargetID=5800%26Segments=13,28,50,132,142,148,373,530,534,535,536,539,540,541,542,543,544,545,546,548,549,550,551,552,553,554,555,556,558,559,560,562,563,564,565,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586,587,610,611,621,651,844,978,1102,1143,1183,2587,3780,4054,4380,4493,4525,4548,4553,4605,4636,4648,4649,4650%26Targets=5302,29,208,1504,6877,7731,7675,6419,7678,5800%26Values=34,46,51,63,77,84,100,110,150,204,219,228,243,250,252,269,301,305,320,5402%26RawValues=%26Redirect=http://adclk.thinkmedia.cn/clk/pid=2468/media=quna/place=73gjp3/size=230x200 119.254.26.36
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&TID=1960&Auth=1D705CD055EE5F1DA0B198994432BDDA3917ED5FBEB46EB462D92AC5B17DDEC6&referer=http://www.cfmogu.com/&utz=1403774660520 115.236.16.240
hxxp://img1.res.szgla.com/lw/images/login/login140616/body.jpg?v=1 117.27.241.117
hxxp://source.qunar.com/site/images/wns/20140625_red_4869_728x90.jpg 119.254.26.36
hxxp://simg1.qunarzz.com/site/images/flight/home/bg_bd.jpg 119.254.26.35
hxxp://history.qunar.com/history/newhistory.html 59.151.16.186
hxxp://p.tuigoo.com/pic/close.png 115.236.16.240
hxxp://simg1.qunarzz.com/site/images/airlines/CA.gif 119.254.26.35
hxxp://simg1.qunarzz.com/site/images/flight/home/hurryup.gif 119.254.26.35
hxxp://qde.qunar.com/js.ng/framId=ad_home_leftAD_bottom&chan=flight&pg=home&pos=mid&site=qunar&size=728x90&tile=14037746817393432272&city=北京 211.151.112.111
hxxp://uimg.xiaoangel.com/jsorigin/AC_RunActiveContent.js 115.238.101.99
hxxp://img1.qunarzz.com/qs/201406/04/a19b826ff7e2033f6886324a.jpg 116.10.187.203
hxxp://www.gm3579.com/tpl/hw_ddsb0618/top.swf 116.10.187.15
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&TID=667&Auth=1D705CD055EE5F1DA0B198994432BDDA07BB81A80E94952E8948A87D08F39E23&referer=http://www.cfmogu.com/&utz=1403774671270 115.236.16.240
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&TID=1974&Auth=1D705CD055EE5F1DA0B198994432BDDABFD05BDEC4C1B2DBD592146C65F203BE&referer=http://www.cfmogu.com/&utz=1403774656442 115.236.16.240
hxxp://hzs9.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=none&cnzz_eid=2026431406-1403774660-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=296133721 42.156.140.23
hxxp://img.res.szgla.com/lw/images/login/login140616/tab.jpg?v=1 125.78.240.189
hxxp://img.34wan.com/public/js/inc.js?555 101.226.200.132
hxxp://qde.qunar.com/js.ng/framId=homeadSy&chan=flight&pg=home&pos=right_top&site=qunar&size=230x200&type=Tear_angle&tile=14037746817393432272&city=北京 211.151.112.111
hxxp://userimg.qunar.com/imgs/201103/29/66Iba26Dsd1_IiKO6720.jpg 119.254.26.36
hxxp://css.res.szgla.com/lw/js/sign_v3.js?v=1 220.162.97.209
hxxp://qde.qunar.com/js.ng/framId=couplet_load&chan=flight&pg=home&pos=right&site=qunar&size=120x300&type=couplet&tile=14037746817393432272&city=北京 211.151.112.111
hxxp://www.gm3579.com/tpl/hw_ddsb0618/an.gif 116.10.187.15
hxxp://v.6.cn/event/promimg/?src=pming393 61.146.152.57
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=flight_float_layer 59.151.61.61
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1DA0B198994432BDDA01EC416CFBC47FB8F19D49E35E521FAA&referer=http://www.cfmogu.com/&utz=1403774663192 115.236.16.240
hxxp://img1.qunarzz.com/qs/201406/25/abff041c31dd85546886324a.jpg 116.10.187.203
hxxp://simg1.qunarzz.com/site/images/airlines/SC.gif 119.254.26.35
hxxp://simg1.qunarzz.com/site/images/flight/flight_search/qn1cs1_disable.gif 119.254.26.35
hxxp://img1.qunarzz.com/qs/201404/25/f1f51d8b645559506886324a.png 116.10.187.203
hxxp://simg1.qunarzz.com/site/images/new_main/tb.bg.gif 119.254.26.35
hxxp://simg1.qunarzz.com/site/images/flight/flight_search/btn_normal.png 119.254.26.35
hxxp://t.tudou58.com/swfd/bd/4c/chuanqi86/reg_btn.gif 8.37.231.19
hxxp://simg1.qunarzz.com/site/images/flight/home/img_qnkhd.png 119.254.26.35
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_middle 59.151.61.61
hxxp://js.tuigoo.com/pic/spacegif.gif 115.236.16.240
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=312679588 42.120.219.171
hxxp://simg1.qunarzz.com/site/images/flight/flight_v1/ico_arrsel.png 119.254.26.35
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top2 59.151.61.61
hxxp://qde.qunar.com/js.ng/framId=flight_float_layer&chan=flight&pg=home&pos=top&site=qunar&type=floating_layer&tile=14037746817393432272&city=北京 211.151.112.111
hxxp://www.6.cn/?src=tuiga834 61.146.152.57
hxxp://vj1.6rooms.com/css/base_MIN_11.12.css 61.146.152.57
hxxp://simg4.qunarzz.com/common/hf/footer_v10.png 119.254.26.35
hxxp://xx.ztgame.com/images/v8/s_index/banner/2.jpg 122.228.251.70
hxxp://vi0.6rooms.com/live/63/67/b744ef7cf7616402b9cd75cd3b296755.jpg 103.224.232.27
hxxp://simg4.qunarzz.com/common/hf/header_v12.png 119.254.26.35
hxxp://bc.qunar.com/js/ga.min.js 59.151.16.186
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkL 59.151.61.61
hxxp://xx.ztgame.com/images/v8/s_index/banner/1.jpg 122.228.251.70
hxxp://simg1.qunarzz.com/site/images/airlines/CZ.gif 119.254.26.35
hxxp://u.union178.com/_regload.php?tpl=1403085104&game=qs&dirtype=0 115.238.73.148
hxxp://vr6.6.cn/imges/live/index/firstpay.jpg 116.114.22.34
hxxp://simg1.qunarzz.com/site/images/flight/flight_search/bg_sephuan.png 119.254.26.35
hxxp://vi0.6rooms.com/live/2014/06/21/23/1013v1403362989752327021.jpg 103.224.232.27
hxxp://simg1.qunarzz.com/site/images/flight/home/ico_la_ie6.png 119.254.26.35
hxxp://simg1.qunarzz.com/site/images/flight/flight_v1/postmk_wf.png 119.254.26.35
hxxp://p.tuigoo.com/pic/spacegif.gif 115.236.16.240
hxxp://p.tuigoo.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A60AAB6420FBCFD38A74E8F7A85C55E29907E532FC72AB49DAD&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393 115.236.16.240
hxxp://z.myzwqwe12.com/AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F4733086193DA6C7674EE3CE649E52CE4FD2CE9468122DFDCEF870293E&Url=&referer=http://www.cfmogu.com/ 115.236.16.240
hxxp://txt.union178.com/txlink.php?alid=40782&oid=7893&game=qs 115.238.73.92
hxxp://img1.qunarzz.com/qs/201406/16/69042343885abe176886324a.jpg 116.10.187.203
hxxp://z.myzwqwe12.com/AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F4733086193DA6C7674EE3CE642079A95560F77388AFBC377673F7783E&Url=&referer=http://www.cfmogu.com/ 115.236.16.240
hxxp://css.res.szgla.com/jquery/jquery-1.4.4.min.js?v=1 220.162.97.209
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=569172903 42.120.219.171
hxxp://simg1.qunarzz.com/site/images/flight/home/bg_tabsel.png 119.254.26.35
hxxp://hzs7.cnzz.com/stat.htm?id=1360447&r=http://www.gm2468.com/68503.html?sid=10352&lg=en-us&ntime=none&cnzz_eid=1627145524-1403774678-http://www.gm2468.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1353530233 42.156.140.24
hxxp://www.cfmogu.com/index.html 121.12.125.78
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top 59.151.61.61
hxxp://qde.qunar.com/js.ng/framId=flight_active_dynamic&chan=flight&pg=home&site=qunar&type=dynamic_skinned&tile=14037746817393432272&city=北京 211.151.112.111
hxxp://img1.res.szgla.com/lw/images/login/login140618/right.jpg?v=1 117.27.241.117
hxxp://simg1.qunarzz.com/site/images/flight/flight_search/ico_a.png 119.254.26.35
hxxp://lw.q1.com/js/request.js 125.78.240.189
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=690083581 42.120.219.171
hxxp://www.cfmogu.com/0.htm 121.12.125.78
hxxp://www.qunar.com/twell/cookie/allocateCookie.jsp 59.151.61.61
hxxp://s94.cnzz.com/stat.php?id=1360447&web_id=1360447 1.99.192.16
hxxp://qde.qunar.com/js.ng/framId=ad_home_rightAD_top&chan=flight&pg=home&pos=top&site=qunar&size=230x200&tile=14037746817393432272&city=北京 211.151.112.111
hxxp://simg4.qunarzz.com/common/hf/24h.png 119.254.26.35
hxxp://u.union178.com/_reg.php?tpl=1403085104&game=qs&dirtype=0 115.238.73.148
hxxp://s6.cnzz.com/stat.php?id=4693566&show=pic1 1.99.192.15
hxxp://www.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&p= 116.10.187.15
hxxp://hzs9.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=1403774661&cnzz_eid=2026431406-1403774660-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1873693337 42.156.140.23
hxxp://p.tuigoo.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A60AAB6420FBCFD38A7F6627464F0F92ABDBDDFF92A5BAD7034&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393 115.236.16.240
hxxp://vi2.6rooms.com/live/2014/06/07/22/1013v1402152081287210157.jpg 103.224.232.73
hxxp://img.res.szgla.com/lw/images/login/login131009/iconk.gif?v=1 125.78.240.189
hxxp://www.cfmogu.com/Ä¢¹½Í¼Æ¬.gif 121.12.125.78
hxxp://vi1.6rooms.com/live/2014/06/12/17/1013v1402565661143534317.jpg 103.224.232.67
hxxp://c.cnzz.com/core.php?web_id=4693566&show=pic1&t=z 42.120.219.6
hxxp://vi5.6rooms.com/live/2014/06/25/15/1013v1403682187455450221.jpg 110.249.215.42
hxxp://img1.qunarzz.com/qs/201405/08/f1f51d8b645559506886324a.png 116.10.187.203
hxxp://www.gm3579.com/tpl/hw_ddsb0618/mu.swf 116.10.187.15
hxxp://qde.qunar.com/js.ng/framId=ad_home_leftAD_middle&chan=flight&pg=home&pos=top&site=qunar&size=728x90&tile=14037746817393432272&city=北京 211.151.112.111
hxxp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842 125.78.240.189
hxxp://z.myzwqwe12.com/AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F4733086193DA6C7674EE3CE64247F7ACDE395F580416FB00BA92BF05A&Url=&referer=http://www.cfmogu.com/ 115.236.16.240
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=flight_active_dynamic 59.151.61.61
hxxp://xx.ztgame.com/index_gc_ad7.html?ad=2343627 122.228.251.70
hxxp://pcookie.cnzz.com/app.gif?&cna=x9QyDBpdXF0CAcGK9OfjJSLK 42.120.219.171
hxxp://p.tuigoo.com/pic/logo.png 115.236.16.240
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_bottom 59.151.61.61
hxxp://www.gm3579.com/tpl/hw_ddsb0618/js.swf 116.10.187.15
hxxp://simg1.qunarzz.com/site/images/flight/home/bg_bd_rex.jpg 119.254.26.35
hxxp://vr0.6.cn/imges/live2013/logo.jpg 221.204.21.34
hxxp://counter.ztgame.com/ref.php?ref=2343627&return_url=http://xx.ztgame.com/index_gc_ad7.html?ad=2343627 101.226.182.61
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=couplet_load 59.151.61.61
vi4.6rooms.com 60.217.241.16
vj0.6rooms.com 61.146.152.57
93.1234xw.com 119.146.202.93
vi7.6rooms.com 60.217.241.160


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0
ET POLICY Outdated Windows Flash Version IE

Traffic

GET /count/headerImage HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688


HTTP/1.1 302 Moved Temporarily
Date: Thu, 26 Jun 2014 09:24:31 GMT
Connection: keep-alive
Location: hXXp://simg4.qunarzz.com/site/images/zhuanti/huodong/header0625.jpg
Content-Length: 0
Server: QWS/1.0
HTTP/1.1 302 Moved Temporarily..Date: Thu, 26 Jun 2014 09:24:31 GMT..C
onnection: keep-alive..Location: hXXp://simg4.qunarzz.com/site/images/
zhuanti/huodong/header0625.jpg..Content-Length: 0..Server: QWS/1.0..font>....


GET /count/counts?t=1403774677630 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:32 GMT
Content-Type: text/javascript
Connection: keep-alive
Content-Length: 384
Server: QWS/1.0
__mobile_cnt_callback__ && __mobile_cnt_callback__("54,511,663#54,511,
663#54,511,664#54,511,664#54,511,664#54,511,664#54,511,664#54,511,664#
54,511,664#54,511,664#54,511,664#54,511,665#54,511,665#54,511,665#54,5
11,665#54,511,665#54,511,665#54,511,665#54,511,665#54,511,665#54,511,6
65#54,511,666#54,511,666#54,511,666#54,511,666#54,511,666#54,511,666#5
4,511,666#54,511,666#54,511,667");HTTP/1.1 200 OK..Date: Thu, 26 Jun 2
014 09:24:32 GMT..Content-Type: text/javascript..Connection: keep-aliv
e..Content-Length: 384..Server: QWS/1.0..__mobile_cnt_callback__ && __
mobile_cnt_callback__("54,511,663#54,511,663#54,511,664#54,511,664#54,
511,664#54,511,664#54,511,664#54,511,664#54,511,664#54,511,664#54,511,
664#54,511,665#54,511,665#54,511,665#54,511,665#54,511,665#54,511,665#
54,511,665#54,511,665#54,511,665#54,511,665#54,511,666#54,511,666#54,5
11,666#54,511,666#54,511,666#54,511,666#54,511,666#54,511,666#54,511,6
67");..



GET /stat.php?id=4693566&show=pic1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s6.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Thu, 26 Jun 2014 09:24:20 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 26 Jun 2014 09:24:20 GMT
Expires: Thu, 26 Jun 2014 10:54:20 GMT
1f7a..(function(){function l(){this.c="4693566";this.O="z";this.K="pic
1";this.H="";this.J="";this.o="1403774660";this.M="hzs9.cnzz.com";this
.I="";this.q="CNZZDATA" this.c;this.p="_CNZZDbridge_" this.c;this.C="_
cnzz_CV" this.c;this.s="0";this.v={};this.a={};this.ia()}function g(a,
c){try{var b=[];b.push("siteid=4693566");.b.push("name=" f(a.name));b.
push("msg=" f(a.message));b.push("r=" f(h.referrer));b.push("page=" f(
d.location.href));b.push("agent=" f(d.navigator.userAgent));b.push("ex
=" f(c));b.push("rnd=" Math.floor(2147483648*Math.random()));(new Imag
e).src="hXXp://jserr.cnzz.com/log.php?" b.join("&")}catch(e){}}var h=d
ocument,d=window,f=encodeURIComponent,k=decodeURIComponent,p=unescape,
q=escape;l.prototype={ia:function(){try{this.R(),this.G(),this.fa(),th
is.D(),this.l(),this.da(),this.ca(),this.ga(),this.i(),.this.ba(),this
.ea(),this.ha(),this.$(),this.Y(),this.aa(),this.na(),d[this.p]=d[this
.p]||{},this.Z("_cnzz_CV")}catch(a){g(a,"i failed")}},la:function(){tr
y{var a=this;d._czc={push:function(){return a.w.apply(a,arguments)}}}c
atch(c){g(c,"oP failed")}},Y:function(){try{var a=d._czc;if("[object A
rray]"==={}.toString.call(a))for(var c=0;c<a.length;c  ){var b=a[c]
;switch(b[0]){case "_setAccount":d._cz_account="[object String]"==={}.
toString.call(b[1])?b[1]:String(b[1]);break;case "_setAutoPageview":"b
oolean"===.typeof b[1]&&(d._cz_autoPageview=b[1])}}}catch(e){g(e,"cS f
ailed")}},na:function(){try{if("undefined"===typeof d._cz_account||d._
cz_account===this.c){d._cz_account=this.c;if("[object Array]"==={}
<<< skipped >>>


GET /live/2014/06/25/15/1013v1403682187455450221.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi5.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ngx_openresty
Date: Wed, 25 Jun 2014 07:45:04 GMT
Content-Type: image/jpeg
Content-Length: 56956
Expires: Sat, 20 Jun 2015 07:45:04 GMT
Cache-Control: max-age=31104000
ETag: "1381143194"
Last-Modified: Wed, 25 Jun 2014 07:43:07 GMT
Accept-Ranges: bytes
X-HITS: 2
Age: 92367
Powered-By-ChinaCache: HIT from 060311H3SN
......JFIF.....H.H......Exif..II*................ohXXp://ns.adobe.com/
xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011
 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="h
ttp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.ad
obe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:153C485015D7E21188
93DECBD7D31876" xmpMM:DocumentID="xmp.did:A501B390FB7311E390829D9DDE61
46BB" xmpMM:InstanceID="xmp.iid:A501B38FFB7311E390829D9DDE6146BB" xmp:
CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:B002A74B73FBE3118BCB8E2B4CC3F52C" stRef:docu
mentID="xmp.did:153C485015D7E2118893DECBD7D31876"/> </rdf:Descri
ption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
;...C.................................................................
...C..................................................................
......................................................n...............
...............!1...#$%AQ4aq."&35D....2CET.....BSUc...'6FRWdest..X....
......Vbfgruv.............................................j...........
...............!1...A%Qa..."$5q....EU.....#&24Ve..6BFu....3DT...'7CRfr
....v.....(GWbd....................?..O-FP.Y.....o1..p..Mwf'.......H..
.8.;T.........)..........c.Td.v.J.r ........M...K._.....39..m(hyS.
<<< skipped >>>


GET /live/2014/06/12/17/1013v1402565661143534317.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi1.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ngx_openresty
Date: Thu, 12 Jun 2014 09:35:17 GMT
Content-Type: image/jpeg
Content-Length: 17197
Expires: Sun, 07 Jun 2015 09:35:17 GMT
Cache-Control: max-age=31104000
ETag: "1876977567"
Last-Modified: Thu, 12 Jun 2014 09:34:21 GMT
Accept-Ranges: bytes
X-HITS: 0
Powered-By-ChinaCache: HIT from 13002723SI.2
Age: 1208954
Powered-By-ChinaCache: HIT from 06010923Sf
......JFIF.....H.H......Exif..II*................ohXXp://ns.adobe.com/
xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011
 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="h
ttp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.ad
obe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:153C485015D7E21188
93DECBD7D31876" xmpMM:DocumentID="xmp.did:1AC4CD05F14C11E39FCA9371B832
E354" xmpMM:InstanceID="xmp.iid:1AC4CD04F14C11E39FCA9371B832E354" xmp:
CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:064AFE714BF1E311B719B0CA82FA7F30" stRef:docu
mentID="xmp.did:153C485015D7E2118893DECBD7D31876"/> </rdf:Descri
ption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
;...C.....................................%...#... , #&')*)..-0-(0%()(
...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((.
....................................................T.................
..........!1.AQ..."aq..2B..#RSUV.......3C....$5br...ETW...st..........
...........................@........................!.1Q.Aa.."q......2
RS...#B..3T.br...C..............?.b..PB..D)..B..D)..A .@'.<[email protected]=
...^..=yV(..D2.83.g<."..R!H."..R!H."..R!H."..R!H."..R!H.".... .r...
..ij%C=p.......Q.....cEkWTnF<..D{u......[A.c.. ...........c..%j
<<< skipped >>>


GET /stat.php?id=4693566&show=pic1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s6.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Thu, 26 Jun 2014 09:24:21 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 26 Jun 2014 09:24:21 GMT
Expires: Thu, 26 Jun 2014 10:54:21 GMT
246d..(function(){function l(){this.c="4693566";this.O="z";this.K="pic
1";this.H="";this.J="";this.o="1403774661";this.M="hzs9.cnzz.com";this
.I="";this.q="CNZZDATA" this.c;this.p="_CNZZDbridge_" this.c;this.C="_
cnzz_CV" this.c;this.s="0";this.v={};this.a={};this.ia()}function g(a,
c){try{var b=[];b.push("siteid=4693566");.b.push("name=" f(a.name));b.
push("msg=" f(a.message));b.push("r=" f(h.referrer));b.push("page=" f(
d.location.href));b.push("agent=" f(d.navigator.userAgent));b.push("ex
=" f(c));b.push("rnd=" Math.floor(2147483648*Math.random()));(new Imag
e).src="hXXp://jserr.cnzz.com/log.php?" b.join("&")}catch(e){}}var h=d
ocument,d=window,f=encodeURIComponent,k=decodeURIComponent,p=unescape,
q=escape;l.prototype={ia:function(){try{this.R(),this.G(),this.fa(),th
is.D(),this.l(),this.da(),this.ca(),this.ga(),this.i(),.this.ba(),this
.ea(),this.ha(),this.$(),this.Y(),this.aa(),this.na(),d[this.p]=d[this
.p]||{},this.Z("_cnzz_CV")}catch(a){g(a,"i failed")}},la:function(){tr
y{var a=this;d._czc={push:function(){return a.w.apply(a,arguments)}}}c
atch(c){g(c,"oP failed")}},Y:function(){try{var a=d._czc;if("[object A
rray]"==={}.toString.call(a))for(var c=0;c<a.length;c  ){var b=a[c]
;switch(b[0]){case "_setAccount":d._cz_account="[object String]"==={}.
toString.call(b[1])?b[1]:String(b[1]);break;case "_setAutoPageview":"b
oolean"===.typeof b[1]&&(d._cz_autoPageview=b[1])}}}catch(e){g(e,"cS f
ailed")}},na:function(){try{if("undefined"===typeof d._cz_account||d._
cz_account===this.c){d._cz_account=this.c;if("[object Array]"==={}
<<< skipped >>>


GET /lw/images/login/login140616/title.jpg?v=1 HTTP/1.1
Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:30:51 GMT
Cache-Control: max-age=2678400
Content-Length: 28315
Content-Type: image/jpeg
Last-Modified: Mon, 16 Jun 2014 13:00:09 GMT
Accept-Ranges: bytes
ETag: "baa550e76289cf1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 fjpt183:5 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......<.....)hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xm
pMM:InstanceID="xmp.iid:42AD4239F52C11E3AD068B47F32DAA6A" xmpMM:Docume
ntID="xmp.did:42AD423AF52C11E3AD068B47F32DAA6A"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:42AD4237F52C11E3AD068B47F32DAA6A" stRef:
documentID="xmp.did:42AD4238F52C11E3AD068B47F32DAA6A"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
......................................................................
........................................!..1A..Qa"..q..2...R.#3S.....B
b..$.r.Cs..dt%...c.T.EU&...4D..5.e.......................!Q.1A".....R.
.aq.2B....br.#[email protected]. ].N...
A...k.........\~....^crw(~:..XpbE.|.JG............j...>...:l.mo&4 .
.g........-.#.P.$Z.P..T.:.l.qu'x..P..../[email protected]...&.....d/7w...
....P:C........&a.....~..(..@...=...;}.|...........w....J.l.kf....
<<< skipped >>>

GET /lw/images/login/login131009/iconk.gif?v=1 HTTP/1.1


Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:31:40 GMT
Cache-Control: max-age=2678400
Content-Length: 1093
Content-Type: image/gif
Last-Modified: Thu, 10 Oct 2013 02:23:20 GMT
Accept-Ranges: bytes
ETag: "949120b05fc5ce1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 fjpt183:2 (Cdn Cache Server V2.0)
Connection: keep-alive
GIF89a.............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:BF6C13DDD71B11E2B223D1D763
11C7B1" xmpMM:DocumentID="xmp.did:BF6C13DED71B11E2B223D1D76311C7B1">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BF6C13DBD71B11E2B223
D1D76311C7B1" stRef:documentID="xmp.did:BF6C13DCD71B11E2B223D1D76311C7
B1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.............................................
......................................................................
...............~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIH
GFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ........................
.........!.......,...........D..;..
<<< skipped >>>


GET /swfd/54/58/2629/btn.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.you1ad.com/tuigoo/1.html?uid=14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:27 GMT
Content-Type: image/gif
Content-Length: 7039
Last-Modified: Mon, 06 Feb 2012 07:18:25 GMT
Connection: keep-alive
Expires: Thu, 26 Jun 2014 10:24:27 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes
GIF89a..2......W.oS........G.F...X.......B......R..8.\.....=.&........
..*..{...........E..........I:........;....<.........j..1..&.kT.sY.
.u..d.u.....R.G......t.....U...........M...F..c...X..~n]y....r..l.....
............x.....`....w..x......C./&....:.2.....h....7.J...1.G......k
.g..G8.......i...e..j........Y.l.....a..1&.....h..d...../..q(...xh....
.......N..m.c.....ZG<.......F..l........!......wF6.~N.d.E..l6*.....
|.....y..S....YE.[.........|.j.....m...`..w..}.....Y.WD.<.....j....
...........I..k...........x..~..a'....$.R..W....._...5..s..,.......S.l
%...C!....{.....#[email protected].......{..w..x.e.Z.
...'.....n.f......S.{....e....v.....`...v...L......sN...h... ....G..2.
._.......^$.......O........................~.....v?4..................
_......j..p..h.7....!.......,......2.......ds.......|.....O..!x*"....^
....C......p....?Vt.......>.h....5Q..9qa.."..l(4!B...B0.....f..;2`.
.oT.....^.aL....n.......`..../6.3c.]./n..=K#...p........d..U.6.[.t.Fu.
.F..i.~..Br..G.M.p$.&...Hc.....l^|1....Z...,...1b..1.....b........wl.?
...9............#..F>......B.n...'..#dH...Z.w..W..Q..|...IAp.B.. B.
.....}D....Vh.....!..l... .8.*}`....^x...F....:.........}..;......T.c-
}0R...l...L.....\.E.TJ9..ONY..U6...`....Uf.%.c..e.M..H...)..>n..7..
.#!..(..ABh..~.j......#...(.~..(.p8.h.......r.(.~d.)...j).~..i.JV.f..~
.!.>....?...D#.d ....Y....`...&..-...D..4#m. .....6.........*{m3.l.
-..B.m0`..m........YK."..A-.<q`......B|Q..}h...p.....G,q5*T.N:.W\1.
``...r."...\...)t|..,..q:).|.....B3*.P2.'..3...,1.......|!....`..8
<<< skipped >>>

GET /swfd/54/58/2629/sp.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/swfd/54/58/2629/index.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:28 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 571
Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx/1.0.
10</center>..</body>..</html>..<!-- a padding to 
disable MSIE and Chrome friendly error page -->..<!-- a padding 
to disable MSIE and Chrome friendly error page -->..<!-- a paddi
ng to disable MSIE and Chrome friendly error page -->..<!-- a pa
dding to disable MSIE and Chrome friendly error page -->..<!-- a
 padding to disable MSIE and Chrome friendly error page -->..<!-
- a padding to disable MSIE and Chrome friendly error page -->..ont>....


GET /swfd/54/58/2629/ren.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/swfd/54/58/2629/index.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:29 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 147062
Last-Modified: Thu, 22 May 2014 07:48:20 GMT
Connection: keep-alive
Expires: Thu, 26 Jun 2014 10:24:29 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes
CWS.....x....T.../.3...9g.r.!......9J.".C.9...$ITP...AD...d..........{
.=.{...w...3.~.vU.....wU..$....P..0..eb"..n..a.........*......$.$.....
-.......$...../ !!.......Eq...{..^...cf...jPv...u..w......v^..2LL..^..
.K........#.....U[o~.>.?Z..IR..........]V...Wu..s...z99...........y
.v....paq.i....C..2.  ....E.......K..J"D........g.g.:........$,").....
S.o.....\...-...pi.....g[...L....~:^..........~(......^......_........
...*.....[.m.#.........w..:3...|.=<.........sn?.`oG~.G?.._{G.;./...
........w.P.E..\].$.U........U.*B......*b..b......b......6e/....~is...
...sm.....(.....JH.#T.....s................q:....~.hK.0...m.S.J.......
.E.........$z.......I.\........._...N..K.......%p^^^....A..K%..Q.H.prr
.......?b.....c1..7...nG.*K..KH..n...W!u......#..Kw....../.{G.........
=$,q..L.#K...........H.......M0.Ue\6...BA.. ..'8.....d..R.. . ....  O.
...... .C.......MDK..{.4.....O.O~....3^3.b...[YP.L..S.5..3q......#..?N
..][email protected][{..p.4....?(..s......b.g.......Z.Y..h*.....*..p.>m..E.
.=WK..w].C..g.J..D.U.K%D...\.....&|..y0....'Mf....Y;.g.U./<......v&
..m...v.9...t......M.)..Lz6~G..>..........FEV'[email protected]
...p..9Ni.........bgF.=..{...G...m...4.'.......V^..~........=.......W.
..g..z&-4.}..\.|*m#...@...(.1G.....>..*1...oszF.../N...Dqj"g..9...j
.....8..?.t.2....8..(..3D.jj.....o..0.q..X.....YZ.\.r.F..2...}:.&...hX
..9s.95..I]...T..wN.s..R.sa.y.. G@wz]C..O....Ak.#.......QL.ZP.....(...
.. ..p...B.FD....!..'@q. z..Q...e../.t~.....:\.~CJ....."pT?..5......U.
..........G.OfOV."MU.U..Bw.u8Y.......:.RV:v~v:ZBRJ.v~QI.^. -.. BPP
<<< skipped >>>

GET /swfd/54/58/2629/logo.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/swfd/54/58/2629/index.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:32 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 7419
Last-Modified: Tue, 25 Feb 2014 01:52:38 GMT
Connection: keep-alive
Expires: Thu, 26 Jun 2014 10:24:32 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes
CWS.....x...eP].........Np..C... ....\......\..-H.......}.............
.TW.>.sj>3=.. ....p..@.....^$.....Cu....8...6.[.d.dD$d$Ddd$d..dT
t\tt44t.l.L\b...b.""2J...9....5;5.#.. .)....................BG..LFD...
-X.......%.......8.T4t...z\............%........ix.._....:...&......&.
.<..3s.BC'"&!%c`dbfa}./ ($,".VVN^AQI.........'..._..]\..=<...CB.
.#"....'..HMK...UPXT\RZS[W.........?084<25=3;.._X..........p~qy....
......@.....\x/\.....(.p..{.....D.../..b....7...MBnu7........$:.......
..E......D..`....R=............../......0.j..h.x<8.<.._b...."...
.rx.x.$p.........................w.R..|......q.L9.,2........8R0......`
............evbDR.A.'...kc,..;?yr.e=....1.....A.<vG...|[email protected]....
...K....6........2.f..(7f[[email protected]..#~V..
..M........oA).....u.......O.r!....-..@x..?......v...a.uk..&..|.......
...8J^'.!...r].w...2A-J...yQW.A........L......G?.-,..#..|......p.)Xz.?
.Q... ....$..:@ E..M..]w...n..x.b.b.....Gn.(g....G...I.......d.c......
?/....p.|....., ..VQ...............>.....1...[..Fw.....M....]h.P.f.
u(..R._J...EN..V...dL.`n.......8.ck.i.DB.....8..y..m.C..Ru....T...O.zf
..@i.{...C.o..8.t~:.?.....!...*d4X.]<.....o.....g ...{...{..c...&..
..O.....y...W..'J....rW.k.7u,.x...p..n.Ee4...W....o<..2............
Y..4a......`./sH...''.....[..DH.....z^.3.?...D w....-0.|.m...|.0../O..
..b...p.:<..:...!.........=utR..I$\...[q.A.4......9.6.,n..:.T:.V8.d
...*.<K.!.,XM..lt'....Zt&..*:.i~..~~.^E.k}n4...]CL....;....f..1..P.
..}.{..|..O.W.k7i.(.FY.)F).8O.c^>..7.;.C.^.....V..)....|#.....7
<<< skipped >>>

GET /swfd/54/58/2629/reg.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/swfd/54/58/2629/index.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:32 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 7463
Last-Modified: Tue, 24 Dec 2013 07:02:23 GMT
Connection: keep-alive
Expires: Thu, 26 Jun 2014 10:24:32 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes
[email protected]:.{.NB..I.Q.w.....w.)[email protected]..
.....g...w.=...'[email protected].(.....>??.....$......O  .O&..,.....
a.*.a..>...... ...a...0...BA..?..... ......(P....sR..B.............
....DX._./.J.....JD...S.A..............QPSS\`ccARP...QP"Y..Z*.jZ......
..........F(t.p....:Fjf......4...p.....4 ...|.....`...}.S.......L.U..@
`.>`([email protected]?......J......o....%.|........./.x?L....
... D b..7.>.......c 0..".qC....{D.....E....y... .l.'s( . .....f...
.4..*O|:...i;.[DJp........|q......K...un..Zi..\.....>....Y..p..i..5
V..C...G.t..tZ.d..Z... (...]...8..[FFq...G.`.....)vN.b.......U7.q.v(mW
..r..\...k...e...'.....]....B.n.H{t..]{.....ze'.....bg....].....Wy...]
.Z.....cy~..>..I2..z. .|.jx..tm.%....D...3-...z(..s.iP{1.vJ.iz.q(X.
.65..#......8<2..^0..-=..%..3].j.r.A...%*....S..2.2....."}...a..J1\
~.Pn.L.^..'j....V..|.c1......m.Do..(.....m[,..../..L...\..m..U...<.
....O.i>....Bc.u.9T.....h.9Z.e.I,..[).K..2.">pGQ..:r.s<..c.?.
ee....h...sG....1k^h.\C/v.UhH....L........p)4GI4<@.......D.`,o.q ..
.1....4^F..".....mt..lX....w,....|@/ZJ;.a..........[.r.).i..L..Z./.2..
.....\..:V...q...1........*%^3y..}byK..]m...g......D'..K..2~C..f......
.DdM..nL..|..><..K(E.k..=0.Y2...P..#..v...eq...,&m.w..h~.....<
;..h.IJ......uG.,[email protected]~v.
/.........<...?.....F...&y<s...a.A.:.....[..A_V..w.fY...ds..D..9
ZC..F.v.@...!....8.K....l.Y...".:.....0..I.J....Q.u..S.w......t.E...V.
l.......6.]...#w G.5..........[ ......~...-yo}.I.....*Mo.l._*..}..
<<< skipped >>>

GET /tuigoo/1.html.2.js?uid=14516&tid=1 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.you1ad.com/tuigoo/1.html?uid=14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:33 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 571
Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx/1.0.
10</center>..</body>..</html>..<!-- a padding to 
disable MSIE and Chrome friendly error page -->..<!-- a padding 
to disable MSIE and Chrome friendly error page -->..<!-- a paddi
ng to disable MSIE and Chrome friendly error page -->..<!-- a pa
dding to disable MSIE and Chrome friendly error page -->..<!-- a
 padding to disable MSIE and Chrome friendly error page -->..<!-
- a padding to disable MSIE and Chrome friendly error page -->..HTT
P/1.1 404 Not Found..Server: nginx/1.0.10..Date: Thu, 26 Jun 2014 09:2
4:33 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 571.
.Connection: keep-alive..<html>..<head><title>404 No
t Found</title></head>..<body bgcolor="white">..<
center><h1>404 Not Found</h1></center>..<hr>
;<center>nginx/1.0.10</center>..</body>..</html&g
t;..<!-- a padding to disable MSIE and Chrome friendly error page -
->..<!-- a padding to disable MSIE and Chrome friendly error pag
e -->..<!-- a padding to disable MSIE and Chrome friendly error 
page -->..<!-- a padding to disable MSIE and Chrome friendly err
or page -->..<!-- a padding to disable MSIE and Chrome friendly 
error page -->..<!-- a padding to disable MSIE and Chrome fr
<<< skipped >>>


GET /AShow.aspx?AID=9842 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=1974; expires=Thu, 26-Jun-2014 12:24:04 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:04 GMT
Content-Length: 3549
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...i[T......\...Vs....[.ks...u.
......?k.u.*.i.u.{..z.tgg..]?|v|..w...G.>.s(.Sj.K.=........._|..is.
.......X...q[...j.^..v\V..o..u~.K...| .C..Z.....v.7.l.o.a..%y....G..._
r..'....;..l.....v.H.f..C|.|../..0..>....a..2.J.fm~.|.|../\.?.6.."o
.....H.i.K......ZUo.|k.-.;)....../.......j.....g.;.}.V.|....~.........
.nw..4|z.";...... ...j...R...o..w.A...r]..>zM...2 ....*..V.g)p..i..
dL..x.;.....~.....Ow......;..T.([...#...`.......WY;...!.-..&.>...m&
gt;..............v............3...."......E..V....`>.!../..O.h....A
....Y...W..{A...~.$....._..pZ......I.~..'_.C....g...U>y[....!}.e...
........2.,......&../....5.........;...y...O<E.(........6o......O..
.(.].....;..m._..........`.....^WU9..t......!.... .d...7.rJ.ySg.y.....
..?.....j.c.....;...}.%.L...n>...6.d:..E............l?$..}.......U^
.d.1..jQM.2.j.{.[..M~.l....w.....v..'=J.>...z............yM8.0d..?.
...~..gu...Z.._..:.}.\[email protected]............*f.M...:
?..n..XQ..t......U...\...F.\.nB....M..2&.xQ...~ \.5../w...?&%.O...}...
.Z..'g.w..~J.ng.#zwFZ.....y^\.[.uZfM..'._.=}...g.?&m.......{......]...
....]ipo{g..9.....< .........4.>.......G..\..g.....v}.M..\../...
....!.-......P.Wo0..~<.{.x......~&X>... ...n.<.1`0.....C...''
;........K......je.1 .r...-i....yU/......t.. ..4..#2.d.>....4......
.j2......o.@.\....^Q.f=Y..^./25d.?.....c..........4(.C?h.G....U*..-.Lc
r..m.......u(......!..E....h.g...........9.M..:...yC..= ..l...-.j.
<<< skipped >>>

GET /AShow.aspx?AID=9842 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=505; expires=Thu, 26-Jun-2014 12:24:07 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:07 GMT
Content-Length: 3599
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...i[T......\...Vs....[.ks...u.
......?k.u.*.i.u.{..z.tgg..]?|v|..w...G.>.s(.Sj.K.=........._|..is.
.......X...q[...j.^..v\V..o..u~.K...| .C..Z.....v.7.l.o.a..%y....G..._
r..'....;..l.....v.H.f..C|.|../..0..>....a..2.J.fm~.|.|../\.?.6.."o
.....H.i.K......ZUo.|k.-.;)....../.......j.....g.;.}.V.|....~.........
.nw..4|z.";...... ...j...R...o..w.A...r]..>zM...2 ....*..V.g)p..i..
dL..x.;.....~.....Ow......;..T.([...#...`.......WY;...!.-..&.>...m&
gt;..............v............3...."......E..V....`>.!../..O.h....A
....Y...W..{A...~.$....._..pZ......I.~..'_.C....g...U>y[....!}.e...
........2.,......&../....5.........;...y...O<E.(........6o......O..
.(.].....;..m._..........`.....^WU9..t......!.... .d...7.rJ.ySg.y.....
..?.....j.c.....;...}.%.L...n>...6.d:..E............l?$..}.......U^
.d.1..jQM.2.j.{.[..M~.l....w.....v..'=J.>...z............yM8.0d..?.
...~..gu...Z.._..:.}.\[email protected]............*f.M...:
?..n..XQ..t......U...\...F.\.nB....M..2&.xQ...~ \.5../w...?&%.HTTP/1.1
 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Type: text
/html; charset=utf-8..Content-Encoding: gzip..Expires: -1..Vary: Accep
t-Encoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.50727..Se
t-Cookie: UnionADShowTG=505; expires=Thu, 26-Jun-2014 12:24:07 GMT; pa
th=/..X-Powered-By: ASP.NET..Date: Thu, 26 Jun 2014 09:24:07 GMT..Cont
ent-Length: 3599...............`.I.%&/m.{.J.J..t...`.$..@.........
<<< skipped >>>

GET /AShow.aspx?AID=9842 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=1960; expires=Thu, 26-Jun-2014 12:24:08 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:08 GMT
Content-Length: 3539
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...i[T......\...Vs....[.ks...u.
......?k.u.*.i.u.{..z.tgg..]?|v|..w...G.>.s(.Sj.K.=........._|..is.
.......X...q[...j.^..v\V..o..u~.K...| .C..Z.....v.7.l.o.a..%y....G..._
r..'....;..l.....v.H.f..C|.|../..0..>....a..2.J.fm~.|.|../\.?.6.."o
.....H.i.K......ZUo.|k.-.;)....../.......j.....g.;.}.V.|....~.........
.nw..4|z.";...... ...j...R...o..w.A...r]..>zM...2 ....*..V.g)p..i..
dL..x.;.....~.....Ow......;..T.([...#...`.......WY;...!.-..&.>...m&
gt;..............v............3...."......E..V....`>.!../..O.h....A
....Y...W..{A...~.$....._..pZ......I.~..'_.C....g...U>y[....!}.e...
........2.,......&../....5.........;...y...O<E.(........6o......O..
.(.].....;..m._..........`.....^WU9..t......!.... .d...7.rJ.ySg.y.....
..?.....j.c.....;...}.%.L...n>...6.d:..E............l?$..}.......U^
.d.1..jQM.2.j.{.[..M~.l....w.....v..'=J.>...z............yM8.0d..?.
...~..gu...Z.._..:.}.\[email protected]............*f.M...:
?..n..XQ..t......U...\...F.\.nB....M..2&.xQ...~ \.5../w...?&%.O...}...
.Z..'g.w..~J.ng.#zwFZ.....y^\.[.uZfM..'._.=}...g.?&m.......{......]...
....]ipo{g..9.....< .........4.>.......G..\..g.....v}.M..\../...
....!.-......P.Wo0..~<.{.x......~&X>... ...n.<.1`0.....C...''
;........K......je.1 .r...-i....yU/......t.. ..4..#2.d.>....4......
.j2......o.@.\....^Q.f=Y..^./25d.?.....c..........4(.C?h.G....U*..-.Lc
r..m.......u(......!..E....h.g...........9.M..:...yC..= ..l...-.j.
<<< skipped >>>

GET /AShow.aspx?AID=9756 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShowTG=1974


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=1974|1805; expires=Thu, 26-Jun-2014 12:24:09 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:09 GMT
Content-Length: 2546
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:m.u.....]=.{ww..x.........w.
-..........>.._.......^....~0^\....]..{.i..{..'O.b.v.5.w......v.v..
.......?....v..........{..}z......O..v.=9y......g.~..`...g;....?y....g
.......v....... ....~..s......tI.........Z.....w.w......l.(.....3.i...
.s...lVM..zs\V..-....f.........|._...~...V..X...........;.w..|.l...{;.
..>........>.?=.wr......{'........?=...{........;{...2.>..._.
..Q|.I..V...Wg'.bU-iD[.0....uqQU..".....U.....;.i..y^\....vvb...Y.. &L
3.....x..~....O.k}.?$..~.[...~}"c...:.CM..cM.....e...........5...I..q.
h..Z}..).(....z.W.[...?...rg.hp...>^/g.y..g.............&RUo..t.M.|
v'...qr.u.^N..[w...C._..".........}.....>.....v^4...d}..Q".,]...~..
...iq...Y.-zo|.X>..E..7."...F.?..*.......>..#...i].........Es^..
g..yV69>.U.... ......_.>;.;n.........>.].....;.._.._.........
......Sj.0.......O......<.........9..>.A..?... A....w...........
.|.?....sRh.W....'.E..bY...,;8c?....h.L.;i.y[..uN...W...!..I.......~..
.l.........A..jK...?&.A....?...(..~D....=z.{.-...M.-.s......lS....r5..
..U6..-.:l...qUL....x...5...*}...j.Y....~......mV.4'....Q...T..]*Z....
>.j.....G0wJ..87.e..u? .wc...M.U].....g.&..g.........q.....'.A#....
..G=b .....R....{....y.t..!c..c9..O>^.;.,.....`R.m.x.sX.#.....0.J..
B;.4U.n.8.....q.se{1 w..9L.....G.lI."s.h.f....F...d.L...#g....{2.....w
!...{.#2.Y..........m.d....~:...i]..Gv(......sX...^.T~t$.(.......U.0..
...D...1.........U....Bb:.@....^[email protected].\]]y.J.
<<< skipped >>>

GET /AShow.aspx?AID=9756 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShowTG=505


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=505|1805; expires=Thu, 26-Jun-2014 12:24:13 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:13 GMT
Content-Length: 2542
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:m.u.....]=.{ww..x.........w.
-..........>.._.......^....~0^\....]..{.i..{..'O.b.v.5.w......v.v..
.......?....v..........{..}z......O..v.=9y.............O...'{.....<
.;=.......'.>[email protected]....{.........~./.eK?Wu.(.....~........jQ,/.=.
g...u....O...........Y[TKm..~.M.=.............>..Y..?..=....!.v...?
.....{.v.>.}x....'.>}..zz....y........<{.....1....jp..>.w.
d.....!..F..'.rZ...^..T.U...my....j..EU...|Vd..U1#\......o.yq1o?......
.f5...0.......y..=...?...M..PW..o.S.....16....5Q~.5......U...e~.~vo?.`
..'-..I.M.j......8O...U^.o....<k...]....>.x.....2.}..._....."k..
HU.-..e6)...........z9..n..?...~....._.K...s....n....../.y........D...
t..K........e..gu.....b...........~..........g..........uU._N~.>.Z.
.y......Y....T._...L?V...~........vkvg$.~..w......x.~....V*.....3?#...
?L...8.?..>.?.n.".p.P0.{N..g.....8..........z...}`..{..O.>.?....
....I..^Ek?#...y..e.~.......$...i3.....m...9..v^a.B...&m..Z0....GO..[.
..~4.7....-.C~..,....2.....l......b....}....7u.l.I6._...Mu.....<.o.
W.,.........U1.[Rg...b..? ..E....g...s.Q.W?.z.Ye...2..G) RRQ.w.hMRF...
....v....)1.............!..7UWu..[.?...(f.}..................\........
...?..H..{....? .............?.x..P..~/.r.I......a....GG..X(.>..l.T
.......n.........}..0........%Q....]..C........3y....)$kJ..L?.....\.v.
....fE.*..GK2........>...2k.u.j...pwc.n..a...z)R...p..o....&Ve...G.
.........Bp.H| T..Rp...|.!&..{...}...E........-f..q..I...suu..*m..
<<< skipped >>>


GET /stat.htm?id=1360447&r=http://VVV.gm2468.com/68503.html?sid=10352&lg=en-us&ntime=none&cnzz_eid=1627145524-1403774678-http://VVV.gm2468.com/&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1353530233 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hzs7.cnzz.com
Connection: Keep-Alive
Cookie: cna=x9QyDBpdXF0CAcGK9OfjJSLK


HTTP/1.1 200 OK
Server: Tengine/1.4.1
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 28 May 2013 02:57:17 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..



GET /live/33/84/bd5463690a93c57a1039c47e11ab0f97.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi5.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Wed, 04 Jun 2014 04:34:52 GMT
Content-Type: image/jpeg
Content-Length: 40582
Expires: Sat, 30 May 2015 04:34:52 GMT
Cache-Control: max-age=31104000
ETag: "3219167622"
Last-Modified: Fri, 20 Dec 2013 09:19:14 GMT
Powered-By-ChinaCache: HIT from 13002723SH
Age: 1918179
Powered-By-ChinaCache: HIT from 060311H3SN
......JFIF.............<CREATOR: gd-jpeg v1.0 (using IJG JPEG v62),
 quality = 100....C...................................................
.................C....................................................
...................f....".............................................
...............}........!1A..Qa."q.2....#B...R..$3br........%&'()*4567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
......................................................................
.....................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&
'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz............................
........................................................?........&/...
...rls..%.>.7..i...o...1......y..i../LW....n..._.S. ..p.Q/)BO....K.
g...hM7....mm8..5...u<Z..)..>.~...B.%.J....k.....?...r`7.... .w{
.....Y.Z......HT......T.....g,..B...:..w.=.M8..e....7. .`....'.l|G.@|O
.|...........|a.Sl.........^k7.B.c.....&.GD.......~....{..c...........
....!.jy.8.o.{.W...._.....j....O....W.....A.A..=..kO.x......x[H.f1...^
. i!.o.5)....sy3.....G... .iR..Y.J......B..M..^.eN.D.V.).R..).s..2...O
._..x...*..FYJ.L\.:K.....H...i..J4.....^T.(F.a.NUUJ......-..........g.
W....MJ. ./P....K.^....A.. .O...N..;*.q.]iV....Q...]....jV..-..g..8...
.yi<....`rd.H&..H..O.H....8..)..k'.7.........R.`A.....;.....<U..
.n...[.:......go..r.......jV...<oc..i.....u5.....[..ZO..K...Q..kt..
...q.M.G"........S.....8Nt):.(W.Ru......V......'.u..&xK...O.#......J.z
Y.....V.).j..G...B..\..T.N....n......%.!Yx.....7c-..#.d..Go....5.G
<<< skipped >>>


GET /tpl/hw_ddsb0618/an.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gm3579.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:37 GMT
Content-Type: image/gif
Content-Length: 6291
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 09:49:21 GMT
Expires: Wed, 02 Jul 2014 14:48:59 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
Age: 66939
Via: http/1.1 4399_cluster (CDN CACHE V1.0)
GIF89a..2.........Y.u.....R-....G2...w<9............./.W:4.hh:"KH83
....qqffe..d&.0..H.u4...W..TRP4.B..j..........Y3.TU..6. .......vut....
.....o?4~|{..3.I.$"(........iF.........D3.k.x(..f3.A.@'N..8...}BB=75R!
..?3c;3.X3............jUv.;.h.........~.k  9........|..[...|.....vv...
GGG.%..t/.2.....'.VZV.....7......gK][email protected]"......gV_..E....%..
......G...............4...D Q.....F.8..S.'...x.z..h....Q....R.....A...
..)...\_Z\.O4.....E.7.X5L.......l{uf....XZW...~XuVPP%..c ...3...?.6...
.w.....v...5H!;D>BJ1Z *)WYX0.1...G..X..[=Q.b,ODBP<`.4.ZFl1!"E...
B'..U......m/-.~4.m.._....WQT6.....r21...:..bDR.aa....M1O-I....K....PK
OA$.. .ZUXO62KOM .#.x.?CA=>=QTQ.....O...nll.a&._..........512_bb...
U*&P(@Y43.dz.....`pvq~e|srq......`^]......B!Ea>Ub``Z.Y..R.......w..
...Q2....^3 ...2.......P..!.......,......2.....[5a.......*\......#J.H.
............ C2.C.d..(K.DyR%I....aR.&L.,k...R.O.6e..)r'K.)K.S7...K... 
U....X.j......`...Kvl)o...Jt ..5*T.......w.......5v...K..a.~..]<W..
....>.......'...._5.&5K4i..B.HqX......c...a..R.\......I....U ......
7...s...E.%[email protected].<..D..}..........TP..8.
......Q......'.$..7.Th.!w.HTTP/1.1 200 OK..Server: nginx..Date: Thu, 2
6 Jun 2014 09:24:37 GMT..Content-Type: image/gif..Content-Length: 6291
..Connection: keep-alive..Last-Modified: Wed, 18 Jun 2014 09:49:21 GMT
..Expires: Wed, 02 Jul 2014 14:48:59 GMT..Cache-Control: max-age=60480
0..Accept-Ranges: bytes..Age: 66939..Via: http/1.1 4399_cluster (CDN C
ACHE V1.0)..GIF89a..2.........Y.u.....R-....G2...w<9...........
<<< skipped >>>

GET /tpl/hw_ddsb0618/js.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.gm3579.com/tpl/hw_ddsb0618/main.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gm3579.com
Connection: Keep-Alive
Cookie: CNZZDATA1360447=cnzz_eid=1627145524-1403774678-http%3A%2F%2FVVV.gm2468.com%2F&ntime=1403774678


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:42 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 208617
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 09:49:23 GMT
Expires: Thu, 03 Jul 2014 08:41:56 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
Age: 2566
Via: http/1.1 4399_cluster (CDN CACHE V1.0)
CWS.....x...u@T...=C.tw...]........Hw.4.CH#HIK.....R.". ....1.....9.=.
...3....s.u=.=..~XC......gK.H.@rx. .(............S..tsu...H.....).....
.........#""[email protected];..o'O_'.w..le... ....6........
......... ........w.`'QYo; _.o=........Up..q..........[......r.Z.9....
...s.{...e'.<..r..sp.r.........r..s.......=.l.n.kek.k.....4........
......N.A...w{..s.[O...V]....nn\.....cg....G/...K.............QW.Uv...
r..S.{...tr............Q......................C.?...M.........h..?..K.
..iz;98....D..........V...UZ@._^FV.[.._DVA....I....y;...*x{..1..V.>
v.{J..wW...?.W..?.&........h..Q. 7...........E...ey....y.e....f..B.\..
....e.Z......uJ...3...........s..}4. Ky.p.[.Q{.o7 ..V...N6V..r.r.8z...
X..q..v.q.....S.......d.`0..=.. %...WTP.H....Y..^.X......Q..I...9Hf...
}.Sv..x../..=......8...HdK.g.."D...Ug@0tb.)....#......I.?...0A D......
l............x.}...P...P...Q.ab.. ....C...y. tL\\LJZZ..LL.{........`..
.ki.... `TT\ZRT,r....&......).9..q.....@. Ð[email protected]
BD.6J....H..Hh.([email protected] .x...2:....hD.t<|..^i....e...e...6O...`
..?b.q4$`.......FB.o.#.!...C..x..a  ..;[email protected]...
N....\..i..jM...W>..\....Z....(......Q....T.>*:.F..'_R.:..Bb.?..
..[.J...H.,RL].TD....$*[email protected]?.W..r.p..
<G..._.bXU...A5.W.......jb.[s.n..,2........M^.!.#.$.....E..3..-..S.
9.t...Ru...m~y....'....!#WH...C.z..i$=.8r..a.7...V..LUu.!.|...........
.u..GW..q]_....?zB.....O.i.CZh>I.....|....z$..sgFd......."$...u....
@.k...7...Bk.n....~4.|..XI.5G..2..J"g.]v.o7u..mtO....:..u..6[...5.
<<< skipped >>>


GET /xm/2013.11.261.gif HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://p.tuigoo.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 115.236.19.58
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
Last-Modified: Wed, 27 Nov 2013 01:42:51 GMT
Accept-Ranges: bytes
ETag: "98ad3afc11ebce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:32 GMT
Content-Length: 38379
GIF89a...........jQ..nonN...1v.H5(...............`..................d.
...s.P...&.....k..VkHUD//%%mVEiL5s.nN..................V.......-jto.-.
......wd..y...mroKrt0"..F.\..........wRLH....$......X.....q...........
....Oc4.yi.............c.........wl....h.....e....wT...dw4..j....1...}
.....v,KO..y.YL..R......@ .2C..C....$Xe............G...GO..Yl.........
..N............. ....(0....7B..................R:?............Tj......
..\=.7.......&..<...v.iV]./......mCW..i.....P.................Se`7-
I\a.......{p...r..V.....W.}................Qu......}<g....UN....-..
............... .`{.F.!...[...ay......}...............................
..............9.......................................................
.............................................................C.....\..
!..a`..._}R..Hº!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehi
HzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
dobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <
;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> &
lt;rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1
.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" x
mlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.
did:12278B547F56E311BDF0D3EE77448737" xmpMM:DocumentID="xmp.did:B9A0BE
11568111E396F2887EEF4C264B" xmpMM:InstanceID="xmp.iid:B9A0BE10568111E3
96F2887EEF4C264B" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:15278B547F56E311BD
<<< skipped >>>


GET /vataplan?framId=topicLinkR&f=s&cur_page_num=0&rep=1&tag=99&vataposition=QNR_Zjc=_CN&vatacon=&rows=1&qtype=js&vataframe=bannerDefault&callback=QNR._AD.topicLinkR&ab=b&tile=14037746817393432272&city=北京 HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:38 GMT
Content-Type: text/plain;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: sn=1403774678_1; path=/; expires=Thu, 26-Jun-2014 17:54:38 GMT; HttpOnly
Server: QWS/1.0
Content-Encoding: gzip
303...............r.F...~..VI..w....I.....&.r!h..4.n. .uj25^g1U.".}..L
....y..{2NV.t...>.......^...N...Dpo~....y..(K!.........'.b7C.?...Jl
..'\.q.`.Q.V.....A....:'z.J.=..}..'....O.'... ..G)l....|.......o^.....
./.o.?.x..........._...~..7....}.....R9...:.........t....c...B......2.
MHQ.h.).x.[.k...8]...q..n....c....F./.no.e...KC/VF8...|.LWe(.........*
.2.)..~.u..."....p.=..I....#S..EP.W.......(...vHH3J.{s<...l.#.G rL.
J.B.ke..a...e..u..9b.3.w........:q...flQ..Vb.!...........C."Y<8..1D
...3.&.C.-...8.1.....p..)gh......M]..b3.b..X,..5e..d..2...F#...<...
..M....$/wU.r.v..gL.h.L.!..M.....9.L..i...bj\@.|bsSc.(.5`-EW...Nv...y.
.L.4...,.u>a..Z4.3..k.%A[.....I.&....-......#..h..H.'....}q#p<.K
<%...2...`.........)..z.q.c....v...tcp....h{.^......Q.%q.X..A.~...#
..ga................T0.......0......


GET /vataplan?framId=ifmRightTextlink&vataposition=QNR_OA==_CN&tag=99&rows=14&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightTextlink&ab=b&tile=14037746817393432272&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: text/plain;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: sn=1403774679_1; path=/; expires=Thu, 26-Jun-2014 17:54:39 GMT; HttpOnly
Server: QWS/1.0
Content-Encoding: gzip
6a6..............k.......)..j.4.........8...;.*..._.[.$...-ti.....n.V.
]..V..Vh...t23.. ..(.Ee.....y..<.K...cq(._.....I.....*B?.~..../.ev.
,.....F.....X.vh$.m........7.2.wR.(roQ.........i..^.^....{}.2.....l...
.b....I./...._>.~..?.........&...W..o........^......?<x.........
8}y........~~...].;3..x....S9.. ..E.O.c.Y`...wQ;i.......S.A......@H...
.VR..&.,l..l`$..72.......P(...7.C...Xig.M{@FI.B.$.... 9\...i....zj....
\WB9...q#..NZI...l1.z.X..H@S.... .5.C..F.7.`...i.Z4.1.o,.E...].uHK....
.Y.L.#.. ..$.D..q1..z1..3jQ.)Q..hi....!..H..5[...fn.....3g.P!.B...aB.W
'.g....KUH.L( ....Y.9.n=?. ..A`.0.'.F.fE3b.t..AY....{....C..([email protected]
......y..5....d..,.......[.G.nS..H>..z......6.}s..i.. ..1.l..D...s.
..A.q0....i.....q...eUU.v.....y....,Gg.{/....ovFh_N2.<[t......n..M.
E.wZdd..C.1..~''."~cw.\.......~|.v.....'..^..={q..Cl......?=:...uo....
g_.<....'...8...N.~......qWR.l`....f.|.V..ooXt..{S.^.V\.....Y`!....
Fg..4....:.X...{.@...#.##...u.....eH.j..l..n...........~9^.4>.@%...
.d..C..e#d<.....^..d.TI.M...t#I]...E1P..Uj9...' .v...,.&..G.26.<
t...0...q"....:bK......P.Y~.......qd.P..R..../..$..._.E..4@B/.ut.y...`
.A8sP@.[\X.."..|...6.....W..;.m..'.....f.ev.N(.j2SA...S.be..&....p.P.&
...q..,.$a.~}?..<\!..a..k.1...o.u|....7O^..T..<...'.............
.'..g..>.^.y.........G._... ......'._..l..u....:yu...._lo.:.......G
......T.........6.>.......W..&....q.*..y.:V....G...Em..g.n....s#.n/
.B...f.4Tu..... ).:Te.......g|...> ."([email protected].:Q...T
nQ.......U....)R...]m:.....z1..FD...E....d.R..Z...q8....U.P..$U5@.
<<< skipped >>>


GET /vataframe/b.html?_=20120830&rnd=homeadSy HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:38 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0..HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 09:24:38 GMT..Content-Type:
 text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: kee
p-alive..Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT..Content-Encodin
g: gzip..Server: QWS/1.0..48a.............Vko.6..._..[..z.MS,[email protected]
].m_.P"e..H....E...)Y....a..y...{I..........Ej.H......9'Q.e...g...
<<< skipped >>>

GET /vataframe/b.html?_=20120830&rnd=flight_active_dynamic HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=couplet_load HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=ad_home_leftAD_bottom HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top2 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:40 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=topicLinkR HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:40 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /suggest/livesearch2.jsp?lang=zh&q=北京&sa=true&callback=top.XQS_1403774683926 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:41 GMT
Content-Type: application/x-javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
84..top.XQS_1403774683926({"userInput":"......","c":0,"result":[{"type
":3,"country":"......","key":"......","display":"......(BJ)"}]}.);..0.
.HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 09:24:41 GMT..Content-Type: a
pplication/x-javascript; charset=UTF-8..Transfer-Encoding: chunked..Co
nnection: keep-alive..Server: QWS/1.0..84..top.XQS_1403774683926({"use
rInput":"......","c":0,"result":[{"type":3,"country":"......","key":".
.....","display":"......(BJ)"}]}.);..0..



GET /AP5Min.aspx?AID=9842&TID=1974&Auth=1D705CD055EE5F1DA0B198994432BDDABFD05BDEC4C1B2DBD592146C65F203BE&referer=http://VVV.cfmogu.com/&utz=1403774656442 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:07 GMT
Content-Length: 219
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://lw.q1
.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1
&track=1974|9842">here</a>.</h2>..</body><
/html>..HTTP/1.1 302 Found..Cache-Control: no-cache..Pragma: no-cac
he..Content-Type: text/html; charset=utf-8..Expires: -1..Location: htt
p://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=
1&track=1974|9842..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.50
727..X-Powered-By: ASP.NET..Date: Thu, 26 Jun 2014 09:24:07 GMT..Conte
nt-Length: 219..<html><head><title>Object moved</
title></head><body>..<h2>Object moved to <a hr
ef="hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==1
4516&check=1&track=1974|9842">here</a>.</h2>..&
lt;/body></html>......


GET /AP5Min.aspx?AID=9842&TID=505&Auth=1D705CD055EE5F1DA0B198994432BDDA9802E06B2D9FD0B1A4732DC48A795461&referer=http://VVV.cfmogu.com/&utz=1403774659708 HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://js.union001.com/PClick.aspx?AID=15235&KEY=6FBCE2FEBE3F1F4B34035BDB1B9868C2CC3F7B0F77DABDE2
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:09 GMT
Content-Length: 218
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://js.un
ion001.com/PClick.aspx?AID=15235&KEY=6FBCE2FEBE3F1F4B34035BDB1B986
8C2CC3F7B0F77DABDE2">here</a>.</h2>..</body></
html>..HTTP/1.1 302 Found..Cache-Control: no-cache..Pragma: no-cach
e..Content-Type: text/html; charset=utf-8..Expires: -1..Location: http
://js.union001.com/PClick.aspx?AID=15235&KEY=6FBCE2FEBE3F1F4B34035BDB1
B9868C2CC3F7B0F77DABDE2..Server: Microsoft-IIS/7.5..X-AspNet-Version: 
2.0.50727..X-Powered-By: ASP.NET..Date: Thu, 26 Jun 2014 09:24:09 GMT.
.Content-Length: 218..<html><head><title>Object move
d</title></head><body>..<h2>Object moved to &l
t;a href="hXXp://js.union001.com/PClick.aspx?AID=15235&KEY=6FBCE2F
EBE3F1F4B34035BDB1B9868C2CC3F7B0F77DABDE2">here</a>.</h2&g
t;..</body></html>......


GET /AP5Min.aspx?AID=9842&TID=1960&Auth=1D705CD055EE5F1DA0B198994432BDDA3917ED5FBEB46EB462D92AC5B17DDEC6&referer=http://VVV.cfmogu.com/&utz=1403774660520 HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://VVV.you1ad.com/tuigoo/1.html?uid=14516
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:11 GMT
Content-Length: 162
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://VVV.y
ou1ad.com/tuigoo/1.html?uid=14516">here</a>.</h2>..<
/body></html>..HTTP/1.1 302 Found..Cache-Control: no-cache..P
ragma: no-cache..Content-Type: text/html; charset=utf-8..Expires: -1..
Location: hXXp://VVV.you1ad.com/tuigoo/1.html?uid=14516..Server: Micro
soft-IIS/7.5..X-AspNet-Version: 2.0.50727..X-Powered-By: ASP.NET..Date
: Thu, 26 Jun 2014 09:24:11 GMT..Content-Length: 162..<html><
head><title>Object moved</title></head><body&g
t;..<h2>Object moved to <a href="hXXp://VVV.you1ad.com/tuigoo
/1.html?uid=14516">here</a>.</h2>..</body></ht
ml>......


GET /AP5Min.aspx?AID=9842&TID=1961&Auth=1D705CD055EE5F1DA0B198994432BDDA01EC416CFBC47FB8F19D49E35E521FAA&referer=http://VVV.cfmogu.com/&utz=1403774663192 HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://counter.ztgame.com/ref.php?ref=2343627&return_url=http://xx.ztgame.com/index_gc_ad7.html?ad=2343627
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:41 GMT
Content-Length: 239
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://count
er.ztgame.com/ref.php?ref=2343627&return_url=http://xx.ztgam
e.com/index_gc_ad7.html?ad=2343627">here</a>.</h2>
;..</body></html>..HTTP/1.1 302 Found..Cache-Control: no-c
ache..Pragma: no-cache..Content-Type: text/html; charset=utf-8..Expire
s: -1..Location: hXXp://counter.ztgame.com/ref.php?ref=2343627&return_
url=http://xx.ztgame.com/index_gc_ad7.html?ad=2343627..Ser
ver: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.50727..X-Powered-By: ASP
.NET..Date: Thu, 26 Jun 2014 09:24:41 GMT..Content-Length: 239..<ht
ml><head><title>Object moved</title></head>
<body>..<h2>Object moved to <a href="hXXp://counter.ztg
ame.com/ref.php?ref=2343627&return_url=http://xx.ztgame.com%
2Findex_gc_ad7.html?ad=2343627">here</a>.</h2>..<
;/body></html>....



GET /imges/live2013/logo.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vr0.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Content-Length: 4111
Cache-Control: max-age=31104000
Date: Wed, 04 Jun 2014 04:35:11 GMT
Content-Type: image/jpeg
Expires: Sat, 30 May 2015 04:35:11 GMT
Last-Modified: Mon, 02 Sep 2013 08:45:57 GMT
ETag: "246892552"
Powered-By-ChinaCache: HIT from 13002723SH
Age: 1918160
Powered-By-ChinaCache: HIT from 060108b3SD
......Exif..II*.................Ducky.......O..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
1 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmp
MM:InstanceID="xmp.iid:22A6BBA813A911E38CBF872E69BADB11" xmpMM:Documen
tID="xmp.did:22A6BBA913A911E38CBF872E69BADB11"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:22A6BBA613A911E38CBF872E69BADB11" stRef:d
ocumentID="xmp.did:22A6BBA713A911E38CBF872E69BADB11"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................d...............................................
.............................................!1..AQ...a"2..q...BRb#35.
..r.$4e..S.t...U.('........................1A.!Qa."...q.....2BRbr.....
...S.T.............?.......Q .Rvl....L......P.........R..O..G.z.1....?
L..g..-....).K.].K..2%....t..g.c...3..q.2[JCM..\......I.==..s..v..^.&l
t;....WT..-c~7.....i9z..K..!nFk.0..mf*)O@[email protected]...
.'z..q.R"..=u.6.....0....F.jEv..l.{.V....*<...DC...O`. ......%J
<<< skipped >>>


GET /qdlm.html?uid=14516 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.tudou58.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:14:58 GMT
Server: nginx
Content-Type: text/html
Last-Modified: Thu, 26 Jun 2014 06:45:51 GMT
Transfer-Encoding: chunked
Content-Encoding: gzip
Age: 571
X-Via: 1.1 zjjhdx34:8080 (Cdn Cache Server V2.0), 1.1 dls20:1 (Cdn Cache Server V2.0)
Connection: keep-alive
d53.............Y[s.... ..k.!...Y".ib.....'VzS...,IX ...(Y....z..O2.8.
3}H..u..N..8M............ )...)m............~im.....N....WO.?.. ....5.
8.~.......YM.....c7q......E.;I........Y=.... ..a.......-.... .r.......
,3.KKj1...YY.....IX..z.....?.~RY.................."1{I.......M<.rp.
...O.n.`..........?....?..w.........l(..8.....X...._..;..Z...m.2h....k
Z.V;.z.S../...X.Zm.@T%v..:...tb5=...%...\_T:.mw....<.2p.m...q.Y.u..
.{...A......h.\?.%l..:I.;,.......~..N.gq..>.e...9D....5.n.L......%.
.. .Z^.....`\DQ...g...X...[A.XO...0P.S..g%..h.$...y..l(q/.v...K..T.W.m
K...V....Y[$....j!}.....E...'.d{/.D.{9..*Vg.*m...L..".p}.w........caEv
...a..}..h...5.KX]....... ..y..m^lD".E>.4...Vbw.H....#.....rnrf.zE.
{M....=...N.V,...B.1.d.Sv.1^Rn...p...S...-..DDl'.S..mL.Q..=6(CR...%.A.
)..R.qc....r$.n..(C;...e)D,. ..60u.;.$pt$)O..X......l....b..>q.id.A
K.g......bQ.j.g..<R.1..........x..O..s...8.CX.v.%... 1.....Z]....Nq
.0.,..5.....b..zN..`....;L...oP.Q.c.'...VX.W...K*....CZ$.....<.....
........r.B26.$...7H.4 ...x..qDZ..:...y...V.E...lU2...N.p3..NW6.:>.
...f....*.."..3u..cr8l..4.\.R...@..}..v...E. ..AA@D.=..A...n....I....b
.........J..Y.Ax&.%...D.....F.XIGG t..V|^...K...cp..k3.*.Jm.?WR.)@...r
..|6..V:3?G3..V..U....yL..d.......n.....~....K....O..s.....\..........
..s...]...r..c.....Y.5wq.."5!f..B>1o.Dn.Nln.|......dS.....d..]Q..T.
n.@..#.......h....$..s9.....Y...<\y..xG ...n8..C:.M5...\d>.Y.3{R
......u;.B.i^.4;u.6.0>.(R8.....])q...Wc....M.~.A7?:DK........%|....
.g|..]/HOZ.~.i....[.d...O..a..^z....Y....Nf......a..I...).$3y.k.?#
<<< skipped >>>

GET /swfd/bd/4c/chuanqi86/index.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://t.tudou58.com/qdlm.html?uid=14516
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.tudou58.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 08:14:16 GMT
Server: nginx
Content-Type: application/x-shockwave-flash
Content-Length: 370
Last-Modified: Tue, 10 Jun 2014 10:33:09 GMT
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjhdx40:80 (Cdn Cache Server V2.0), 1.1 dls20:1 (Cdn Cache Server V2.0)
Connection: keep-alive
CWS.X...x.}[email protected]...~.A#..w...]....]H.>..t.&.6m..c..e.c.......w..
$....s.~9sg.`?..=....*h..b.8.4....-.=7..W......0.V$;S?z......8......1.
.....1.&!&.ek....E.U...5.C..\[[email protected].{n..dp.XS..tG..VI..;..8..a
.1.`f/.....pz........3.......s......eB7....Q....m..O.".,.3..Z.Zq..DY..
uQ..<G9..x.&.;...*.U.........D.).W.Y..M.....q.j.CEA"y..E..8.\Q....\
....?...w..2b....6pF..B.k.HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 08:1
4:16 GMT..Server: nginx..Content-Type: application/x-shockwave-flash..
Content-Length: 370..Last-Modified: Tue, 10 Jun 2014 10:33:09 GMT..Acc
ept-Ranges: bytes..Age: 1..X-Via: 1.1 zjjhdx40:80 (Cdn Cache Server V2
.0), 1.1 dls20:1 (Cdn Cache Server V2.0)..Connection: keep-alive..CWS.
X...x.}[email protected]...~.A#..w...]....]H.>..t.&.6m..c..e.c.......w..$...
.s.~9sg.`?..=....*h..b.8.4....-.=7..W......0.V$;S?z......8......1.....
.1.&!&.ek....E.U...5.C..\[[email protected].{n..dp.XS..tG..VI..;..8..a.1.`
f/.....pz........3.......s......eB7....Q....m..O.".,.3..Z.Zq..DY..uQ..
<G9..x.&.;...*.U.........D.).W.Y..M.....q.j.CEA"y..E..8.\Q....\....
?...w..2b....6pF..B.k...



GET /showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A60AAB6420FBCFD38A74E8F7A85C55E29907E532FC72AB49DAD&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Wed, 31 Jul 2013 15:22:38 GMT
Accept-Ranges: bytes
ETag: "0b345ca18ece1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:13 GMT
Content-Length: 2942
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...L_~....I..
.....wr...7O....o.x...w.7u.l....Yy........m.zt........../..yu..`..e.u.
......GG.q.._......,.g......4...~..6#\..v.....g..T.6_..o.W.G.T....6...
....t..M.~.n...>J..L[.e~.........&..:m..2...EV_..G;.w..D3..U{....eV
...U1k..g.E...M...9}........(.I.../....v...</..m..|N..........V[]T.
....lW?YTM.*......}..-.y.f..g..*}.....1A.C.o..F.....E/...e%s.._....q..
)....*.....g~&....;....u.L...G...=J...../9.%. hG......'.........0&.We.
<?o...W...R....3..M.J.`.W........p._T.9............^..Yu5./..CK^.._
..E`i...j.-....F........e..2[.....f/.:[4...ZV..o...q..4m..{g........~.
D~.........0-............'.p7^?....|.......wR....<........>...U3
..e.L.Un..~.. ...,.Wu...r..............GP.....W.X.K.n...........~.1>
;......|...x.M..\.9..c.!u~..G.......j]..............?)..........}...E.
.......~.6..j..n........Z.]....*........Q:..Y^..Cz)...=.x...%.......J[
.w..~:......n*....fok.]..Y[..l....n..c&...[.}........Y..{.4L[.sR'.Y.. 
......BX.........V.`y.............9..VJ.N....1 z]e5..{..?..Y~.........
W....vF{.....z....3b.k4..T...o/........=..._3....J..U..;$'........>
%.a..;..5...O#=..w.?].....~F..=......M....w......loCJ...~z{...|..g.}..
.W..u8.YsU..y.._..R?..4k..cC..i.....uO"KzaR..[.i.k...;....'....?n|Cg..
....^YU .........*............A._7..*37$.q...<k..............."..c.
....D.......b.i_..n|g.j..$....%7.o..7..c./._7.3%-..w....)f..........=.
....T.....wf9.^......c-No8..O..Ue.>.UE...i.c@/}..o.........O..6
<<< skipped >>>


GET /history/newhistory.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: history.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:38 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 18 Mar 2014 14:18:23 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip
Server: QWS/1.0
ce2.............[ms.6..,..F....-J.....t. .k.y.J.......m..H....l..... .
.;N.N..L...bw.`.......O.{..X...x....x..l.......h:2......^.`L.?JC....t.
..;Fg.....~.....I/N.......u.q...9.w...............u;...?z..8bA...W..c.
D....3....l.'i..w.........$\3.A....?...............#..a..Io..:..?..0LY
.\y.....`.^,...h..1..#.7\..Xk..O..&..B,......%........m..J77...K......
.........^8........c.............1>..........r...3h >...#.07.<
;8..`n...u1<....1p.-.At.<..6.%ujQ.a..Pr....a. ...o.ms...Z..2/v{.
X.\......,HL....c.......]....1.Y D....[.maG...9.G..f.=..i..,^...mt.3..
...??............iP....(.....T.g..\.M. .....g..7/..\....5=.F.*..D.M..?
. ..5.x..l......C<.Y..>..C.c...g:F...y....~.Z....'.....O.!.....w
...e.\...QB1.........../-V..2u...h..i/]/Cf.C...<Np.%F...!....{. .`.
..v.cf....."...D:)J-.....'...Z$.`.......J.[.rZ..:.AI.%.E.R..Y....p.y3.
!..F.......eS}.v:.P6...e s......g.P.t.^.,.B.k..A.......!......Y.M..g.q
YY0=. ..F^..3.e.;}...9m....o;.(.......A.........).N.W........p...?....
..... .N....T........`.....P[.,dW\...a.C.t.....B..._Dm..x.).1b...Y...N
b.#E...G.....I.rX.G.g......#.h..L3.......X\.%*$'Q.......H..!.,....|.!.
... ..... ......w.U..5D ...$.`...O<..d....=....Y....e.A....G..#...f
...&][email protected])..K9.:.....W:....T.Z .W5o..r-,5.N*....Sfd. ..
.5..(.)I.951Y..E.E......[xC...7..7..t..^.?(..B......D...r..D.t..,.%I..
i...s...;.<..y..I.....k....X...}f(C;b....X.....l.:......Gx9wW.?...u
....F..X.^%.....).^g_P........P..X!.f......VX_..ay. "[email protected].
..K..ZgKK.x.A!....?Y.d.....r8n.......i..._.P.......$.Gm..".H..x_.o
<<< skipped >>>


GET /live/2014/06/07/22/1013v1402152081287210157.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi2.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ngx_openresty
Date: Sun, 08 Jun 2014 18:08:06 GMT
Content-Type: image/jpeg
Content-Length: 18799
Expires: Wed, 03 Jun 2015 18:08:06 GMT
Cache-Control: max-age=31104000
ETag: "4266272576"
Last-Modified: Sat, 07 Jun 2014 14:41:21 GMT
Accept-Ranges: bytes
X-HITS: 0
Powered-By-ChinaCache: HIT from 13031133W2
Age: 1523785
Powered-By-ChinaCache: HIT from 06010923Sl
......JFIF.....H.H......Exif..II*................ohXXp://ns.adobe.com/
xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011
 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="h
ttp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.ad
obe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:DC2D375A1556E21189
44D025EC2D7FEA" xmpMM:DocumentID="xmp.did:C22E621EEBB311E387EC83C84452
C778" xmpMM:InstanceID="xmp.iid:C22E621DEBB311E387EC83C84452C778" xmp:
CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:F7B1E97DB1EBE311B629933DE223DE94" stRef:docu
mentID="xmp.did:DC2D375A1556E2118944D025EC2D7FEA"/> </rdf:Descri
ption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
;...C.....................................%...#... , #&')*)..-0-(0%()(
...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((.
.....f.............................................X..................
.......!..1A."Qa..2q.....#BUf.......$3CS....Rbr47...%DVW.......su.....
..............................>.......................!1...AQa...Rq
.."S....2...4.#3Bcbr$C..............?...{i......N...^..2.g..]..B.YH$..
.=.1...:...^..3..<...\.....u.....(...;......6...n..|~>......~...
6...n..|~>......~...6.........._.(Y'...._...,..O.m.qI........g.
<<< skipped >>>


GET /images/v8/s_index/banner/2.jpg HTTP/1.1
Accept: */*
Referer: hXXp://xx.ztgame.com/index_gc_ad7.html?ad=2343627
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xx.ztgame.com
Connection: Keep-Alive
Cookie: uniqid=1406261724512128767627; ref=2343627; date=2014-06-26 17:24:51; ref_date=2014-06-26 17:24:51; ref_ip=193.138.244.231


HTTP/1.0 200 OK
Date: Thu, 26 Jun 2014 09:06:12 GMT
Server: Apache
Last-Modified: Fri, 13 Jun 2014 11:49:23 GMT
ETag: "14b8104-1fd074-4fbb644c196c0"
Accept-Ranges: bytes
Content-Length: 2084980
Cache-Control: max-age=3600
Expires: Thu, 26 Jun 2014 10:06:12 GMT
Content-Type: image/jpeg
X-Cache: HIT from CTS-GD-212-18.fastcdn.com
F-In-Cache: father-in-cache
Age: 1128
X-Cache: HIT from CT-ZJWZ-251-70.fastcdn.com
Connection: keep-alive
......Exif..MM.*.............................b...........j.(..........
.1.........r.2...........i....................'.......'.Adobe Photosho
p CS5 Windows.2014:06:13 18:38:25.....................................
...............................................&.(....................
.............X.......H.......H..........Adobe_CM......Adobe.d.........
......................................................................
..................................................................C...
."................?...................................................
.......................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5
....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw..........
..............5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.
T..dEU6te......u..F...............Vfv........'7GWgw.................?.
..?Y....f7.......n..d<...~%.....E....~.}f..e.u.W...x;...p......u...
.UZ....I....tgu....3...!..Kv..d5.B.[.........bf.^.....>f.N.j.*.....
.)[email protected].{>.........].#....U...o..u..fS...r
......g........^5Y....v.Z..n.i.....o.oj&:wH$...../..3\:.}y]2.e.cwn....
X....~..i....Gb.O...y.T.. p ...C..=.c..o....}].....^. }......k.GlO...}
..k.....Y....}t...m.c.K.w.c~..!q......G._L.=K.....M.3.;).).=...6......
..g...u/. Xs..f;.!.....W..4........._....y.cm..{Z..Z...Cy-......g.Z.'.
W]..a.:.P...H6Tgw.~.S......=?.........l.........q.{Z.......#......o.Vg
V....m.....d.^....n..Y....w./..]0..s..r-.. H.Z7z.7.....~.O"..K....,...
...:{k}y...K73.-...MS..\.._.'.W..#....~5O.f=[...K..6......QmM..c..
<<< skipped >>>


GET /stat.htm?id=4693566&r=&lg=en-us&ntime=none&cnzz_eid=2026431406-1403774660-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=296133721 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hzs9.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.4.1
Date: Thu, 26 Jun 2014 09:24:22 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 28 May 2013 02:57:17 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..



GET /ips.jcp?callback=QNR.ips.callback&_=1403774681817 HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:37 GMT
Content-Type: application/x-javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
Content-Encoding: gzip
38.................,(.KN..IJL...VJ.,.T.Rz.3...5J....#...$.....0..t>....


GET /airCoPromote.jsp?airCoList=CA,SC,CZ&num=5&callback=AirLineDeals._parseData HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:38 GMT
Content-Type: application/x-javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
Content-Encoding: gzip
a9d..............{o........Z..s.PY..!8.RT..\U...&...."...T.."..J.%...H
Q.V1-.P.|....E..`.93......0kF0..{y......lg1...Bo........... ..t.......
...g.]g.r.hk...7.<l.nu.[..^...........1".....vv5.e...a6...a.=..~w..
....x..e....,...]..^XYY>z...K.&...h..n..#.........p.......%.~dza...
).L:u...).n.:.5....w....:./......v.....?;...O.q....Lm..!.....%xb4.... 
.n.t.N..>U<....}.|[email protected]...<:=.tqq..SL......Y#
.z.........../........UaX.m.Pi.0de.."N|DF..C (*f.W.I..r)B:.ZW.q.p.....
Z........jU......f1A2..W7...s.R=v..y.X.sq.9f.p...{....*.#..{..T.. ..6.
hc^.,.T.U..j......>x5..<[eX.m....a.....".....\y...R`.......\..R.
.5.......l.....8{.x.D\..S.......V(..w.F..V...h.\.......C..b.........g.
...;[email protected]([email protected]...&.L...'.k....W....su#QV(">.
"..s........{c....Ft.9E.|.L...7.._..>..yp...V.~.y.i.........>..3
.. an.U.|q..f&3....N.(..F.b.D..w.[..T...&..&.)..{.z...B.Z..F.9>..F*
.6CH.f.Bx........F....q.....-...s.:.........|1....i.&..._.."ov.3.YF..M
.......">[email protected]..[....a...O........dUXV?N.....@12".c
.;....y.s.".:.....G...j..*|....a.*l.,........L7NY.3...j........".s...H
d..=.:.r....Uw.......V{~D.Ny..)'.K.........D.?.v.t.%..D;....S.........
f(c......!...p........3..`...Ig(\.............,n1.&....,.s......x....U
.rZk.E.r..s....z#..y1_..[Zo..Y.7R.7.rK.%!.q...9...."a=..,.}.k.,...qC&l
t;..;.6.|....z;....,n1.&d:#.aK.P  (..Kn.W\.g.....<..H...l.-........
......I...W.k...,..h.1...XY.<.... ..&.f.....5..p.i/.?..../..6......
....8...)r...Em.F...........H..^....j.8>.8....Q..@.&.xR..!...:.
<<< skipped >>>

GET /lpisearchd?callback=jQuery15208817795147039577_1403774679881&from=&to=Hot&month=All&cachefrom=&cacheto=&type=rt&source=fhome&_=1403774683926 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:40 GMT
Content-Type: application/x-javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
Content-Encoding: gzip
1de...............J.1...%W..H2K&.)...R.XA.azQJ/.*..\.."n.......|.f.oa.
....;........Y..x~......B.......s.....#.^.....H>. ^..W...J.D5...#u.
..k$G..A..gj..,..A.6<..z!(/yZ..Y.u.fF.GD.................V.rQo.....
..2......V..E..?..,<5Af.`r.... .....z.....r..0....E...)...s..X i..y
.m.m7.j.R.."....f......tW.[.. %.XI...O....B..V?.Mf............J..6.T..
no...]w....X........1.....;.*vb.cK(.....o4........h...{........^G".5..
.F.........D].YA;p..[.>)..[..Edq.3..5.I.18...y0!..9R,.......'...d:i
o......0..HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 09:24:40 GMT..Conten
t-Type: application/x-javascript; charset=utf8..Transfer-Encoding: chu
nked..Connection: keep-alive..Server: QWS/1.0..Content-Encoding: gzip.
.1de...............J.1...%W..H2K&.)...R.XA.azQJ/.*..\.."n.......|.f.oa
.....;........Y..x~......B.......s.....#.^.....H>. ^..W...J.D5...#u
...k$G..A..gj..,..A.6<..z!(/yZ..Y.u.fF.GD.................V.rQo....
...2......V..E..?..,<5Af.`r.... .....z.....r..0....E...)...s..X i..
y.m.m7.j.R.."....f......tW.[.. %.XI...O....B..V?.Mf............J..6.T.
.no...]w....X........1.....;.*vb.cK(.....o4........h...{........^G".5.
..F.........D].YA;p..[.>)..[..Edq.3..5.I.18...y0!..9R,.......'...d:
io......0......


GET /holidayService.jcp?count=2 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://flight.qunar.com/site/main.swf?20090107
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:42 GMT
Content-Type: text/xml; charset=utf8
Connection: keep-alive
Content-Length: 37415
Server: QWS/1.0
<?xml version='1.0' encoding='utf-8'?>.<root>.<airline 
from='......' to='......'><line date='2014-06-26' go_start='23:3
0' go_expires='01:40' back_start='23:20' back_expires='01:30' go_avc='
........................ HO1254' back_avc='........................ CA
178' go_isNew='1' back_isNew='1' go_update_time='33...' back_update_ti
me='3......'><client name='..................' price='706' disco
unt='6.2...' type="go"/><client name='...............' price='76
6' discount='6.8...' type="back"/></line><line date='2014-
06-27' go_start='11:05' go_expires='13:20' back_start='07:10' back_exp
ires='09:45' go_avc='........................ 9C8992' back_avc='......
.................. 9C8991' go_isNew='1' back_isNew='1' go_update_time=
'0...' back_update_time='1......'><client name='................
.....' price='439' discount='3.9...' type="go"/><client name='..
...................' price='439' discount='3.9...' type="back"/><
;/line><line date='2014-06-28' go_start='11:05' go_expires='13:2
0' back_start='07:10' back_expires='09:40' go_avc='...................
..... 9C8992' back_avc='........................ 9C8991' go_isNew='1' 
back_isNew='1' go_update_time='2......' back_update_time='8......'>
<client name='........................' price='420' discount='3.7..
.' type="go"/><client name='.....................' price='497' d
iscount='4.4...' type="back"/></line><line date='2014-06-2
9' go_start='11:05' go_expires='13:20' back_start='07:10' back_exp
<<< skipped >>>


GET /tpl/hw_ddsb0618/main.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p=
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gm3579.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:37 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 895
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 09:49:23 GMT
Expires: Thu, 03 Jul 2014 01:55:29 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
Age: 26949
Via: http/1.1 4399_cluster (CDN CACHE V1.0)
CWS.W...x..UMo.6.~.|X].%... [email protected].............;.
.f.l9...n. .z..y..!M..k....W.............v...a.Qga.qSfG......t:.NkU..#
.j...#].HD._F..*.?(w.L.O.....Y..99c.qT./ega...x.x..V]......j(.. .J(.,9
e,.tS.....U....$lD9.S.....o.i_..]........0...................Ar.Q....&
lt;.....q.|...3..]~........>.O.]..O. .#.E4.!......R.5G,....8.|...hV
.c.....Z.....5...$W6.<..a.r4.C:z..O/c....I.R.?X....<.. .K....Q.}
.l.6v..n...]...wm...X..-.....M.......-....v...}....<....6[}..|....x
...a.p...kt-....H.j...A='aa..1I8M.:*.V.6e...=6..ia.Ps5.....>l.[....
.Z...v..4...[..\....E..?6......k..?.hy.uT..WWW.....~........G4....|p..
..cq9`.>..?.Fq.'|.|::!b....!`....D.......gZ.7......p...Y|..pv....VF
[email protected].`...(..y.....EZ.{=..%.(X/(k..t...%(.d....7.O...%
.\....Y."QRtSy...J.....|.|.|^..!.k.U9..K.]z.6.i..e*9hK....g..Wy...e.(.
..i..{*.?....Rw..7.Sl.?..._e..o.........p3.K...../.!..R....E.9..[.>
.._......HTTP/1.1 200 OK..Server: nginx..Date: Thu, 26 Jun 2014 09:24:
37 GMT..Content-Type: application/x-shockwave-flash..Content-Length: 8
95..Connection: keep-alive..Last-Modified: Wed, 18 Jun 2014 09:49:23 G
MT..Expires: Thu, 03 Jul 2014 01:55:29 GMT..Cache-Control: max-age=604
800..Accept-Ranges: bytes..Age: 26949..Via: http/1.1 4399_cluster (CDN
 CACHE V1.0)..CWS.W...x..UMo.6.~.|X].%... [email protected].
............;..f.l9...n. .z..y..!M..k....W.............v...a.Qga.qSfG.
.....t:.NkU..#.j...#].HD._F..*.?(w.L.O.....Y..99c.qT./ega...x.x..V]...
...j(.. .J(.,9e,.tS.....U....$lD9.S.....o.i_..]........0..........
<<< skipped >>>

GET /tpl/hw_ddsb0618/bg.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.gm3579.com/tpl/hw_ddsb0618/main.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gm3579.com
Connection: Keep-Alive
Cookie: CNZZDATA1360447=cnzz_eid=1627145524-1403774678-http%3A%2F%2FVVV.gm2468.com%2F&ntime=1403774678


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:41 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 86204
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 09:49:22 GMT
Expires: Thu, 03 Jul 2014 05:05:04 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
Age: 15577
Via: http/1.1 4399_cluster (CDN CACHE V1.0)
CWS..a..x....X...6.00@...'a....e... ....AC ...w...[.....!$x !....r.>
;..s.s.....y.z....Z..........#U..... $...$#....w .1m9......J.wJ.....M.
......[......OTT.....................(.....5..........g.....C...o.>
.n.....6.r....tu..1w........................O-...9.....jc.B..7w.....\P
.O{' ..........,k....?/. ./..OX.OXL@D.....[...._5.j.f.ane.a.o.E.b.....
G....7sW {......jB%x....mn...9...<..Fyh[..sm....5..5.......:..ZGMML
...a.bi.,'.;....J....SPP..>V.........e.e....`...E.R..k.w49WKOgk....
Y._......4..m......*/...../,.W.....$'(.XV.W._PTVA..............J..../.
.f.....)I..S.'M..W..?.$*/(.'* .....0.;.....o$a>>^.,..hpQ.AyY~9.0
/.........."..r........K.. O.c......u.tw.K.....v...i..^....ae)f...l.!e
...doi.' ................!.....i.x......,....4..w...^b.U..0....M......
...;..>..U@. %"}@GD.B...FGKLF....&&...BKG........!......#$.gB.....K
...O..2rr........y....iYy.a.bB0^....0qq.?.%E.xyy..$.L...a.........bFa.
.0..L....q.....$...............B.`.0A...?,[email protected]&..v.O.a3
=...C.....9(.NPV...C..<.f...J....F...o... L...L.?........U......'.i
...#...V..._.....o.r.!r2rrX.\...\.Ci...}...&.......T&..I......._s.&..2
...W...WW.......o$e....Sx7=.|T.c....<W..Mz.............].Dls.......
..5.8.V.lU.._..p.0s..J.}...H.3CC.Z.`A.Q...p.=@..[,..h....A...u......b.
.f..H.Fa..O(NS&b."U. ...w......</.?.bl..Rv.%.n[^..#...^C....x.9.q..
...;!.R.......m..-......C.2.....0m.$.nG"u..;..G...."....z.......%sBk..
...T..v.&c...37<..'.I.....6.4.X...Q]9Ig..&.*..3-....o......S.......
]...,a...w..%.....e.j8.....g<..9....G.%D.D.NNN.B..`..( Xr...C"o
<<< skipped >>>

GET /tpl/hw_ddsb0618/top.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.gm3579.com/tpl/hw_ddsb0618/main.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gm3579.com
Connection: Keep-Alive
Cookie: CNZZDATA1360447=cnzz_eid=1627145524-1403774678-http%3A%2F%2FVVV.gm2468.com%2F&ntime=1403774678


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:46 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 43222
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 09:49:24 GMT
Expires: Thu, 03 Jul 2014 02:42:28 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
Age: 24138
Via: http/1.1 4399_cluster (CDN CACHE V1.0)
CWS.....x...wXS..6.Z.....B..{....."$.....4.[.((E.........."UD@D. ..PO.
..{......}...go.....Zkf...{..8n..V.......&...w)....9..Q.XM.r....W.s'.u
..............B8..KKK.......cj...y......e.*@....|a..o?./O........<.
......_`=}...^...0/...v....B..8.J2...;?/.......E-.....3..........s..^.
..C..]...1)a9....o...0........................*.7m....T....n.g....~7..
....W.ws/..c...._kB...M&..........!.........^..$..A.......s.Tg..;..2..
.~v.0.m5..A....#).....!...!..*,,%...*.*),"*.*."}...7.......p.........7
M..]C.8.`......."..*"...!~..,.&....!.."&..!...........................
...I.E... ....I.....M....1 q..).a.uU._h...b.."j..B..*jb....../...M..C.
._:..y..=.....Po......a.....l..Q*|..p.......O......fw.(x.......h....x.
.r......$.[.. .U...s5"..@*.`c...sP= F;..,.....{............./.T.@\<
.....HDL...a....(I...0w.........!.!1)%.....1....B.9/@....!..$......
...sP...C..q.....\..8XP.6....u..`...q.....s`.....]......qqq.....c.q.q.
.((.@(.......1>..u......=..Z....}.TJjA.....I~.......7.4:,...1a.p...
0E"`.66.......]....a...*[email protected]^_.
P!.53S..9.=y....K.AT.p?._..'..T.f..V...).5....).!..s.[Z5g.....1M  ^"..
.....oIY...HdB........Bg...V....E.]^^.lrD...j.B_.P..!.......8..H.4F...
...n....= ....c....Z.......UV.|I"....{.Dne}H..No...A.U<1m.....7..UJ
.I&.?..A....<zT.#.y.2A.n.k9...]..r...........r.L4V....X........D7. 
.4...j......WxH!....4Z...<_0.Y..N......a...j........!.1N?........i.
........S.,....6n.....<.............. o..Y3.....,.@..=...P$.M.s....
2..c..|........D...%A.{..e..q....{.........|.D.O.<4.`.[....q..N
<<< skipped >>>

GET /tpl/hw_ddsb0618/tc.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.gm3579.com/tpl/hw_ddsb0618/main.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gm3579.com
Connection: Keep-Alive
Cookie: CNZZDATA1360447=cnzz_eid=1627145524-1403774678-http%3A%2F%2FVVV.gm2468.com%2F&ntime=1403774678


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:47 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 10739
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 09:49:23 GMT
Expires: Thu, 03 Jul 2014 05:16:17 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
Age: 14910
Via: http/1.1 4399_cluster (CDN CACHE V1.0)
CWS.W4..x..zgT......T!.t.B...t..P..... H .%.P..A..Ho*H..{o...Io"M)....
.p.s.9g...........xW........k..0V0@....$u.........bb .../'g%..../...).
[email protected]..^.$....%$.%......8?,.. ...A...#..8G/......9zG8.{.U!..
`}1.......'w.$...#......JJ..............;.........s.1.rwF.pDx..G.T.G..
...v..U.R..g.?`!a.........9qi)3)Y%iE%.s...J.....%.KU..G8!..?(..K).I. .
.(II.Q..d.SwwB9..G....Q..'&.cn....].F.wi.......83?..........$.....}}..
X...uD^..'N@Q('%E.YY)E..........................q....;.........Cs..@..
..h.^.k(....T.................LGQC[CK......;[email protected]......<
bJ..;UG4............E.w4...HZJF^JJRNK.........4LC^RJN.&.;.....5...B...
..[b....{K;9.m.zx{..K......<..#.R..........A..#<<.(G.....8...
....A.;.U.......K.....<.......)[email protected].'.......j
.......$~..(...P$..S.......N.#0 8.....,T. _..i.ZS.Q..,.k?d.D\".....==.
...w....!.....zTf....L.z...............zn.......2....Q2..H.TO..n.d.$..
.=...q.....y...#.....G .,d.o.....-...6v..?.F|G..Sq=...!.........G.....
%..:[email protected]{.....LO..L..a
">G ..'.x.N.q...S.t`...)6........`J.=.....H. R0....":IB..E..FNABJ.:
AI\5d.@$d.$T'.(H(O....DF..f..JS0....4q..06...?rBF. $...{~s.....N..s.[.
..N8|...]" ;.W...#.d..%Q0.0.rR2...oK .0)#[email protected]...
....r!P.......;<..6..N.......o&..=....B....4\...f.R.y."........u.ng
).K....x.....{... ..<>{.d,2.....Y...d......k}u.J)...?....W7%..G.
?.l...B..~.ME>..6~.i..'... ..W.;....r.....vG.S."3B.z99.7t...z..d..J
Z...(c..I......eZj.. ..Zl<S.....r.........R}.&.X.$K.&..^.4$`.cv
<<< skipped >>>

GET /tpl/hw_ddsb0618/mu.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.gm3579.com/tpl/hw_ddsb0618/main.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gm3579.com
Connection: Keep-Alive
Cookie: CNZZDATA1360447=cnzz_eid=1627145524-1403774678-http%3A%2F%2FVVV.gm2468.com%2F&ntime=1403774678


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:47 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 41793
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 09:49:23 GMT
Expires: Thu, 03 Jul 2014 01:56:06 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
Age: 26922
Via: http/1.1 4399_cluster (CDN CACHE V1.0)
CWS.....x...UP.].6..58..........[.......].[.....5.....w...j.U.|.A...L.
..k...g..`/A .O....$........$....s/\n.......`A...>[........=n$0..P.
.....[=BU...`~...}......|t0.......'J$*.E.,...4U....S.7...........h.'..
......&!\[email protected]....(...V..........G.y.$
...?qP...r....AY..... .Y......?.bSJRb....|.@.`c3....G.....m ......<
.f.".&....I..x..h..?......3u.d.......C..q...C.`...xrM..._....@..&Lr.H.
.....yR..2...c..f.g....W.KH..7...nx...{..uA....e.}.m..R...-?.wd.j1].B[
..x  ...gr.$..w.U..fA..y-..'b|.j..(..4.,J......VG. [H.._..V.(.^..gy.wz
{F..............ECG.G.....RE...t.l...|<0E_1.....J...p....c.S%..xp..
............l.....:....f...ki..L..X. B.H.9X.......~@......$.Wf..4.<
..l.....w.O*j........-K.S..;(...W}..o.....4....y..d..V....q.(..H$.*...
.l.j..m.9..V.z={J....f.$..I.#..k....c...bM.... .tg.h.......s.uq..wL...
d...H..&awv9...S.R_..!`z.....&5..#..,J.$m...kNV4........u ZVn.kl.. .Oz
..xxJ...q}"..;.{..<>....[..8...S.n]3.d.j....v$.....Q>....M..-
........I..w...I.. "G..|...._N...y8....{.f.=}...!.;....q.j..OS..!._.ze
.OX.0S..o.......}.....&..xG.......g.c.u..h.'^~.0gq"%..`.."r...x.^.....
....OH.(BT.............[2/..G...4=..hh..T.._.>H..S..yW.T..S........
!.=!..D..l.A.$;..7o]..W.).I.mr.z.n|!.[r.b8e^N.o.y$/.6 ...ZZ.^lgQb[.. g
.....'...5j.;.nxX.\.'....aa ..(..ks.5.'.  ../vB.`......\./\..E..m.....
.....I.....[U..S.JL..o3..4....YX|............[..0..A..|. ...LF;.......
XK..D...L#.F..L.....L3.!....4.\..z.........k X.P....D.f.E...t7......*.
.fa:.C.E*:.e..Q.Gu...?...*.....q...A ...-"`Z.[..]-.W.'*;.m...>x
<<< skipped >>>


GET /_reg.php?tpl=1403085104&game=qs&dirtype=0 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: u.union178.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: application/octet-stream
Content-Length: 0
Last-Modified: Sat, 23 Oct 2010 08:09:13 GMT
Connection: keep-alive
Cache-Control: no-cache
Accept-Ranges: bytes
HTTP/1.1 200 OK..Server: nginx..Date: Thu, 26 Jun 2014 09:24:39 GMT..C
ontent-Type: application/octet-stream..Content-Length: 0..Last-Modifie
d: Sat, 23 Oct 2010 08:09:13 GMT..Connection: keep-alive..Cache-Contro
l: no-cache..Accept-Ranges: bytes......


GET /_regload.php?tpl=1403085104&game=qs&dirtype=0 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: u.union178.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:43 GMT
Content-Type: application/octet-stream
Content-Length: 0
Last-Modified: Sat, 23 Oct 2010 08:09:25 GMT
Connection: keep-alive
Cache-Control: no-cache
Accept-Ranges: bytes
HTTP/1.1 200 OK..Server: nginx..Date: Thu, 26 Jun 2014 09:24:43 GMT..C
ontent-Type: application/octet-stream..Content-Length: 0..Last-Modifie
d: Sat, 23 Oct 2010 08:09:25 GMT..Connection: keep-alive..Cache-Contro
l: no-cache..Accept-Ranges: bytes..



GET /common/hf/header_v12.png HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg4.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 06:04:15 GMT
Content-Type: image/png
Content-Length: 8997
Last-Modified: Tue, 22 Apr 2014 11:20:03 GMT
Expires: Fri, 01 Aug 2014 06:04:15 GMT
Accept-Ranges: bytes
Age: 12019
X-Cache: HIT from qunar_cdn_01
[email protected].$....gAMA......a.....sRGB.........PLTE
.....................................................................#
....................:::.f........................................j..}}
}................................................YSQ..................
.....................NML............,.....nnn......`__.........X......
....|D..........B........................kkkS....T.........sss|.......
.).....F....'.....................vom.........p.....FFF).....___F.....
...d................................SSS7.....xxxb..!v...J.....tRNS.@..
f.. .IDATx......8v.'.xI.^...L.4JT...B..UzHQT..F.....=3.%.e{.w._....`S.
..z...Jb.>.....p.k.. ..^.z?v.....k...k/.....(.GN..z......\..@>..
.oI....t.....K)'/I'........|......u.......¦.u\..y.....}.Olo.......du
~)...,W...............\ .......%E.L..N%9...E [email protected].....
 ;.\.R...y.&.h\....d{#..V....>9......%n..-%.$].._.4[;g........s...x
[email protected]?.ri..Y~=........Mr.. ...Z..]q~..%......... Y W.h....Y
A8.%...(....Ns).ricg..r.F.k) [email protected].{....l/.Q...z...p.k.}d.y.]
..:.7.;;.....A.Y.D..Wp../y.<.w7...S...."P#g..`.. ...... ..Wn.Y.u...
.A...r.........zA'........"./[email protected]
...`.?u..xF...l.p.-..K.A;.?.~...Y%.....v}........<...uU.. .L..YD...
(.#.aOV.N.<.{.-...S.T.)..5.........gb...#...<...WN.....7O.Dt..Gh
.>s.. ....#.S.%......z ....W...._^.r/Nr...S..|E|.<......{/.q9Z..
 ..G...&B./.i.}/./..7^.....N...C.W.DM.._.........Ajq.j0...7G..:.......
.......^.\..V6Mvw...;.....Y...&....n^..X...O.X\.... m..5.R.i...$..
<<< skipped >>>

GET /common/hf/arc.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg4.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 153
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 05:45:53 GMT
Last-Modified: Tue, 15 Apr 2014 08:15:04 GMT
Expires: Fri, 01 Aug 2014 05:45:53 GMT
Age: 13122
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR.....................gAMA......a.....sRGB.........PLTE
.....^.....: [email protected]...!IDAT..c`d``u`..`..a..............'.. ...
.....IEND.B`...



GET /site/images/wns/20140619_flighthp_tbut_230x200_4031.swf?clickTag=http://qde.qunar.com/event.ng/Type=click%26FlightID=114287%26AdID=209121%26TargetID=5800%26Segments=13,28,50,132,142,148,373,530,534,535,536,539,540,541,542,543,544,545,546,548,549,550,551,552,553,554,555,556,558,559,560,562,563,564,565,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586,587,610,611,621,651,844,978,1102,1143,1183,2587,3780,4054,4380,4493,4525,4548,4553,4605,4636,4648,4649,4650%26Targets=5302,29,208,1504,6877,7731,7675,6419,7678,5800%26Values=34,46,51,63,77,84,100,110,150,204,219,228,243,250,252,269,301,305,320,5402%26RawValues=%26Redirect=http://adclk.thinkmedia.cn/clk/pid=2468/media=quna/place=73gjp3/size=230x200 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=au
HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:42 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 42065
Last-Modified: Thu, 19 Jun 2014 10:36:53 GMT
Expires: Fri, 01 Aug 2014 09:24:42 GMT
Accept-Ranges: bytes
X-Cache: MISS from qunar_cdn_02
CWS.t...x...EX......C..w....n.....!x.....|.;.wVVV.......,ff5.<s....
...u...E.../....Dz._........M.*.o..,.........<@....A.UKa`.C.&@"._..
4.......=/3..1.............-........#..... ;'7.....\l......L....,....,
<M.X.>..~..|.6q5.f.....o.....F...7.S. ...a.....e...Y....^..S....
.J.... [email protected].".#&".#  .`.&!c '
 ...e.....NL.#........O.....d$d....VR.R............/..K  ..a`........}
. !.. ..``..........a0HYD`1......X.b...E....&/(......?~.........c.....
...UL\BRJZYEUM]CS................3 0(8.WhXl\|Bb.......................
?=.}...CS.3.s...K.[.;.{...G.W.7.w...O..... .[.Oq.............H.....aHY
`1D....0.X...Dc...........'.?R.oR^..._............/......|............
[email protected][email protected]@.C..%....[... .N..: .._~59)..~..)..N.....ci.....)...m
..........z...LC....9.P.;.FB.."?._F...O..7\.|y...H!.i]....C.)..1Y..j[.
(8n|..0"[email protected]&.O...GB!.^..f..0=.79....8.|.C. ........;PYw.i..
,k....=..<.C"....)Xh.....4.c~1.i>...b2?Z.F.&..#^.....N....w.7.h.
.-......g....S..i..6.`....o.....A..TVS..0........_.....j.S.k...J....sI
...~.}nhI.!..:.......wq...2..,C.....%j ..kC.\..*Wl..<.....h.\....A.
s.!. .(Mm'.q..ZB....X........0w..G....c).<..%[email protected].....[./..
.......I ....9w;W...".]H.4.]Y.y.?/H6.. !;.}..F..B...-.j.....\.-.:.v...
=...z....u{[email protected].'....X.NBn......~....q.}.}........
.../....L0...c.C'.O....i<I..H.mHa:.....1...O.Q...d...O...z.s.tk....
C..I....._....v$.......=.s.Z>i.)...E=...$...V.....V{r..G-y.-?;.....
..V......d....u..H.q....^....E.1NV...A..)Q&.....d..n@d.... .t..7Ni
<<< skipped >>>


GET /qs/201406/04/a19b826ff7e2033f6886324a.jpg HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Thu, 26 Jun 2014 09:24:47 GMT
Content-Type: image/jpeg
Content-Length: 1658
Connection: keep-alive
Last-Modified: Wed, 04 Jun 2014 03:11:18 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 1923208
Via: SX-119-115.fastcdn.com (DLC-3.0), SX-167-168.fastcdn.com (DLC-3.0), CT-187-196.fastcdn.com (DLC-3.0)
......JFIF.....H.H.....&Exif..II*...........................n.........
..v...(...........1.......~...2.......................i...............
.....'.......'..ACD Systems Digital Imaging.2014:06:03 14:24:43.......
....0220........294.....................>...........>...........
..................R98.........0100...........C........................
........... $.' ",#..(7),01444.'9=82<.342...C...........2!.!2222222
2222222222222222222222222222222222222222222......>.>..".........
.............................4............................!1AQ"a.2q.B.
...#3R...................................(........................!1..
.Aq2Qa................?..(.j,..Q....P-..)*.vN.QX.iH.^.z..![H.\....I.0.
".%......7ha%...1..?....dk....).h{...eEst.Gy.B.s....Qf.0.Y<...W...J
4.SV..E.."...........8....Z......vyq..M.m....Qq....?X..?Th.[..._..8-7.
.,./eD.......U.O....... ......?.....U...n.\.)..W}Q\>H...Ji..... V..
9~...}&..S..'Y..t....p..6s.kH.OH....S.X_....5.Q...H,K..N}).......QD...
,.o8G.^...jL-..31..6l........ .jS...Mi.....%:(!.h.~.........O....{..@.
..._.x.d.l....W.k.-..r%.....1..I=.).%n6\W...6..EV'..E...GRI.s..}...$..
..B.W..-Q."....9..q.....)q.~s3...\..?q.....r...).u?...{.......ru.-.1..
C.4.....T..@......[...o>.;.6K.J...M...l.M?.4..i....>(zI..~SL.e..
|.<y.2.~..H6.."(..!O}=....Z6}!..^u%.g...6..E....w...-...1:J0.......
/..s.sR5...lBv..4.c..I..............Q.F..C../......%.xi....s.....U2...
i.F...&.......(.4......D...h.=.{...].l.....-.Z....wQ...^7.../s'./.F.&$
m......kA.....*...GwK?.../?1...j.=.vc..H.:.{f...."j(.N......yV.|..
<<< skipped >>>

GET /qs/201405/28/f307f21d8092f1d86886324a.jpg HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Thu, 26 Jun 2014 09:24:47 GMT
Content-Type: image/jpeg
Content-Length: 2095
Connection: keep-alive
Last-Modified: Wed, 28 May 2014 15:01:33 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 685488
Via: SX-251-27.fastcdn.com (DLC-3.0), CT-187-194.fastcdn.com (DLC-3.0)
......JFIF.....`.`.....0Exif..MM.*.......1..............VVV.meitu.com.
...C................................... $.' ",#..(7),01444.'9=82<.3
42...C...........2!.!2222222222222222222222222222222222222222222222222
2......>.>..".......................................7...........
..............!.1.AQa."2q..Rb....$3CSr................................
..,......................!..1Aa.Q......q...R.............?.....T.FZ]..
.C62>.:....r.$k......I...T.a.{.q..z........."s.......-....../.{.1.;
w<.8TD.m.......w.a..U..T.... ..i.c..5.UQ#M......H...L&(.v...b....Hb
T.........W.H.W._.`....#...W..jiZj{..]t.eT.W.. ..x.g.dd{......qjhd..PZ
M...6......`....,.4N...K,n.G. .u.OV.%.|?.....NK<.?_.n.q.5k&oQ.s.9?.
t..........xrK$.U.......y.v...Xe.zW.O.,K&7..........nT....wg?t ~.m=DsC
...a..yi.9..R....:-kV.i.:.eG.*H?.4.-...JV.gfiES....>.O. ...%..;...#
.mNT.5r.E*J.".....Ywc.>C..t.Ypx...W.v:Qr.....c..R..c..eB..I....D..O
.^.Bfic|..;.....i8....X-..:.*#...U.f....0UP1.1....:( ...a..i....TTD..3
m...H...O...e ..._o..h.T..Gf..}D.y.ohC..a.K...4.TX.$.y..632.*J.#.a....
w..U.d..........|v?...t..q.)(....4I...pF\|.(....4=Y_3.h..4z..'E.......
..O..1........^..........`....w.z.Z8&.zJm..3"....3.N.b.....a.K..p9!.o.
...-7.;......>.....V$.S........pt.lu......E..-.9... .r6.....9..5.;}
.A..%L.......y.k..IP.ZZ..38S# [email protected]#....0...._.
u....Z.P.b.....n;1..|..J.%....$..4.s.........K:....^...Rb...5V.q .....
.M2.3&u./..%./I..l..)j*c...E..%b..p....W.Zg.K...w..c.d..3.....u.<.?
8..*nQ..VM.#K.Nq.....Yz.jJj.....[.Q.#..3..%N9<s..?.....&.....^.
<<< skipped >>>

GET /qs/201406/25/abff041c31dd85546886324a.jpg HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Thu, 26 Jun 2014 09:24:48 GMT
Content-Type: image/jpeg
Content-Length: 16805
Connection: keep-alive
Last-Modified: Wed, 25 Jun 2014 11:06:18 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 80289
Via: SX-167-175.fastcdn.com (DLC-3.0), CT-187-198.fastcdn.com (DLC-3.0)
......JFIF.....H.H......Exif..II*.................Ducky.......B.....oX
MP.://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzr
eSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adob
e XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <rd
f:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <
rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/
mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmln
s:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did
:23F4848C45F8E31196F7B827E3387EBE" xmpMM:DocumentID="xmp.did:B11756B4F
AA911E3A69DB328A4F059A4" xmpMM:InstanceID="xmp.iid:B11756B3FAA911E3A69
DB328A4F059A4" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <
;xmpMM:DerivedFrom stRef:instanceID="xmp.iid:27F4848C45F8E31196F7B827E
3387EBE" stRef:documentID="xmp.did:23F4848C45F8E31196F7B827E3387EBE"/&
gt; </rdf:Description> </rdf:RDF> </x:xmpmeta> <?
xpacket end="r"?>...C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222...........".....................................
...K........................!..1..AQ."aq..#2B.....R....$3TUbr....C.%e.
..4Ss...................................8.........................!1.A
Q"aq..2........#..S.B.CRb............?........<M.,k#(%IB...f.?.N...
...1wW....##...>.(.2I"H>..O...G\y..J....:.b..eZf....#...........
...h...3A.4....P.xd0..J..A..F:.pG....!..[....Z.L..i.YH...a......eV
<<< skipped >>>

GET /qs/201405/08/f1f51d8b645559506886324a.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkL
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Thu, 26 Jun 2014 09:24:49 GMT
Content-Type: image/png
Content-Length: 2842
Connection: keep-alive
Last-Modified: Thu, 08 May 2014 12:13:12 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 1760919
Via: SX-119-115.fastcdn.com (DLC-3.0), SX-167-169.fastcdn.com (DLC-3.0), CT-187-196.fastcdn.com (DLC-3.0)
.PNG........IHDR...............Q*...;iCCPicm..x..SwX...>..e.VB....l
.."#[email protected]....(.gA..Z.U\8.....}z............y.
....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W
. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@
..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H...
....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o"&
gt;!.........N..._....p...u.k.[..V.h..][email protected].<......%b
..0..>[email protected][email protected]..#......)..4.\,...X..P
"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ .
..........\...L....D..*.A..............a.D@.$.<.B........A.T.:.....
........18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.
]H#.-r.9.\@.... [email protected].]...k....=.....K.ut.}..c..
1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.
'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m..
..... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%
...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2.
.g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_
.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.....
..9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.
c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x
.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..
J.6.....|...M....V>VyV.V..I.\.,.m.WlP.W...:........v.m.....).).
<<< skipped >>>

GET /qs/201404/25/f1f51d8b645559506886324a.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkR
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Thu, 26 Jun 2014 09:24:50 GMT
Content-Type: image/png
Content-Length: 2842
Connection: keep-alive
Last-Modified: Fri, 25 Apr 2014 07:05:04 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 1392660
Via: SX-119-115.fastcdn.com (DLC-3.0), SX-167-170.fastcdn.com (DLC-3.0), CT-187-198.fastcdn.com (DLC-3.0)
.PNG........IHDR...............Q*...;iCCPicm..x..SwX...>..e.VB....l
.."#[email protected]....(.gA..Z.U\8.....}z............y.
....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W
. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@
..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H...
....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o"&
gt;!.........N..._....p...u.k.[..V.h..][email protected].<......%b
..0..>[email protected][email protected]..#......)..4.\,...X..P
"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ .
..........\...L....D..*.A..............a.D@.$.<.B........A.T.:.....
........18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.
]H#.-r.9.\@.... [email protected].]...k....=.....K.ut.}..c..
1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.
'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m..
..... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%
...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2.
.g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_
.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.....
..9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.
c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x
.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..
J.6.....|...M....V>VyV.V..I.\.,.m.WlP.W...:........v.m.....).).
<<< skipped >>>


GET /imges/pixel.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vr0.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Content-Length: 43
Cache-Control: max-age=31104000
Date: Wed, 04 Jun 2014 04:37:34 GMT
Content-Type: image/gif
Expires: Sat, 30 May 2015 04:37:34 GMT
Last-Modified: Tue, 07 Aug 2007 15:01:15 GMT
ETag: "1635128698"
Powered-By-ChinaCache: HIT from 13002013S5
Age: 1918017
Powered-By-ChinaCache: HIT from 060108b3SD
GIF89a.............!.......,...........D..;..



GET /js/ga.min.js HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bc.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:38 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Content-Length: 2584
Last-Modified: Tue, 12 Jun 2012 13:55:42 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Set-Cookie: QN1=wKgZEVOr5tZJRS5XMP7WAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=qunar.com; path=/
P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
Accept-Ranges: bytes
Server: QWS/1.0
(function(){var e=function(){this.param={};};e.prototype.cookie=functi
on(i,j,g){if(arguments.length>1&&String(j)!=="[object Object]"){g=g
||{};if(j===null||j===undefined){g.expires=-1;}if(typeof g.expires==="
number"){var l=g.expires,h=g.expires=new Date();h.setDate(h.getDate() 
l);}j=String(j);return(document.cookie=[encodeURIComponent(i),"=",g.ra
w?j:encodeURIComponent(j),g.expires?"; expires=" g.expires.toUTCString
():"",g.path?"; path=" g.path:"; path=/",g.domain?"; domain=" g.domain
:"",g.secure?"; secure":""].join(""));}g=j||{};var f,k=g.raw?function(
m){return m;}:decodeURIComponent;return(f=new RegExp("(?:^|; )" encode
URIComponent(i) "=([^;]*)").exec(document.cookie))?k(f[1]):null;};e.pr
ototype.add=function(f,g){if(g!=null){this.param[f]=g;}};e.prototype.g
etHashString=function(f){var h=window.location.hash.toString();var g=n
ew RegExp("" f "=([^&?]*)","ig");return((h.match(g))?decodeURIComponen
t((h.match(g)[0].substr(f.length 1))):"");};e.prototype.getQueryString
=function(f){var h=window.location.search.toString();var g=new RegExp(
"" f "=([^&?]*)","ig");return((h.match(g))?decodeURIComponent((h.match
(g)[0].substr(f.length 1))):"");};e.prototype.send=function(){var f=th
is.get_location();var g=new Image();g.src="hXXp://bc.qunar.com/" f "?"
 this._collect_params();};e.prototype._collect_params=function(){var g
=[];var h=this.param;for(var f in h){g.push(f "=" encodeURIComponent(h
[f]));}return g.join("&");};e.prototype.getDomain=function(f){return(f
||"").replace(/^. \.(. ?\.. )$/,"$1");};e.prototype.get_location=f
<<< skipped >>>


GET /core.php?web_id=4693566&show=pic1&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Thu, 26 Jun 2014 09:24:22 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 26 Jun 2014 09:24:22 GMT
Expires: Thu, 26 Jun 2014 09:39:22 GMT
2f1..!function(){var p,q,r,a=encodeURIComponent,b="4693566",c="pic1",d
="",e="online_v3.php",f="hzs9.cnzz.com",g="1",h="pic",i="z",j="站
;长统计",k=window["_CNZZDbridge_" b].bobject,l="http
:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push
("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"==
=m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.cr
eateScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.
php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.
com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'&g
t;<img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="&l
t;a href='" q "' target=_blank title='" j "'>" j "</a>",k.cre
ateIcon([p])))}();..0..HTTP/1.1 200 OK..Server: Tengine..Date: Thu, 26
 Jun 2014 09:24:22 GMT..Content-Type: application/javascript..Transfer
-Encoding: chunked..Connection: keep-alive..Last-Modified: Thu, 26 Jun
 2014 09:24:22 GMT..Expires: Thu, 26 Jun 2014 09:39:22 GMT..2f1..!func
tion(){var p,q,r,a=encodeURIComponent,b="4693566",c="pic1",d="",e="onl
ine_v3.php",f="hzs9.cnzz.com",g="1",h="pic",i="z",j="站长&
#32479;计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="0",n
=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o
.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.call
Request([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScript
Icon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?we
<<< skipped >>>


GET /?src=tuiga834 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Thu, 26 Jun 2014 09:26:13 GMT
Date: Thu, 26 Jun 2014 09:24:13 GMT
Server: ngx_openresty
Content-Type: text/html
Content-Length: 136104
Last-Modified: Thu, 26 Jun 2014 09:23:14 GMT
Cache-Control: max-age=120
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 0
Age: 16
X-Via: 1.1 bjzw89:80 (Cdn Cache Server V2.0), 1.1 yfdx34:2 (Cdn Cache Server V2.0)
Connection: keep-alive
............i....7....w.i;.....}A.CB...Z.........Z..B.]..j.....H [email protected]
HX..Z@hg'b.y^.....:.._. ....<.'.... .f...*......M...o.>....si.;3
..'?.D..v.L.v6.Mu.s....;wN..'Z.me.u....f.].U......`......|s.......7...
~..7V...6.u.].2..x.6Uiw....nc.. ....[s^..{.......Ls.#-...b...g..=V....
.x....f}~...z.;.v...U.......;.jV....._.=.....klk..M{..4.U.......<9.
.....l...a=........o....1....j=......mo...=<9<..^..f..i........,
...w.^i...{.....................?..}...a........6..bY..?........9.OuZ.
......o.'..}..............7.A.V...Tz......s.8.'.;.... ..;..{......k...
..7.n...z.?.?........{../.......a~w.p.....{{o_[...V.......?{......o...
..o. ...|18..>.W...3._}..........X.?.........._......[.S...$..>.
v....'[.....n..Pj{...:S.v.6.-5.8c.....itG[..&j....6.SnTv.E..1V...7.5g*
....q~3..?w.......5....^.....l...].Fif..Z.ni....y.m.9....~.s\...;.....
...'...Wi..&........j....u...........z.6?..0./^hz..>.X.......m...u.
.vK.v-z.....n.f:Xr.\.l..'.s.vw.k..'.-.n.].....&..............I?Z......
.........z.uG........;.9...M...7I`....:S...G..^..g.a..0.7.)W .o....3..
..6..)o..*.>................j.<.i*...V}7..zsG.Y.<6..dl.>.M
W:$up......e|........ne.p.5g....p?.9^.....J......w.........x.g ....M..
N.7.V*cK[6...xy".`|.?.}.....O._&^e h..U..o..*^v......!#.(#....M ...f.;
.yLU.....6..<f..*x...<..c...%D.`.....U/..&..m...d.<[email protected])
..c..4...e ...7.&^..r...x....g*M..............X|. ..t3\X.%Xn|G......U%
 N.m.[io..16Y....0...........z3.1.m.....G.....0...!=c]x..e.|.r....o...
..../.....`.X.y..`.. ;*..l..j.. .=>..w...{.7..I...i2..r........
<<< skipped >>>


GET /lw/css/login/login_140618.css?v=2 HTTP/1.1
Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: css.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:01 GMT
Cache-Control: max-age=2678400
Content-Length: 10164
Content-Type: text/css
Last-Modified: Thu, 26 Jun 2014 08:16:45 GMT
Accept-Ranges: bytes
ETag: W/"305856f81691cf1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 quanzhou245:0 (Cdn Cache Server V2.0)
Connection: keep-alive
@charset "utf-8";../* CSS Document */..*{ margin:0; padding:0;}..img{ 
border:none; vertical-align:top;}..li{ list-style:none;}..a{ text-deco
ration:none; outline:none;}..body{background:#000000 url(hXXp://img1.r
es.szgla.com/lw/images/login/login140616/body.jpg?v=1) no-repeat cente
r top;height:1500px; font-size:12px; font-family:"......"; line-height
:22px;}...one ,.tow{width:1000px; margin:0 auto; overflow:hidden; zoom
:1;}...tow{ background:url(hXXp://img.res.szgla.com/lw/images/login/lo
gin140616/tow.jpg?v=1) no-repeat; height:323px; padding-top:33px;}...l
eft{width:709px; float:left; position:relative; float:left;}...right{ 
width:291px; height:989px; background:url(hXXp://img1.res.szgla.com/lw
/images/login/login140618/right.jpg?v=1) no-repeat; float:right; posit
ion:relative; padding-top:249px;}...main_link{ position:absolute; widt
h:36px; height:100px; top:380px; left:138px;}...main_link a{ backgroun
d:url(hXXp://img.res.szgla.com/yz/none.gif?v=1);width:36px; height:100
px;text-indent:-9999px; display:block}...video{ position:absolute; wid
th:80px; height:75px;top:75px; cursor:pointer; left:40px; text-indent:
-9999px;}...top_wz{ position:absolute;  top:585px; left:170px; font-si
ze:18px; font-family:"............"; color:#edcc68; font-weight:bold;}
...top_wz span{ color:#74e7b6;}../*right*/...mulitline{ position:absol
ute; height:22px; line-height:22px; width:200px; overflow: hidden;top:
205px; left:86px;font-size:18px;color:#f4e493; }...down{width:204px; h
eight:155px; margin-left:80px;}...down a{ background:url(hXXp://im
<<< skipped >>>


GET /js.ng/framId=flight_active_dynamic&chan=flight&pg=home&site=qunar&type=dynamic_skinned&tile=14037746817393432272&city=北京 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=flight_active_dynamic
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:40 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Content-Length: 59
Set-Cookie: NGUserID=c0a8e146-7367-1403774680-3; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/
AdServer: l-ads6.ad.cn6:9678:50
Server: QWS/1.0
document.write('<div style=\"display:none\"> </div>')
;....


GET /js.ng/framId=couplet_load&chan=flight&pg=home&pos=right&site=qunar&size=120x300&type=couplet&tile=14037746817393432272&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=couplet_load
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:40 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Content-Length: 59
Set-Cookie: NGUserID=c0a8e144-6291-1403774680-86; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/
AdServer: l-ads6.ad.cn6:9678:50
Server: QWS/1.0
document.write('<div style=\"display:none\"> </div>')
;....


GET /js.ng/framId=ad_home_leftAD_bottom&chan=flight&pg=home&pos=mid&site=qunar&size=728x90&tile=14037746817393432272&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_bottom
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6; NGUserID=c0a8e145-32693-1403774679-178


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:40 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Content-Length: 59
AdServer: l-ads6.ad.cn6:9678:50
Server: QWS/1.0
document.write('<div style=\"display:none\"> </div>')
;....


GET /js.ng/framId=ad_home_rightAD_top2&chan=flight&pg=home&pos=top&site=qunar&size=230x90&tile=14037746817393432272&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6; NGUserID=c0a8e145-32421-1403774680-52


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:42 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Content-Length: 59
AdServer: l-ads5.ad.cn6:9678:50
Server: QWS/1.0
document.write('<div style=\"display:none\"> </div>')
;HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 09:24:42 GMT..Content-Type: a
pplication/x-javascript..Connection: keep-alive..Content-Length: 59..A
dServer: l-ads5.ad.cn6:9678:50..Server: QWS/1.0..document.write('<d
iv style=\"display:none\"> </div>');..



GET /js.ng/framId=homeadSy&chan=flight&pg=home&pos=right_top&site=qunar&size=230x200&type=Tear_angle&tile=14037746817393432272&city=北京 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=homeadSy
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Content-Length: 74
Set-Cookie: NGUserID=c0a8e145-32693-1403774679-178; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/
AdServer: l-ads6.ad.cn6:9678:50
Server: QWS/1.0
document.write('<div site=\"qunar\" style=\"display:none\"> 
;</div>');....


GET /js.ng/framId=flight_float_layer&chan=flight&pg=home&pos=top&site=qunar&type=floating_layer&tile=14037746817393432272&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=flight_float_layer
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:40 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Content-Length: 74
Set-Cookie: NGUserID=c0a8e145-32421-1403774680-52; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/
AdServer: l-ads6.ad.cn6:9678:50
Server: QWS/1.0
document.write('<div site=\"qunar\" style=\"display:none\"> 
;</div>');....


GET /js.ng/framId=ad_home_leftAD_middle&chan=flight&pg=home&pos=top&site=qunar&size=728x90&tile=14037746817393432272&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_middle
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:40 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Content-Length: 1353
Set-Cookie: NGUserID=c0a8e01e-25892-1403774680-161; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/
AdServer: l-ads6.ad.cn6:9678:50
Server: QWS/1.0
document.write('');.;(function(){.    try{.        var ad_type="image"
;.        var css = '',.            html = '',.            jsCode = ';
(function(){\n    var clickTag = "hXXp://qde.qunar.com/event.ng/Type=c
lick&FlightID=120624&AdID=211254&TargetID=207&Segments=13,28,5
1,142,148,152,373,530,534,535,536,539,540,541,542,543,544,545,546,548,
549,550,551,552,553,554,555,556,558,559,560,562,563,564,565,567,568,56
9,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586,587,
610,611,621,651,844,978,1102,1143,1183,2587,3780,4380,4493,4525,4548,4
553,4605,4636,4648,4649,4650&Targets=5302,29,207,1504&Values=34,46
,51,63,77,84,100,110,150,204,215,228,230,243,250,252,301,305,321&Raw
Values=&Redirect=hXXp://dujia.qunar.com/tejia";\n    var img_src = "
hXXp://source.qunar.com/site/images/wns/20140625_red_4869_728x90.jpg";
\n\n    var container = parent.QNR.AD.create_div_container( Current_ad
_id );\n\n    container.innerHTML = [\'<a target="_blank" href="\',
 clickTag ,\'"><img border="0" src="\', img_src ,\'" /></a
>\'].join(\'\');\n})();',.            jsrc = '',.            run = 
'1';.        if( css || html || jsCode || jsrc ){.            top.QNR.
AD.run_in_content( Current_ad_id , css , html , jsCode  , jsrc , run);
.        }.    } catch(e){.        if( window['console'] ){ console.lo
g( e ); }.    }.})();.document.write('');....
<<< skipped >>>

GET /js.ng/framId=ad_home_rightAD_top&chan=flight&pg=home&pos=top&site=qunar&size=230x200&tile=14037746817393432272&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6; NGUserID=c0a8e146-7367-1403774680-3


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:41 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Content-Length: 2841
AdServer: l-ads5.ad.cn6:9678:50
Server: QWS/1.0
document.write('');.;(function(){.    try{.        var ad_type="flash"
;.        var css = '',.            html = '',.            jsCode = ';
(function(){\n\n    var swf_click = "hXXp://qde.qunar.com/event.ng/Typ
e=click&FlightID=114287&AdID=209121&TargetID=5800&Segments=13,
28,50,132,142,148,373,530,534,535,536,539,540,541,542,543,544,545,546,
548,549,550,551,552,553,554,555,556,558,559,560,562,563,564,565,567,56
8,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586,
587,610,611,621,651,844,978,1102,1143,1183,2587,3780,4054,4380,4493,45
25,4548,4553,4605,4636,4648,4649,4650&Targets=5302,29,208,1504,6877,
7731,7675,6419,7678,5800&Values=34,46,51,63,77,84,100,110,150,204,21
9,228,243,250,252,269,301,305,320,5402&RawValues=&Redirect=hXXp://
adclk.thinkmedia.cn/clk/pid=2468/media=quna/place=73gjp3/size=230x200"
;\n    var clickTag = encodeURIComponent(swf_click);\n    var swf_src 
= "hXXp://source.qunar.com/site/images/wns/20140619_flighthp_tbut_230x
200_4031.swf";\n    var link_click = "hXXp://qde.qunar.com/event.ng/Ty
pe=click&FlightID=114287&AdID=209121&TargetID=5800&Segments=13
,28,50,132,142,148,373,530,534,535,536,539,540,541,542,543,544,545,546
,548,549,550,551,552,553,554,555,556,558,559,560,562,563,564,565,567,5
68,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586
,587,610,611,621,651,844,978,1102,1143,1183,2587,3780,4054,4380,4493,4
525,4548,4553,4605,4636,4648,4649,4650&Targets=5302,29,208,1504,6877
,7731,7675,6419,7678,5800&Values=34,46,51,63,77,84,100,110,150,2
<<< skipped >>>


GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.cfmogu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:06 GMT
Content-Length: 13500
Content-Type: text/html
Content-Location: hXXp://VVV.cfmogu.com/index.html
Last-Modified: Sat, 21 Jun 2014 15:45:01 GMT
Accept-Ranges: bytes
ETag: "505b34c3678dcf1:1ad71"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
<link rel="shortcut icon" href="hXXp://VVV.cfmogu.com/.........ico"
 />..<title>CF........ CF.............. CF............ VVV.cf
mogu.com</title>..<meta name="keywords" content="CF....,CF...
.....,CF..........,CF............,CF..............,CF.............." /
>..<meta name="description" content="CF..............VVV.cfmogu.
com....................CF..................!" />..<script type='
text/javascript' charset='utf-8' src='hXXp://c.myzwqwe12.com/AShow.asp
x?AID=9842'></script>..<script type='text/javascript' char
set='utf-8' src='hXXp://c.myzwqwe12.com/AShow.aspx?AID=9756'></s
cript>..<style type="text/css"> ..<!--..body,td,th {...col
or: #333333;...font-family: ....;...font-size: 12px;..}..a {...font-fa
mily: ....;...font-size: 12px;..}..a:link {...text-decoration: none;..
.color: #275cb0;..}..a:visited {...text-decoration: none;...color: #27
5cb0;..}..a:hover {...text-decoration: none;...color: #FF0000;..}..a:a
ctive {...text-decoration: none;..}..body {...background-color: #FFFFF
F;...margin-top: 10px;..}...lffft {color:#000000;}...STYLE40 {font-siz
e: 14px; font-weight: bold; color: #275cb0; }...STYLE43 {color: #00000
0}...STYLE2 {color: #FF6600}...STYLE5 {color: #333333; }...STYLE56 {fo
nt-size: 14px; font-weight: bold; color: #0000FF; }...STYLE66 {...colo
r: #FFFF00;...font-weight: bold;...font-size: 14px;..}...STYLE67 {colo
r: #FF0000}..-->..</style>..<script type="text/JavaScript"
> ..<!--..function MM_findObj(n, d) { //v4.01..  var p,i,x; 
<<< skipped >>>

GET /Ä¢¹½Í¼Æ¬.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.cfmogu.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 26 Jun 2014 09:24:20 GMT
Content-Length: 1308
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.or
g/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>.....
.......</TITLE>..<META HTTP-EQUIV="Content-Type" Content="tex
t/html; charset=GB2312">..<STYLE type="text/css">..  BODY { f
ont: 9pt/12pt .... }..  H1 { font: 12pt/15pt .... }..  H2 { font: 9pt/
12pt .... }..  A:link { color: red }..  A:visited { color: maroon }..&
lt;/STYLE>..</HEAD><BODY><TABLE width=500 border=0 c
ellspacing=10><TR><TD>..<h1>............</h1&g
t;....................................................<hr>..<
p>................</p>..<ul>..<li>...............
.........................................</li>..<li>......
......................................................................
......</li>..<li>....<a href="javascript:history.back(1
)">....</a>....................</li>..</ul>..<
h2>HTTP .... 404 - ..................<br>Internet ........ (I
IS)</h2>..<hr>..<p>..............................<
;/p>..<ul>..<li>.... <a href="hXXp://go.microsoft.co
m/fwlink/?linkid=8180">Microsoft ............</a>..........&l
dquo;HTTP”..“404”........</li>..<li>....
“IIS ....”...... IIS ...... (inetmgr) ....................
....“........”..“............”..“.......
...........”........</li>..</ul>..</TD><
<<< skipped >>>


GET /imgs/201103/29/66Iba26Dsd1_IiKO6720.jpg HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: userimg.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:48:53 GMT
Content-Type: image/jpeg
Content-Length: 2111
Accept-Ranges: bytes
Last-Modified: Fri, 06 Jun 2014 14:12:33 GMT
ETag: "465a375a6c2caafe02924cc831ecb489"
Expires: Fri, 26 Jun 2015 07:48:53 GMT
Timing-Allow-Origin: *
Age: 5747
X-Cache: HIT from qunar_cdn_02
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................>.>.."..................................
..........................}........!1A..Qa."q.2....#B...R..$3br.......
.%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz........................
......................................................................
................................w.......!1..AQ.aq."2...B.....#3R..br..
.$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.................
...................................................................?..
*.........>....A.....Z[4.)...y...S.. .Ex'..v. .oM^/..-iB*U.`..8k...
....s..k..h....q.O.......^....r.....|Q.xs.5.....[.$.H.xD....o....k....
.B..~... ....Y.cM......vg..xL5G.A.y..........A._..'.......~?h.2j7...C.
.....G......\Q....?......*.?.:....-7R.T....I.i.E.w.........1..2...~F.$
.]..XLKq...............7.e.[yo..,h...%[..*k.. ...e....#...._......^)JI
w<..............E.....z.^..m... ....1...... .............2.i.X.V...
Z...8.....X.i-...m2..L<.r..D..p......<..v.....0.......&..'.._u..
l..........(...W.....'>.M..86.wm.c3........'........^x._...:l.$.2.[
.......yr....._.......H...X............5Q.]G..%..i.|'.8.\g.Q>.....H
.......sI.<SJ...rI/M.`.F..S..=..`......../..z......_......../..z...
....i...[.z._.s.I].......r..w.........N.m_.....~......=...n...g....\..
r.e...........~... .....i.....}..Wq9m.....;...M..p[x.Q;..}FD.1..\N".Y.
^....EU....VG...n[..o.%.W..7.V^r.....\K..O.W...8s....z..Q.........
<<< skipped >>>


GET /swfd/bd/4c/chuanqi86/reg_btn.gif HTTP/1.1
Accept: */*
Referer: hXXp://t.tudou58.com/qdlm.html?uid=14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.tudou58.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 08:14:16 GMT
Server: nginx
Content-Type: image/gif
Content-Length: 8370
Last-Modified: Tue, 10 Jun 2014 10:33:09 GMT
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjhdx33:8105 (Cdn Cache Server V2.0), 1.1 lasi18:5 (Cdn Cache Server V2.0)
Connection: keep-alive
GIF89a..1....C:6&..jb[.........\VQ...pkckgbca\VVRKJD|sj.........:EHrcU
.}hQ?.TNI.|s...L(...sDC;..k..{JFB...lQ.....y.]\Z...:94......b^Zzk\j\L6
)&zpg....v.h`WWQL....Q.......`ZU>0 ...f]UKB>}wpqa.^VN.rc...MLJbR
CED@l` ZYV...........3..}......^YTOJE<;7...650ne\ZTOwkb......`WP...
i\U...UOJbZQYRK...:71VOF.......vk..K[[email protected]]]Uwoe...hVE....
...d.QLGaVNph_...YRN..,kaNsri...aYN..5QPMa[VqaPUSP......m][yhW\TKbYD,,
*yig...vdSii_...d\Q``[email protected].....~......IDJRJB]YRphT.e.^P!..n
l=.POFo]NQOJ...f[RTIB.o]...qlg{q_.~n..v...ZZP767]WIA>B;..XMF...TKEU
N?...NGB"..A?:GAJ?IM..._N=YPI....................}........\...........
=..!...............II?........)..O..wO@ UUK.....P....{f.........NPO..m
...QRP.wh..e..5..2.v.........m..v.......zj.f.....zd...[RJ_PO..y..r....
.N..9;8>hWV.{.\\R{p7#..!..XMP DataXMP<?xpacket begin="..." id="W
5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x
:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        
"> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-n
s#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.
com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/Resour
ceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumen
tID="xmp.did:9420BAA834D8E311B1DDB545A2C1BCB7" xmpMM:DocumentID="xmp.d
id:FD1F6B02DA6811E39EDE9CE5A6A9838C" xmpMM:InstanceID="xmp.iid:FD1F6B0
1DA6811E39EDE9CE5A6A9838C" xmp:CreatorTool="Adobe Photoshop CS5 Window
s"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8062818E40D
<<< skipped >>>


GET /ref.php?ref=2343627&return_url=http://xx.ztgame.com/index_gc_ad7.html?ad=2343627 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: counter.ztgame.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Server: nginx/1.0.15
Date: Thu, 26 Jun 2014 09:24:51 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Set-Cookie: uniqid=1406261724512128767627; expires=Fri, 26-Jun-2015 09:24:51 GMT; path=/; domain=.ztgame.com
Set-Cookie: ref=2343627; expires=Sun, 06-Jul-2014 09:24:51 GMT; path=/; domain=.ztgame.com
Set-Cookie: date=2014-06-26 17:24:51; expires=Sun, 06-Jul-2014 09:24:51 GMT; path=/; domain=.ztgame.com
Set-Cookie: ref_date=2014-06-26 17:24:51; expires=Sun, 06-Jul-2014 09:24:51 GMT; path=/; domain=.ztgame.com
Set-Cookie: ref_ip=193.138.244.231; expires=Sun, 06-Jul-2014 09:24:51 GMT; path=/; domain=.ztgame.com
location: hXXp://xx.ztgame.com/index_gc_ad7.html?ad=2343627
Set-Cookie: NSC_dpvoufs_xfc_01=ffffffffaf16763245525d5f4f58455e445a4a42214a;expires=Thu, 26-Jun-2014 09:30:25 GMT;path=/;httponly
0..HTTP/1.1 302 Moved Temporarily..Server: nginx/1.0.15..Date: Thu, 26
 Jun 2014 09:24:51 GMT..Content-Type: text/html..Transfer-Encoding: ch
unked..Connection: keep-alive..P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BU
S UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR..Set-Cookie: uniqid=
1406261724512128767627; expires=Fri, 26-Jun-2015 09:24:51 GMT; path=/;
 domain=.ztgame.com..Set-Cookie: ref=2343627; expires=Sun, 06-Jul-2014
 09:24:51 GMT; path=/; domain=.ztgame.com..Set-Cookie: date=2014-06-26
 17:24:51; expires=Sun, 06-Jul-2014 09:24:51 GMT; path=/; domain=.
ztgame.com..Set-Cookie: ref_date=2014-06-26 17:24:51; expires=Sun,
 06-Jul-2014 09:24:51 GMT; path=/; domain=.ztgame.com..Set-Cookie: ref
_ip=193.138.244.231; expires=Sun, 06-Jul-2014 09:24:51 GMT; path=/; do
main=.ztgame.com..location: hXXp://xx.ztgame.com/index_gc_ad7.html?ad=
2343627..Set-Cookie: NSC_dpvoufs_xfc_01=ffffffffaf16763245525d5f4f5845
5e445a4a42214a;expires=Thu, 26-Jun-2014 09:30:25 GMT;path=/;httponly..
0..
<<< skipped >>>


GET /AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F4733086193DA6C7674EE3CE649E52CE4FD2CE9468122DFDCEF870293E&Url=&referer=http://VVV.cfmogu.com/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=1805; expires=Thu, 26-Jun-2014 12:24:15 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:14 GMT
Content-Length: 372
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~..q3..U.........]{....L>...
7N~..|...E.L/..'.y}..........".Z.?w~.o..x..:..f]..giYM3.7n............
U.*.8}....{..........~...'.G.m}...O>.......;w..nq.e.~...e....hG.2_^
...q.k..S...^..}d`...._......a..'..o.........H?j ..# U..[..w..z..^..Yu
5.#[email protected]/1.1 200 OK..Cache-Control: no-cache..
Pragma: no-cache..Content-Type: text/html; charset=utf-8..Content-Enco
ding: gzip..Expires: -1..Vary: Accept-Encoding..Server: Microsoft-IIS/
7.5..X-AspNet-Version: 2.0.50727..Set-Cookie: UnionADShowTG=1805; expi
res=Thu, 26-Jun-2014 12:24:15 GMT; path=/..X-Powered-By: ASP.NET..Date
: Thu, 26 Jun 2014 09:24:14 GMT..Content-Length: 372...............`.I
.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...
?\fd.l..J...!....?~|.?"~..q3..U.........]{....L>...7N~..|...E.L/..'
.y}..........".Z.?w~.o..x..:..f]..giYM3.7n............U.*.8}....{.....
.....~...'.G.m}...O>.......;w..nq.e.~...e....hG.2_^...q.k..S...^..}
d`...._......a..'..o.........H?j ..# U..[..w..z..^..Yu5.#[email protected]
.....z..q.......


GET /AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F4733086193DA6C7674EE3CE642079A95560F77388AFBC377673F7783E&Url=&referer=http://VVV.cfmogu.com/ HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShowTG=1805


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=1805; expires=Thu, 26-Jun-2014 12:24:22 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:21 GMT
Content-Length: 372
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~..q3..U.........]{....L>...
7N~..|...E.L/..'.y}..........".Z.?w~.o..x..:..f]..giYM3.7n............
U.*.8}....{..........~...'.G.m}...O>.......;w..nq.e.~...e....hG.2_^
...q.k..S...^..}d`...._......a..'..o.........H?j ..# U..[..w..z..^..Yu
5.#[email protected]/1.1 200 OK..Cache-Control: no-cache..
Pragma: no-cache..Content-Type: text/html; charset=utf-8..Content-Enco
ding: gzip..Expires: -1..Vary: Accept-Encoding..Server: Microsoft-IIS/
7.5..X-AspNet-Version: 2.0.50727..Set-Cookie: UnionADShowTG=1805; expi
res=Thu, 26-Jun-2014 12:24:22 GMT; path=/..X-Powered-By: ASP.NET..Date
: Thu, 26 Jun 2014 09:24:21 GMT..Content-Length: 372...............`.I
.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...
?\fd.l..J...!....?~|.?"~..q3..U.........]{....L>...7N~..|...E.L/..'
.y}..........".Z.?w~.o..x..:..f]..giYM3.7n............U.*.8}....{.....
.....~...'.G.m}...O>.......;w..nq.e.~...e....hG.2_^...q.k..S...^..}
d`...._......a..'..o.........H?j ..# U..[..w..z..^..Yu5.#[email protected]
.....z..q.....



GET /?ex_track=auto_52283dc6 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: flight.qunar.com


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:29 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: no-cache
Pragma: no-cache
Expires: 0
Content-Encoding: gzip
Server: QWS/1.0
Set-Cookie: QN99=4688 ; Domain=.qunar.com; Expires=Thu, 23-Jan-2081 13:20:12 GMT; Path=/
f11.................E.8..L....k.....J}..v4...e.ev....(I.V..*......a...
....6..3............Rw.4........KR.e.l.....xW.|.....[v=.s..{~w.f...Db;
~&...n...m7........p.0g....dv....PV. .QWl9.e....:W.i........%Q.?...,.Y
..O.k.i)v.iW..B...U[S..:z.....;.i..`...?.}.}....k.O....,.z...;?.G...w.
.._..c.;.W|...f.l..gi..F]. ....a[.\.^Q.RUC........... .PY.7..W...|...z
...Q....].,...Z;...s_.<..>v..`h...\<......3_QB;...b.M.a...A.6
7.6........3.s.W._j]..z.xnL.[_|.....y.......h...g[....x.o.....W[.../~.
>.y....Eh....Zg/./...W..^.....S..............2.......CE.H.....{o!.O
~......W....\....._o_>.r....O.......IoY...4..44....&/.QU.FI...<.
%=.W.....2Z.MS ..T..r..%..9`5v.*E.h.e.00W...4U?.0..`...b...N.L...L....
.......l..di.l.. ..(..c.Qq87><".2e.".g..-..E....r.d&.J.6T.j.l.5y
Q1....PQ..<...]....l.i..x.PE...5.s. ...Y;.....2.0..m4.,.......K.Q.Y
..0.=..L{.`m...b..0.~.X,..R....9Q...Ud.(.....UQ..&........,CS.A.ZP.*..
..(.....j.j.r.Q...F....(...E.Y..zz^........./."R.4.>.k,$.o....T..r)
_...gM..W..ed....w.j5.p-g......T..YU...r.6.....tA..Dqk>.{MA.M.....b
....k....J...-....l....d.J[..Vy.` .2.....H..b..n..Z5KA,.I.LC.M&D.O..gS
i(..^..H...uY..h..8......Mh...D.rJS.v.....pT..q.A.._i.....G$.%H...x..1
.....cB^...D`q.R........ .s....O..JE..F.F<A..AMX.Y_:.&.k*-......0.~
'..crtS...1:[email protected]. ..:....\;D..U..j.S1.....v..
....*:.....s....8.......vy.J....z..d'[email protected]?M.4%.5Y..4.
.7]...j.tE)[email protected]:.Q....G.B...rM.. .Z..Ng.M....MS..j....uU
.&.4.......r# .i.0........>%...$!...5...3~'Fz....DE...K0.5m.Y).
<<< skipped >>>

GET /site/timetrack.htm?action=FH|domload|4.782&t=1403792673782 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flight.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:37 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 26 Jun 2014 08:30:04 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Server: QWS/1.0
14........................0..HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 0
9:24:37 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding
: chunked..Connection: keep-alive..Last-Modified: Thu, 26 Jun 2014 08:
30:04 GMT..Vary: Accept-Encoding..Content-Encoding: gzip..Server: QWS/
1.0..14........................0......


GET /site/main.swf?20090107 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flight.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:38 GMT
Content-Type: application/octet-stream
Connection: keep-alive
Content-Length: 23580
Last-Modified: Thu, 26 Jun 2014 08:30:04 GMT
Accept-Ranges: bytes
Server: QWS/1.0
Expires: Sat, 01 Nov 2014 09:24:38 GMT
Cache-Control: max-age=11059200
CWS.P...x..}.\..........H.b.(.bW..)..R....p........[..E.k.]c/...5...Dc
o1Q....Sv.v..&..........y...7o...y3[.,..`9..w1.v.._.qUU.A..>[email protected]|
E.....WK..r/.)........6\'i.?...g......-.5...}..,. .."O....? ..w......X
.*..*.'....a..:M....2 .....|....9s.J...7........D[.l....._..]..8..6...
..-.a=<..a%[email protected]...[..{.Fu;.Q.o'......AM...A..j.A]..Q].A.....
.Q-W..6.......KPg...N..*.)B..IP...=)...A......:.".n.....*}..`.o..../0.
.g0..G..h....Y...........C..D.;..Ue...)#1..>[email protected]. \..2\
.7.1..-...k.8b*AL$.[....... p.Z_x.......... ..Z.......yZR.. 0.Y,e....f
.RTBh.A;V.."1.f1F.W..N..h.|.Z......38ks2..Eh..4v....3QVH6&.U.^...9k..C
....L..$..i...e...C..(.q.*.u.f.r).{.O...=..{$..TYB..R...J.....#.Eo.kY.
.%....."%.$y..&w.2..Q.u@]..H...h..J...u..Sj...le6....)[email protected]..<.
......Su.b ....x._Q9...D..A.-.`.,%..).....D.Eb....r*,...N......(\.T..@
.^..B..vn.v@&..2."(.-R.....BW....... ..HVd.....*..i*]..T.%:!..?.{....u
&..B..2..Y:@.t.7....9.7........(.F1..S*...{...7q#.sw.l..`.~.=.$N'oe...
. .:..|...)..U.J..5..t.....6.P.aV.R..g......Y c.J.....w.F...y.a..Lb.*.
..I.e.Af.&T.T...6."[email protected]...*....G.$... G..
D..HA.O.........FQ.U.T."-.Y..\...5....4(."...Flb..>. ,.KT.e KQ.r...
."P8<.J.)||4J....A....h..5. ......8.=.. ......Y....T..O...%k..`.E..
..I.%GC5..3...F....H... a.A.*m.......].g.|.}9S F.?.4B.E)P.........%k..
1..\-..e9.V.l.-L...-.Lr..._.....I8CR..,.E...`g.t..Ht...u........R.4.&l
t;I).y..$....'U...For..-..R./%.....x..L.....hk.....h{..v...\L...%U..'g
}.P......}..*I..W9|....1.B.....[..q=.....N....Z0f.....$.-....#...R
<<< skipped >>>

GET /site/timetrack.htm?action=FH|load|17.688&t=1403792686688 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flight.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6; RT=; flight.trends=%u5317%u4EAC-%u4E0A%u6D77;%u5317%u4EAC-%u5E7F%u5DDE


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 26 Jun 2014 08:30:04 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Server: QWS/1.0
14........................0..HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 0
9:24:50 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding
: chunked..Connection: keep-alive..Last-Modified: Thu, 26 Jun 2014 08:
30:04 GMT..Vary: Accept-Encoding..Content-Encoding: gzip..Server: QWS/
1.0..14........................0..



GET /AShow.aspx?AID=9842 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=1961; expires=Thu, 26-Jun-2014 12:24:11 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:11 GMT
Content-Length: 3547
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...i[T......\...Vs....[.ks...u.
......?k.u.*.i.u.{..z.tgg..]?|v|..w...G.>.s(.Sj.K.=........._|..is.
.......X...q[...j.^..v\V..o..u~.K...| .C..Z.....v.7.l.o.a..%y....G..._
r..'....;..l.....v.H.f..C|.|../..0..>....a..2.J.fm~.|.|../\.?.6.."o
.....H.i.K......ZUo.|k.-.;)....../.......j.....g.;.}.V.|....~.........
.nw..4|z.";...... ...j...R...o..w.A...r]..>zM...2 ....*..V.g)p..i..
dL..x.;.....~.....Ow......;..T.([...#...`.......WY;...!.-..&.>...m&
gt;..............v............3...."......E..V....`>.!../..O.h....A
....Y...W..{A...~.$....._..pZ......I.~..'_.C....g...U>y[....!}.e...
........2.,......&../....5.........;...y...O<E.(........6o......O..
.(.].....;..m._..........`.....^WU9..t......!.... .d...7.rJ.ySg.y.....
..?.....j.c.....;...}.%.L...n>...6.d:..E............l?$..}.......U^
.d.1..jQM.2.j.{.[..M~.l....w.....v..'=J.>...z............yM8.0d..?.
...~..gu...Z.._..:.}.\[email protected]............*f.M...:
?..n..XQ..t......U...\...F.\.nB....M..2&.xQ...~ \.5../w...?&%.O...}...
.Z..'g.w..~J.ng.#zwFZ.....y^\.[.uZfM..'._.=}...g.?&m.......{......]...
....]ipo{g..9.....< .........4.>.......G..\..g.....v}.M..\../...
....!.-......P.Wo0..~<.{.x......~&X>... ...n.<.1`0.....C...''
;........K......je.1 .r...-i....yU/......t.. ..4..#2.d.>....4......
.j2......o.@.\....^Q.f=Y..^./25d.?.....c..........4(.C?h.G....U*..-.Lc
r..m.......u(......!..E....h.g...........9.M..:...yC..= ..l...-.j.
<<< skipped >>>

GET /AShow.aspx?AID=9756 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShowTG=1961


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=1961|1805; expires=Thu, 26-Jun-2014 12:24:12 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:12 GMT
Content-Length: 2546
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:m.u.....]=.{ww..x.........w.
-..........>.._.......^....~0^\....]..{.i..{..'O.b.v.5.w......v.v..
.......?....v..........{..}z......O..v.=9y.........g..................
..<.;~......_..a..~.{...wN....:.....2_..sUW.bqA......z...........{f
 M[..yN......zAo..j..E..6....4...X..O.....O...j..K......_x..a.....O..?
.wo.........z..S.....S...."....{..?........';;O...=y.s.....'..B.....O.
...._.:;...jI#...yGG...........~..bF..=.9L#....b.~....{...j,_1a.yu5]-.
.v.{H..."_...!...;........cl\...j...k._E.=-.&........~...'NZ...F......
O.Fq.n....:.....y...;.D.;.}..z9...e>.8...0]f..E.V5..z[...lR..;./...
....r....C...z.....g...P....3.`......._....?.'../...g.r]...ge..O......
l.{....YU/...).y..0..yuQ.w./.....G..._O..,...4}......]>.......9.2.$
...~..........q.7....H>........~.........T>....g~F>....Rk.q..
n?}..*.6E....`......h..0.q......g..r......6......|~..........B....~F81
/......,d....1H..E.f..I;..z-.sz-...t..Y.M.f..`......d......h.n.2.T[:..
.1Y.2..e..G.E...#.'.......l.].o.l...l..(.e.......y..>..Y^o..a#....b
z........)[email protected]....}.....~4.n...9.d...RV...V.R......IU.....=..Sb...
./.....q..C.;n......>~<#5Q.>............g..?i...P}U5.8...9L..
]..}.([email protected]....~.....`..^>....m...........>..Pb}......u
..1....... .......a:].MU?.gK....G.4K.0]4.-.$.g.l..9SH.....~.w.........
....fUf...dp.o.%;D.}...e.L.b.>.C........:o..R...#.D..P.4.M....W...%
:./[email protected]...".0.....:..7G...[....,..&7......U.f.E.
<<< skipped >>>


GET /img/pic1.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: icon.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.3.0
Date: Thu, 26 Jun 2014 09:24:23 GMT
Content-Type: image/gif
Content-Length: 428
Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Expires: Fri, 27 Jun 2014 09:24:23 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
GIF89a.......f..3...33.......................................!..NETSCA
PE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.
n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#..
.o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.....
........I........08bX....d.n...CS.3......_..`..H..H\8....).:[email protected]...
x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D....
.......;HTTP/1.1 200 OK..Server: Tengine/1.3.0..Date: Thu, 26 Jun 2014
 09:24:23 GMT..Content-Type: image/gif..Content-Length: 428..Last-Modi
fied: Fri, 16 Jan 2009 08:10:47 GMT..Connection: keep-alive..Keep-Aliv
e: timeout=5..Expires: Fri, 27 Jun 2014 09:24:23 GMT..Cache-Control: m
ax-age=86400..Accept-Ranges: bytes..GIF89a.......f..3...33............
...........................!..NETSCAPE2.0.....!..Powered by AFEI.!....
...,.............I........08bX....d.n...CS.3......_..`..H..H\8....)...
S.b.UX.....(...r.L....tb]&"......#...o.V.a..D..o.V.a..........D..o.V.a
..........D...........!.......,.............I........08bX....d.n...CS.
3......_..`..H..H\8....).:[email protected] ..........D.| .#.u.a....n~D..[..
..n..........D..[...n..........D...........;..



GET /pic/close.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Mon, 31 Aug 2009 17:03:48 GMT
Accept-Ranges: bytes
ETag: "0b28f15d2aca1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:23 GMT
Content-Length: 286
.PNG........IHDR.............\.......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<....IDATx..S... ...?...>;.Y{........D.`.......-.
_w{..A8......O..>f.<`*V..1..N..........R.....`;."HJd...6..\...d.
I.... ..x...\q...D.....l..;.bw.Q=...)..h... .NR.......$.X........%..*.
.0.J......IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png..Last-Modif
ied: Mon, 31 Aug 2009 17:03:48 GMT..Accept-Ranges: bytes..ETag: "0b28f
15d2aca1:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: T
hu, 26 Jun 2014 09:24:23 GMT..Content-Length: 286...PNG........IHDR...
..........\.......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<
....IDATx..S... ...?...>;.Y{........D.`.......-._w{..A8......O..>
;f.<`*V..1..N..........R.....`;."HJd...6..\...d.I.... ..x...\q...D.
....l..;.bw.Q=...)..h... .NR.......$.X........%..*..0.J......IEND.B`..
.



GET /live/63/67/b744ef7cf7616402b9cd75cd3b296755.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Tue, 27 May 2014 08:34:44 GMT
Content-Type: image/jpeg
Content-Length: 40920
Expires: Fri, 22 May 2015 08:34:44 GMT
Cache-Control: max-age=31104000
ETag: "2046553676"
Last-Modified: Fri, 12 Oct 2012 03:19:52 GMT
Accept-Ranges: bytes
X-HITS: 1
Powered-By-ChinaCache: HIT from 13002723SI.2
Age: 2594987
Powered-By-ChinaCache: HIT from 06010923S1
......JFIF.............<CREATOR: gd-jpeg v1.0 (using IJG JPEG v62),
 quality = 100....C...................................................
.................C....................................................
........................".............................................
...............}........!1A..Qa."q.2....#B...R..$3br........%&'()*4567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
......................................................................
.....................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&
'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz............................
........................................................?...|Y._...F..
^:.g.....fT..|[.i~.....2,...uie.:.2......)#...?...............m.......
?.|RX....,.?.t..YC<$.....x... ..!..9/...>3|}......}......u.V....
. ...|C}!?...K..B..}.{.......P..................._.~.|.l:...k....J.r._
.f..c...........^.w.<..i.E.e..W.....I.E.2.s sB.q.....UF....N..$..~.
p~..?....heT..g....7....=.6 ;.......],%*...F2................~....hO..
.<.E.x_.....*x.u.....s.-e"...k%.EK.".w..#........I...j^V....d...2q.
.c.....?)gQn..V-..]...$.?....*B.\...?0.......n..._...O......%..<-..
.3..,\..W.......?ygos5..^_.......o.7S..P[...G.P.A..........tX...<v.
.^!..F.([.._9|.{7....%.....%Lf3.5x.*..K.5....R{?....>j.O..D..O....j
qp........I4...NS...M.=.oe.k.;?.....?....o.e..V..g.5....y;...B..... ..
...Ldi.cs..c{..|.... ...>.K4..$...........x.....5.2.....7..9.&.2...
.......... ...:...7k.....?....=B.:-K........&.m.....V.|.c..m.!...f
<<< skipped >>>


GET /core.php?web_id=1360447&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
Cookie: cna=x9QyDBpdXF0CAcGK9OfjJSLK


HTTP/1.1 200 OK
Server: Tengine
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 26 Jun 2014 09:24:39 GMT
Expires: Thu, 26 Jun 2014 09:39:39 GMT
2ee..!function(){var p,q,r,a=encodeURIComponent,b="1360447",c="",d="",
e="online_v3.php",f="hzs7.cnzz.com",g="1",h="text",i="z",j="站&#
38271;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",
m="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h
=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&
&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.creat
eScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php
?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com
/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'>&
lt;img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a
 href='" q "' target=_blank title='" j "'>" j "</a>",k.create
Icon([p])))}();..0..HTTP/1.1 200 OK..Server: Tengine..Date: Thu, 26 Ju
n 2014 09:24:39 GMT..Content-Type: application/javascript..Transfer-En
coding: chunked..Connection: keep-alive..Last-Modified: Thu, 26 Jun 20
14 09:24:39 GMT..Expires: Thu, 26 Jun 2014 09:39:39 GMT..2ee..!functio
n(){var p,q,r,a=encodeURIComponent,b="1360447",c="",d="",e="online_v3.
php",f="hzs7.cnzz.com",g="1",h="text",i="z",j="站长统
;计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "//
online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push(
"on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callReques
t([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIcon(n
,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id="
<<< skipped >>>


GET /ad.html?cid=1012706&sid=14516 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: img.34wan.com


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:56 GMT
Content-Length: 3759
Content-Type: text/html
Last-Modified: Wed, 28 May 2014 03:23:10 GMT
Connection: Keep-Alive
Vary: Accept-Encoding
Server: nginx
Content-Encoding: gzip
Fw-Via: MEM HIT from ctl-sh-200-132
...........Z.o............c...Rl.r.6......(04.pE^It(.%).n. ..&}di....h
.`}.I..K....4..O.....R.....}..I.....u.9.j7..d..zQC..q`..`0..U..;Fyyy..
.{....V......bJ.."{..l6.G}/f^\|j;`......l 68....4.X......@.;...F......
..^.^......K..}....s.......n......]........>.`.........x..e.....W..
.X.x.e$.....E.\.....v6.....c.H..>>.S .2>.|..,.S..^ A.....=|;.
.q..q....~B.2.]..r}...}?f?..z...M..<0..a.......j........,..g...i..s
.9_.|..A....#PkQ@...`3..:.....D.K.M..$...w.N...........\^b..e.#..f. ..
[email protected]`....C.jU..Z.;...l.P...@M.
.N..57.....".t.f........I...5..&............V?.}O...;...ReQ....N76.e5.
|......w.1.......x...RI.Z.0.......w=.b"C.V.$^]..x.XM......r..........A
i.E....Vs.P.e.)..~...~.u,......j..NE.8.y.......... ..WR.H..V..w/......
.m..X...$......K.u}...6...YQ.I.P..sc..9a:.u:..r.s,.v..o/ai......J..D..
.eP.;...&lQ....a_..:.dV....l.X.c.C........)U...e%.D...........L.;18...
%qg&..6.....%:)da$z...V:.O...W.3.5.......P..l....!......3....2..Ic....
"\D".u.."lbJP..>....{......}&. x..E]e.=..]..&.d.=....=..:HL.s.T.V..
.>...}...K..\(R.......-]...8<....7.$..p..j.O.;z.6....[. ......Ld
.N.07.;6.&..<[email protected].....{..>..gB..C..a?A*p..V..}t.._......W?=
x`..$.Y.(..9j...a.V...M.C.H.D.......p.O9.tV..Jw.... .........x.....G..
Y.iQ.b...3.d.... 1......E.w....i....Q.'g.S....2.&9o.>..U.n.d.>dk
O9=....6..V..J..X&.0..N .......ZF.$....n....x....bY?.......H>g ..s&
lt;.;...j..Lh.$...v....8.j.....y..M(.V.j......&...cv>.k.q..r....]..
. 9..s s.>..,.3..lK.......w....Y..&....k:v#..q...CH....L$f,..o&
<<< skipped >>>

GET /public/js/jquery-1.7.1.min.js HTTP/1.1


Accept: */*
Referer: hXXp://img.34wan.com/ad.html?cid=1012706&sid=14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.34wan.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:57 GMT
Content-Length: 37147
Content-Type: application/x-javascript
Last-Modified: Sat, 12 Apr 2014 05:38:19 GMT
Connection: Keep-Alive
Vary: Accept-Encoding
Server: nginx
Content-Encoding: gzip
Fw-Via: DISK HIT from cnc-tj-021-018.parent, MEM HIT from ctl-sh-200-132
.............~.G....y...#.bqs..L..pd....m{Z.v...?X......j1.y..,......Y
.U....[/"j."..<~..w.ow........ut.w.FWG....&^,....t..W............
b..e..}...|h.Z..|}.............7..v.h....?...N.....0...f..N.w.M......k
.....P..V.NG....y..u.....w.G...C6....g...A.y.u........f......`.j6.....
...:..-......:.A..1_...fc.....l.i.f4?X..u..,.a\..t.....V6..../..a..p.n
:\O.c.O..u.....H^N..!.Y.....f..*M..7.....u.......bp.1....W6.9z....f.q.
nn{.?.\M...W./[email protected].........|.Lm.f..`2...2....w 3...#..0 .
.......l.:[email protected]:..?.....`....<...z.}h._f.Z...' ]  p.5;_O...N
..u..I.X7ye..'.V.Z.....|q.n...I.....A.V......."r..w{...l....~._..0....
r.Z..G...w..~.c........!il..1}.^..%g....?...A....[.............h.2..Vk
....axC.V,..C6.&...2....$...;....l..d.l........sz6~6=.......b.-=..M...
Ez./...%<[..& .j........O..........p.UJ>:.\..f.k.}|.Mr-,~.h]wfg.
.......{.D?.[.7..Ac.qp..;...%....T7...y......,4..u..Y.A...........}...
/..w.......o......]\f...?..;..[.....E.....~.?..'O.o.<...K.o|..s....
{.%d.qp..."...&k..........9........m...j=..'A...!.:A.... .lTY.1W.|u..|
.=.g...^Kn...B...............8. `ys....FG..t...X.N..&...N.vA...../..o.
.4.....P8.L...............{.f....rt7........h....~..............z>.
5....Ug.V.........:W....P....^.R.A\.4bx~u....../....{.\.>......~I..
..8.l._.La.C..[....4...... .....XT.l....._6........?x.......fO....eC.w
Q...|..*:...4.?......id.....q.dd......U...|.f...F....[I...F.....i..../
..p.9.7R......h..........T.6.O2A....'..t=...Hg$..A4.&.6...u6>.]....
..\A.N....;...}....._g3........ ...!|......2.V..:...}^......N..O..
<<< skipped >>>

GET /public/js/inc.js?555 HTTP/1.1


Accept: */*
Referer: hXXp://img.34wan.com/ad.html?cid=1012706&sid=14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.34wan.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:59 GMT
Content-Length: 493
Content-Type: application/x-javascript
Last-Modified: Tue, 25 Feb 2014 09:20:13 GMT
Connection: Keep-Alive
Vary: Accept-Encoding
Server: nginx
Content-Encoding: gzip
Fw-Via: DISK HIT from ctl-zj-205-087.fcd, MEM HIT from ctl-sh-200-132
...........T...0.=.R.!..I.l..W.....V.....4...[.. ._.....!.....I.-j....
73.o.l..k.EP.~...z...e|..Wl.....|f.(....Y...........Q.G..(d..A.y%sfz$.
......u..e..t].(..z<..u.|!.!E.b'*s....z./%.?..R!|C.q.3$......}.|...
...Mit.%...\..EI.....}.f]k..q|.Y `;..|... .g..KW..2.q. xR..^..*e.E..8T
-.i....g#...#...h..).....jp..nU.....fK...2Z.H...f.....g...b9....2...6.
4......z/.7...?~... .r..2...t..pPA...z.=4N...............u.5d.(^".=S..
p.j....k9b9.l./.)3nT......<.>...it.J.~BRQ..i4.R[gk...........t..
................



GET /aa.php?cid=68503&sid=10352&ref= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gm2468.com/68503.html?sid=10352
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: clc.gmhuowan.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: huowan_aasw=1; expires=Thu, 26-Jun-2014 15:59:59 GMT; path=/; domain=.gmhuowan.com
Content-Encoding: gzip
14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Thu
, 26 Jun 2014 09:24:29 GMT..Content-Type: text/html..Transfer-Encoding
: chunked..Connection: keep-alive..Set-Cookie: huowan_aasw=1; expires=
Thu, 26-Jun-2014 15:59:59 GMT; path=/; domain=.gmhuowan.com..Content-E
ncoding: gzip..14........................0..



GET /site/images/wns/20140625_red_4869_728x90.jpg HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 02:56:35 GMT
Content-Type: image/jpeg
Content-Length: 21032
Last-Modified: Wed, 25 Jun 2014 10:30:42 GMT
Expires: Fri, 01 Aug 2014 02:56:35 GMT
Accept-Ranges: bytes
Age: 23286
X-Cache: HIT from qunar_cdn_02
......Exif..II*.................Ducky.......B.....thXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:96674521BAEFE311B
629ADF60B957390" xmpMM:DocumentID="xmp.did:07F7D594FC4C11E39FDDD5E3DC1
15E0A" xmpMM:InstanceID="xmp.iid:07F7D593FC4C11E39FDDD5E3DC115E0A" xmp
:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFro
m stRef:instanceID="xmp.iid:3adf3fb9-e39b-4b5d-a23f-6f1e64972377" stRe
f:documentID="xmp.did:7EE4AD39F08211E391EBB9EF54268508"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
.......................Z..............................................
.................................................!1.AQ".a2.q...B.#...V
..R3T.r...S.......bC$4U...s..D..c..7W......................!..1QA..aq.
.."..2R..#.B3..rC............?... .A..&}... ...Q.....#[email protected]!.
...p.....([email protected]"..>.uT..6_#.}Uq.......d.q..#..
[email protected][email protected]..%.?......E..{....a..{.o..t.3V........]..
<<< skipped >>>


GET /flight/prd/styles/home-2014062503273402.css HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:31 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 01 Aug 2014 09:24:31 GMT
Cache-Control: max-age=3110400
Last-Modified: Tue, 03 May 2011 06:22:57 GMT
Content-Encoding: gzip
Server: QWS/1.0
ef9.............]...Gr. ...;.$....8 .|....9...q.1.........Z-.....?./..
z.t... ....e.....wUW...u..m..^.}...x..w.<-{...t^...>^.......V...
You.[].v.Y...~8l.........f.^<.o7..^.$..(z.l..g4f.M.^...d....^.^..M.
..%....W..].X.y. .}v......W.f...W.....7..zYo.n.t.K.\.K..6...^...Y.'.-`
...{y<...t.n.^..r.#...v. y..b.-{.*...=}..I/......EF8..... ..8..B}.&
4..@....<."....[....:..z..co{(w...?..{.......:.....(L.n{.!....4....
Xf...fG..6K.4...6}Xl7e..>...p.;..$...}V.|L.}...<[n&..H.l..<..
... .5.]."..d....',.7. ......l.*'..G..}Y...}.N6[...........d...RO.&...
.`.|./..D.....77.Q.an?....m..."....e.D~..}d.?0i.d.g...c...l.{...G..`.%
F3.......h..t2..Ge...II.YL..o.~A.Z....-.e.L....ZE..O.........mV...k...
....`d....).O"..8y.(........Z...i.e...(..........'.|..!...x.........c.
`..{.W..`.=..*nTH.7....w.U.$.....,.O....5.H.m..@....~..l..Yyo M,....8.
'u..I..l...K"..JX<4...>l.....L]..Pn.....O.0...n...\M./..s.).....
y...Y~?..e..4..B.}i.Q`..`..\.....P...fC.rh......=X.>.,...q9...G.y.$
.>.........M...OL..?..8x......../.^..Ht[8.... .A.D..Y....Q.k.n...i.
 G..v.UEh#.N......x...0...2:..(.0......]G."7Pgb.?3>..k...x...ktt(E.
C..H..W.SSs\nw...^l.,..&IBs.......=k.....{D.#.....`.B.p..*[email protected].*..
..X..?&c.....W..u|..Dy..S"..w......:..$....X4.v.".g0p.w.x......h$T....
...W<......._........0sj...y...~.........d|[email protected]:W...
'..{r...3.7..xXD)..~..S..fzr..~j..$...Gh..80}GqBL....D.a.G.....a..M...
i.l.16.2...U.3bs...0.xr2.M..Sjq%.p.......}x3.......*.....}.S..1..L.H.O
.k..<k..C..K.I..J..)...:..L#. ..>..2R..)V./...~..h..O.0<.
<<< skipped >>>

GET /js/jquery/build/jquery-1.5.2.min.js HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:33 GMT
Content-Type: application/x-javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 01 Aug 2014 09:24:33 GMT
Cache-Control: max-age=3110400
Last-Modified: Tue, 03 May 2011 06:22:57 GMT
Content-Encoding: gzip
Server: QWS/1.0
eda...............~.G....}.0.-#..&.z.@A.[.......\U ..%.. @..D.`?.<.
<.|.'...!.}g>wj......8.9q.x..4.7....\.k.....r..^...L...EoN..x.Du
&..u.........WG........t<Y7........&....j:...7.Yc6...U9l.........o.
~.X,.........j..7..z.......#......`v3,W..._..........][email protected].\0
........Y.{0......E.7....q..a....u.j...4..-...4N..z....OlE......S...4G
7...j..~~....i...-...r...NW?M...[.;.V.p.....]..v........nf..O...M....,
.k.Ek...ju.V...^..n.<.{....a3{.....gY~......W.f._..ey1h....U3.NW...
E...ey.xS6.S..0.l....fc..|......2;....{?.{L.T.yk..........&...m..zk.g.
..=/(Zi...,T^.95..Aw=........w3....D...]X.y...;..E.S....E9X7.o...b....
...7_.z.C...;#aS......1}.Y...$...?.'..Y....l..V.../[email protected].?......y..
.I./Y.A~.n.../..u.|...O....=.8..T.....V..U........Y9..'.Eq........*...
.>..........x...f.>..z3.H{..7..q..5./F..@a.^N.............r..3..
......<?../....`.R.<..........e.= {.H?.....l?kd....=.^.o6.n.X...
.<..n.m...t..].......n..4z.|.k..._...F.....k..............;..u..~2.
y{.qX...{..7..h...#.x.d......H..F.......p..e.Sd...1.........;.. o]7...
..pzR..Q.P........c.-.``U.yZ.......i9.....s[..Vh....:...............d.
m..B...d:Z7.B[....._M...q.....To.}U.@.....@@.L....#...y....#.{.....s.Y
q.M..SS.a....]9>7(.#........V.......x..=..v...t....}..\..4x.^...G. 
."v.v/.S...BblFi..[..\...;.=..C.{...0.?A^.M....n.:...>-.g.l........
[email protected]....,..r.|c...~.:...z...H...... `..a.&l
t;.ydc.wG.lV$A`?8.-JF:f{.#.... .&..`.o6BP|.a0.....i...hO:[email protected]
.|:}z.@..{3...5kO.(.....~.fZ..G.Q....wf.~...'B.,/xW.~...b..'~.....
<<< skipped >>>

GET /flight/prd/scripts/oneway_index_config-2014062503273402.js HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:35 GMT
Content-Type: application/x-javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 01 Aug 2014 09:24:35 GMT
Cache-Control: max-age=3110400
Last-Modified: Tue, 03 May 2011 06:22:57 GMT
Content-Encoding: gzip
Server: QWS/1.0
20a............uTQk.P.. r.... W|....K.>.!w.]r..li2..<.a.nuC.V.d.
.sb Y.v.....4../i:...C 9.;.;........e...d..f.._.e.B._\.%F*. ..\.SN..v.
....Cy9...{..H*U.H.S... ../. %.&.w....nr...~..H..........|.c..n...1..h
.E..W}.g.q...M.DG.....>.....;Q.{.F9.lu...<[..$...4.....h.....-..
..6.,.z....a...,.......lId[A......gV9=..^-..%.._....U.S.w.F.3K..u.....
.e.......U.*^\2..0.....[..>J.....^2n".Eo.b..0*X67.f`::..y..[..Ae...
. XsG.!..x.j..e....m....S......!x^..h2.MF..)..I. ......",n8.E...Y.o...
t. ~....X.}........C..nG.5..{.L.q.}<I......."...h.....0.....
.


GET /flight/prd/scripts/home_pack-2014062503273402.js HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:35 GMT
Content-Type: application/x-javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 01 Aug 2014 09:24:35 GMT
Cache-Control: max-age=3110400
Last-Modified: Tue, 03 May 2011 06:22:57 GMT
Content-Encoding: gzip
Server: QWS/1.0
eda..............iw...?.U...S.9.)yI.p.#Qr..k.$.v(^..J....ZL../Q.o..8..
x..Y^...,..|..$_..........9q../..............|..XZZnv...K.U;.{....R...
....w..3..}....z...D............~}...GU.....o........_.Qa..o{.}zD..S/.
>...._~.{....z/|...?..p...v?{....v.yiD...c......k...B....FW...v....
.W.....Q].......Q....zW^..=.!.o.....#........p~...7..vT..{...U./..?.E.
.O..dNL.hc...... .......?|q..}.....-...>.B..?.^xgD.....s#*...M.....
s..".l...`@..[.......V.......W....o.W?.!.z/^..N.. ..5....n...q....<
{cm....8c..... .A...J. .g.....q.....A?;s...............Ul...kWz...{.=.
/[f.......i.q..X.p.Y4..4....f.........vL....../........>.td.....6C.
7.....6q2.k..................=.1.g.h...C.Z......KWv.a.L;@8@.?..f...z7.
....3.......>.......g.[..L.-RG....>.r..O...o.....~.../...w..{...
'.p..,.A....T.%%.....t....._.^x=j.......!."N.7.....C...g?..m,..<.^.
[../..>....g.Wv.......v.....^.}..N..v..g..7.s1 M.x........i*...N...
.....].b2..},{.|;Zg.....~.A.yw..I...[L.EQ....o.r...E............>..
t...7......NkCi...s. .f...|....o:uv_..l}..';...{.....B.1.h9T%..Y..[...
...G9..-z.E. .Q...=.....=...u$...Z.#..U..V....|..."Zi.[!.z...ul......u
..m.l.jC.........._%.m ...O.r..".[J.w..|.Q.V..o...`.2]....n...:......n
.>l.......R...z/~......>.......0m.......L.....|>.....){......
A......].m....5...;...5.#..P0.....-`.x.........?r.d....4..l..^...,lx..
.z.<.F..}....O.r........gv.R.v.S#......Eb#..!^a..........].....-:..
...k?.}.a..I.#.X.......5......c..=w....#.............?....o......{..Q.
>.O^.y.]..'..%.7....9nt5.C.1..J.....?}w.......WG......A......[c
<<< skipped >>>


GET /txlink.php?alid=40782&oid=7893&game=qs HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gm2468.com/68503.html?sid=10352
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: txt.union178.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Thu, 26 Jun 2014 09:24:31 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: hXXp://VVV.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&p=
0..



GET /jquery/jquery-1.4.4.min.js?v=1 HTTP/1.1
Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: css.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:23:36 GMT
Cache-Control: max-age=2678400
Content-Length: 78601
Content-Type: application/x-javascript
Last-Modified: Thu, 20 Sep 2012 03:29:06 GMT
Accept-Ranges: bytes
ETag: "eccdc016e096cd1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 quanzhou245:5 (Cdn Cache Server V2.0)
Connection: keep-alive
/*!. * jQuery JavaScript Library v1.4.4. * hXXp://jquery.com/. *. * Co
pyright 2010, John Resig. * Dual licensed under the MIT or GPL Version
 2 licenses.. * hXXp://jquery.org/license. *. * Includes Sizzle.js. * 
hXXp://sizzlejs.com/. * Copyright 2010, The Dojo Foundation. * Release
d under the MIT, BSD, and GPL Licenses.. *. * Date: Thu Nov 11 19:04:5
3 2010 -0500. */.(function(E,B){function ka(a,b,d){if(d===B&&a.nodeTyp
e===1){d=a.getAttribute("data-" b);if(typeof d==="string"){try{d=d==="
true"?true:d==="false"?false:d==="null"?null:!c.isNaN(d)?parseFloat(d)
:Ja.test(d)?c.parseJSON(d):d}catch(e){}c.data(a,b,d)}else d=B}return d
}function U(){return false}function ca(){return true}function la(a,b,d
){d[0].type=a;return c.event.handle.apply(b,d)}function Ka(a){var b,d,
e,f,h,l,k,o,x,r,A,C=[];f=[];h=c.data(this,this.nodeType?"events":"__ev
ents__");if(typeof h==="function")h=.h.events;if(!(a.liveFired===this|
|!h||!h.live||a.button&&a.type==="click")){if(a.namespace)A=RegExp("(^
|\\.)" a.namespace.split(".").join("\\.(?:.*\\.)?") "(\\.|$)");a.liveF
ired=this;var J=h.live.slice(0);for(k=0;k<J.length;k  ){h=J[k];h.or
igType.replace(X,"")===a.type?f.push(h.selector):J.splice(k--,1)}f=c(a
.target).closest(f,a.currentTarget);o=0;for(x=f.length;o<x;o  ){r=f
[o];for(k=0;k<J.length;k  ){h=J[k];if(r.selector===h.selector&&(!A|
|A.test(h.namespace))){l=r.elem;e=null;if(h.preType==="mouseenter"||.h
.preType==="mouseleave"){a.type=h.preType;e=c(a.relatedTarget).closest
(h.selector)[0]}if(!e||e!==l)C.push({elem:l,handleObj:h,level:r.le
<<< skipped >>>

GET /lw/js/sign_v3.js?v=1 HTTP/1.1


Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: css.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:23:36 GMT
Cache-Control: max-age=2678400
Content-Length: 333
Content-Type: application/x-javascript
Last-Modified: Wed, 18 Jun 2014 13:04:38 GMT
Accept-Ranges: bytes
ETag: "be2192dcf58acf1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 quanzhou245:9 (Cdn Cache Server V2.0)
Connection: keep-alive
.....document.writeln("<script>var hhc =new Date();document.writ
e(hhc.getMonth() 1 \"...\");var hhc =new Date();var hui= hhc.getDate()
;if(hui<10){document.write(\"0\" hui);}else{document.write(hui);}&l
t;/script>............<span>1</span>......<span>1
2.4</span>... .........<span>420...</span>......");.
.            .......            HTTP/1.1 200 OK..Date: Thu, 26 Jun 201
4 09:23:36 GMT..Cache-Control: max-age=2678400..Content-Length: 333..C
ontent-Type: application/x-javascript..Last-Modified: Wed, 18 Jun 2014
 13:04:38 GMT..Accept-Ranges: bytes..ETag: "be2192dcf58acf1:736"..Serv
er: Microsoft-IIS/6.0..access-control-allow-origin: *..access-control-
allow-credentials: true..Age: 1..X-Via: 1.1 quanzhou245:9 (Cdn Cache S
erver V2.0)..Connection: keep-alive.......document.writeln("<script
>var hhc =new Date();document.write(hhc.getMonth() 1 \"...\");var h
hc =new Date();var hui= hhc.getDate();if(hui<10){document.write(\"0
\" hui);}else{document.write(hui);}</script>............<span
>1</span>......<span>12.4</span>... .........<
span>420...</span>......");..            .......            .
.
<<< skipped >>>


GET /9.gif?abc=1&rnd=569172903 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
Cookie: atpsida=69687743fd8102e8c2d45a6b_1403774663; cna=x9QyDBpdXF0CAcGK9OfjJSLK


HTTP/1.1 302 Found
Server: Tengine
Date: Thu, 26 Jun 2014 09:24:29 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: sca=9f728ddb; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=69687743fd8102e8c2d45a6b_1403774669; expires=Sun, 23-Jun-24 09:24:29 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=x9QyDBpdXF0CAcGK9OfjJSLK
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Thu, 26 Jun 2014 09:24:29 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: sca=9f728ddb; 
path=/; domain=.cnzz.mmstat.com..Set-Cookie: atpsida=69687743fd8102e8c
2d45a6b_1403774669; expires=Sun, 23-Jun-24 09:24:29 GMT; path=/; domai
n=.cnzz.mmstat.com..Location: hXXp://pcookie.cnzz.com/app.gif?&cna=x9Q
yDBpdXF0CAcGK9OfjJSLK..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-C
ontrol: no-cache..Pragma: no-cache..GIF89a.............!.......,......
.....L..;..



GET /AShow.aspx?AID=9842 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=667; expires=Thu, 26-Jun-2014 12:24:13 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:12 GMT
Content-Length: 3568
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...i[T......\...Vs....[.ks...u.
......?k.u.*.i.u.{..z.tgg..]?|v|..w...G.>.s(.Sj.K.=........._|..is.
.......X...q[...j.^..v\V..o..u~.K...| .C..Z.....v.7.l.o.a..%y....G..._
r..'....;..l.....v.H.f..C|.|../..0..>....a..2.J.fm~.|.|../\.?.6.."o
.....H.i.K......ZUo.|k.-.;)....../.......j.....g.;.}.V.|....~.........
.nw..4|z.";...... ...j...R...o..w.A...r]..>zM...2 ....*..V.g)p..i..
dL..x.;.....~.....Ow......;..T.([...#...`.......WY;...!.-..&.>...m&
gt;..............v............3...."......E..V....`>.!../..O.h....A
....Y...W..{A...~.$....._..pZ......I.~..'_.C....g...U>y[....!}.e...
........2.,......&../....5.........;...y...O<E.(........6o......O..
.(.].....;..m._..........`.....^WU9..t......!.... .d...7.rJ.ySg.y.....
..?.....j.c.....;...}.%.L...n>...6.d:..E............l?$..}.......U^
.d.1..jQM.2.j.{.[..M~.l....w.....v..'=J.>...z............yM8.0d..?.
...~..gu...Z.._..:.}.\[email protected]............*f.M...:
?..n..XQ..t......U...\...F.\.nB....M..2&.xQ...~ \.5../w...?&%.O...}...
.Z..'g.w..~J.ng.#zwFZ.....y^\.[.uZfM..'._.=}...g.?&m.......{......]...
....]ipo{g..9.....< .........4.>.......G..\..g.....v}.M..\../...
....!.-......P.Wo0..~<.{.x......~&X>... ...n.<.1`0.....C...''
;........K......je.1 .r...-i....yU/......t.. ..4..#2.d.>....4......
.j2......o.@.\....^Q.f=Y..^./25d.?.....c..........4(.C?h.G....U*..-.Lc
r..m.......u(......!..E....h.g...........9.M..:...yC..= ..l...-.j.
<<< skipped >>>

GET /AShow.aspx?AID=9756 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShowTG=1960


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=1960|1805; expires=Thu, 26-Jun-2014 12:24:20 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:20 GMT
Content-Length: 2549
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:m.u.....]=.{ww..x.........w.
-..........>.._.......^....~0^\....]..{.i..{..'O.b.v.5.w......v.v..
.......?....v..........{..}z......O..v.=9y.........N.=8~......={...d..
......Ow.>8x..."....~/........O..%.._...~..jQ,......ySO..{...X^.{x.
..i.:?.....Y5]/..qYM.....&....F{...w..~...../|Z-.bI.>.{....C2.<.
9...?.wo.........z........NN?...l.......O...}.t.........O.}zp.l.....'.
.B.....O....._.:;...jI#...yGG...........~..bF..=.9L#....b.~....{...j,_
1a.yu5]-..v.{H..."_...!...;........cl\...j...k._E.=-.&........~...'NZ.
..F......O.Fq.n....:.....y...;.D.;.}..z9...e>.8...0]f..E.V5..z[...l
R..;./.......r....C...z.....g...P....3.`......._....?.'../...g.r]...ge
..O......l.{....YU/...).y..0..yuQ.w./.....G..._O..,...4}......]>...
....9.2.$...~..........q.7....H>........~.........T>....g~F>.
...Rk.q..n?}..*.6E....`......h..0.q......g..r......6......|~..........
B....~F81/......,d....1H..E.f..I;..z-.sz-...t..Y.M.f..`......d......h.
n.2.T[:...1Y.2..e..G.E...#.'.......l.].o.l...l..(.e.......y..>..Y^o
..a#....bz........)[email protected]....}.....~4.n...9.d...RV...V.R......IU....
.=..Sb..../.....q..C.;n......>~<#5Q.>............g..?i...P}U5
.8...9L..]..}.([email protected]....~.....`..^>....m...........>..P
b}......u..1....... .......a:].MU?.gK....G.4K.0]4.-.$.g.l..9SH.....~.w
.............fUf...dp.o.%;D.}...e.L.b.>.C........:o..R...#.D..P.4.M
....W...%:./[email protected]...".0.....:..7G...[....,..&7...
<<< skipped >>>


GET /images/v8/s_index/banner/1.jpg HTTP/1.1
Accept: */*
Referer: hXXp://xx.ztgame.com/index_gc_ad7.html?ad=2343627
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xx.ztgame.com
Connection: Keep-Alive
Cookie: uniqid=1406261724512128767627; ref=2343627; date=2014-06-26 17:24:51; ref_date=2014-06-26 17:24:51; ref_ip=193.138.244.231


HTTP/1.0 200 OK
Accept-Ranges: bytes
Content-Length: 34923
Server: DnionOS/1.0
Date: Thu, 26 Jun 2014 08:32:13 GMT
Content-Type: image/jpeg
Expires: Thu, 26 Jun 2014 09:32:13 GMT
Last-Modified: Fri, 13 Jun 2014 11:49:22 GMT
ETag: "d48334-886b-4fbb644b25480"
Cache-Control: max-age=3600
X-Cache: HIT from CTS-GD-212-39.fastcdn.com
F-In-Cache: father-in-cache
Age: 3167
X-Cache: HIT from CT-ZJWZ-251-70.fastcdn.com
Connection: keep-alive
......JFIF.....d.d......Ducky.......=......Adobe.d....................
......................................................................
......................................................................
......................................................................
.........!1.AQ".aq2....B.....R#3...br...CS.4T......$t5Uu6V7.......cs.D
dE.&F..%e'......................!.1AQ.a".q..2....BR...r#3..b..CS4.....
.........?......(......(......(......(......(......(......(......(....
..(......(......(......)....T....i."n......>C$.8<R;O...b.Nl.$.ht
.)>.]..............0p.%.%............#.4......G:.bdb...kU.I...M9.9.
......G$.#y.1.%......S.v|..L.........r...[ .....5.~...eLv...L#[.....k.
I5 ....y*e...3...\L.tO(:U%eIE...5.;O...t(.......{..<.....&..lk...Hb
..y..2q.X............Q.=....3.C....Vm..Sc..7.m..E....|L.F..u/Gt.6.M...
.\.5.4NG..(......(......(......(......(......(......;}[email protected].@....
[email protected][email protected][email protected]*.1'R.$..*.K.Es!.|z..l.....$|\Mk\/....
D.......xZ....z.tS.F6.dr.([email protected]%.$.bA".&....x...
]P.W....uH.l.y.....v.L.N>..dz/D ...&"..$.[...j.HjL.y..Y.K.....$.#U.
.....YZ..j..&K..Lqkp.@......%.../&.D.m.6.o.G... .qJq?...?.C`?.\k..=..9
@..-..4....).(.:G....."K*..R....M.'.....T....AZ..q.........Zt.&._.....
....!.fFu....=........Ci.UD...iW...oBS......|y_...U..!P .....(........
.RvV.RIJ...RA..0.".x.>L..u!8=..76y..Osq..C...5n4......m...B.2VV....
}c.|I....!6.*(q..lG....V.-..>G....cz..~FrLl .%R.%..X...i..E...u..Q.
Ne...-.d.BFH.D.Y.qPV.T..n....H$.>.u..f..C.c.&;.z;.K......,]*J..
<<< skipped >>>


GET /index_gc_ad7.html?ad=2343627 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xx.ztgame.com
Connection: Keep-Alive
Cookie: uniqid=1406261724512128767627; ref=2343627; date=2014-06-26 17:24:51; ref_date=2014-06-26 17:24:51; ref_ip=193.138.244.231


HTTP/1.0 200 OK
Server: DnionOS/1.0
Date: Thu, 26 Jun 2014 08:57:00 GMT
Content-Type: text/html
Accept-Ranges: bytes
Cache-Control: max-age=3600
Expires: Thu, 26 Jun 2014 09:57:06 GMT
X-Cache: MISS from CNC-TJTG-42-56.fastcdn.com
Age: 1675
Content-Length: 5965
X-Cache: HIT from CT-ZJWZ-251-70.fastcdn.com
Connection: keep-alive
<!DOCTYPE html>..<html>..<head>..    <meta http-e
quiv="Content-Type" content="text/html; charset=utf-8" />..    <
title>........................ 6...20...14.........................
....................</title>..    <meta name="keywords" conte
nt="..................................................................
................................xianxia...xxsj........................
......................................................................
....." />..    <meta name="description" content="...............
...........................................................6...20.....
......................................................................
......................................." />..    <link href="/cs
s/v8/s_index.css"  type="text/css" rel="stylesheet" />..</head&g
t;..<body>..<div class="wrap">..    <div class="contain
er">..        <div class="top">..            <div class="t
ip">..                <a href="/index.shtml" title="............
" target="_blank" class="this">............</a> |..          
      <a href="hXXp://xx.ztgame.com/download.shtml" title="........
...." target="_blank">............</a>..            </div&
gt;..            <a href="hXXp://act.xx.ztgame.com/maidan_v3/" clas
s="bander" target="_blank">.........6...20...14.........</a>.
.        </div>..        <div class="step clear">..       
     <div class="jiantou"></div>..            <dl c
<<< skipped >>>

GET /images/v8/s_index/banner/3.jpg HTTP/1.1


Accept: */*
Referer: hXXp://xx.ztgame.com/index_gc_ad7.html?ad=2343627
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xx.ztgame.com
Connection: Keep-Alive
Cookie: uniqid=1406261724512128767627; ref=2343627; date=2014-06-26 17:24:51; ref_date=2014-06-26 17:24:51; ref_ip=193.138.244.231


HTTP/1.0 200 OK
Accept-Ranges: bytes
Content-Length: 36695
Server: DnionOS/1.0
Date: Thu, 26 Jun 2014 08:25:51 GMT
Content-Type: image/jpeg
Expires: Thu, 26 Jun 2014 09:25:56 GMT
Last-Modified: Fri, 13 Jun 2014 11:49:23 GMT
ETag: "d48336-8f57-4fbb644c196c0"
Cache-Control: max-age=3600
X-Cache: HIT from CNC-TJTG-42-57.fastcdn.com
F-In-Cache: father-in-cache
Age: 3546
X-Cache: HIT from CT-ZJWZ-251-70.fastcdn.com
Connection: keep-alive
......JFIF.....d.d......Ducky.......=......Adobe.d....................
......................................................................
......................................................................
......................................................................
........!1.AQ..aq."2...B..Rbr#3......4....S..$..5U....C..d...7..csD%Eu
V'WTte..&6G8......................!1.A.Q.aq.."2.....R...B#3.b.r...c...
S4............?..8.f.*.SH...h..l...1..fV.G.TCG......[>..d......h...
MM.gl.M1:.FN.2.^\......;..fbF....$.........Q.]1.H...b..t.4..L`..4..B.1
[email protected][email protected]....}...d?.c...?..q.4{....Wx.g
r.. .S.....tYI........mf.9.'.........6.V..078_....C"....S\..|..|I]....
X.\...ny.1.oEu91.D.j.j|...cy...gGU..bCV.z.EOo-r.[.^..........W... ,{jD
`.W;.dO.....m;.. .....:.......u..R5........#..f.].T..D.... ...6.o.'.m.
i..r....U.B....,G.5_.N.RJ.z..2....$y.....4F.. w......Q...A61.oQ.2....`
\!cO.`i.j.k}.Z%.H.....,R......x...p.'....]..]u..._.i..L...7...1Q/.....
.......! .[7k.e....mko.V.h.v.J..4...:..t......EW3.sy[....[...Fz"^.(.}.
...]..V....bj......!.....R0..h:.W.u....wM.B..X.......n....)X../@...lp.
9....W.d.....5......pkKAr...46.lMR6.K.*.hT.c).=-d.....k......8.lZ.h...
..#..W.......'..[.bG.{....Z...~Z....O.>..........T.gk..DG.jr.WL...[
.."i...O.Oy.0I,.....j[B...s......5.M.z.,..m.AJS.........O;..]~........
..W)..#p.H.....{...[N....._.o..~f...yw....9s.......,...........N8....O
.v.:....c.'[email protected].}.X...58Et...]R1..WTd..4.hE4...2..t.lA:D. .2........
zN.......6b.n..A /.yr.C.x.Z...X......W..>:a ..M0..x...4.=zc@. .
<<< skipped >>>


GET /htracker/pid=2468/media=quna/place=73gjp3/size=230x200 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://source.qunar.com/site/images/wns/20140619_flighthp_tbut_230x200_4031.swf?clickTag=http://qde.qunar.com/event.ng/Type=clic
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ad.thinkmedia.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:20:37 GMT
Server: Apache/2.2.6 (Unix)
Set-Cookie: DMP2=140377443739145008; path=/; expires=Tue, 23-Dec-2014 17:20:37 GMT; domain=.thinkmedia.cn
Cache-Control: max-age=1, s-maxage=1, no-cache
P3P: CP='CAO PSA CONi OTR OUR DEM ONL'
Content-Length: 14
Connection: close
Content-Type: text/html
<html></html>...



GET /PClick.aspx?AID=15235&KEY=6FBCE2FEBE3F1F4B34035BDB1B9868C2CC3F7B0F77DABDE2 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: js.union001.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://VVV.gm2468.com/68503.html?sid=10352
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: Union001ADShow=2165; expires=Thu, 26-Jun-2014 12:24:14 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:14 GMT
Content-Length: 159
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://VVV.g
m2468.com/68503.html?sid=10352">here</a>.</h2>..</bo
dy></html>..HTTP/1.1 302 Found..Cache-Control: no-cache..Prag
ma: no-cache..Content-Type: text/html; charset=utf-8..Expires: -1..Loc
ation: hXXp://VVV.gm2468.com/68503.html?sid=10352..Server: Microsoft-I
IS/7.5..X-AspNet-Version: 2.0.50727..Set-Cookie: Union001ADShow=2165; 
expires=Thu, 26-Jun-2014 12:24:14 GMT; path=/..X-Powered-By: ASP.NET..
Date: Thu, 26 Jun 2014 09:24:14 GMT..Content-Length: 159..<html>
<head><title>Object moved</title></head><bo
dy>..<h2>Object moved to <a href="hXXp://VVV.gm2468.com/68
503.html?sid=10352">here</a>.</h2>..</body></h
tml>....



GET /site/images/zhuanti/huodong/header0625.jpg HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg4.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 9221
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 05:45:51 GMT
Last-Modified: Wed, 25 Jun 2014 04:20:04 GMT
Expires: Fri, 01 Aug 2014 05:45:51 GMT
Age: 13123
X-Cache: HIT from qunar_cdn_01
......JFIF.....,.,.....C..............................................
......................C...............................................
........................!.l...........................................
....................}........!1A..Qa."q.2....#B...R..$3br........%&'()
*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................
......................................................................
..........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.
....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
.............................................................?..g.....
...^.....W.S....RZu.........mo..................W...|..W....G....j.j..
.}..Z...G..X.W.,.m..p/BIm..E...dImZI...<)...8.........b.x...K...h,6
"......J3....K.3.........I..'.~.x.....Y......n2x.n\..N).X:....Z.S.....
.. Q.J2..E....... ....u._Q.~.F4..h._..=....$.okm.;'..%...22..J.C..?.&l
t;>M.O7.........NT$...{..t...:.y..Z.5..8q)Cg....m..g....?c..(_.o...
.....5..5...................^-.Y.....-.........-b.......E_..'.........
..a..eQ.U..[...G.....d.{'G...6....(.0R..o.>}.<K....{.8.......U.a
.'...W_.xL.2.]z~....J.....Tp....)..R..M....>.....,..I..-..r1]..f...
O...........C.)...p..|)........G.....7...<r...}.)....iO....:8.Fui{Z
rt.V..Z.....e>.>......q..V.....I.p............u.Fu...<E...b..
b..%.5}.Zq.P..#S.Nx.o......Yk.iv..Z..Qis...]j.r...w.M....gv..."Ir..&.q
..~.....WO.G.R....bi......Tq5...%..F..uV.:...Zp..I.....B..............
k...V..N...JX\=lJ...k.#..Tj.....:....5]5%Nv]G..n.%.Z...4.ot..Z.=GI
<<< skipped >>>

GET /common/hf/footer_v10.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg4.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 06:31:58 GMT
Content-Type: image/png
Content-Length: 8209
Last-Modified: Tue, 15 Apr 2014 06:55:05 GMT
Expires: Fri, 01 Aug 2014 06:31:58 GMT
Accept-Ranges: bytes
Age: 10357
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR..............9Ms....gAMA......a.....sRGB.........PLTE
........6......................................D........<..........
...j.yyy-....!....v...........z. ....!...............'.....333.g."....
........s..w..p...........|.YYY.....&....."......jjj..................
......GGG..d.............MP..e..m.....$.pp.....!..4....<9.hl.N.....
...............pr.......v....t......EB....dd..%i......9..[..21.......y
y...T..........M....MM.(..............[[.....h.....c....RR....*&.....\
....k...............'.."..{[email protected]......*.5........J.
....8.}.....;$...=....u.pq..X....|..N*A...s...d..S....VZ._a.....X....^
=.................~.......?.....AG...d.l..[..i........E.R. {......?N.W
.7:.....y..=....f.x....p.............'..y|.]..(.........'..^.g6..5....
[email protected]"7?o..)GOz.w .....c.....OY`......o.....|..O....w]...kq.x^
;y[*/g.V....tRNS.".l.......l.!i...l!........IDATh....\SW......w....w.s
....4.....&F%7...L..1....d..."...K...!*..R.# .R.DPAAk..Z..Q..i;m.3m...
......@....../..{..9@~..{.s.....3V60..../..7)......?.0...:L.?.=.......
[email protected].'H..}M...._.|../^z.|..?C^:..y........ .......`...E.{
..E...H...(.I...............^@.!..6Q...&.j..=.....]~k......w.ON.....%.
.....=O...\.5d.j...!......xL... a."..)..w..fwm.w.W.......%...._.$.XSs.
.........l.x....q....o.........F..8.g9.^....}....,k.}.V............?..
.....7.[..|....;..~~!~D..._..-..q#..p.y.{..."...5k.'.Z.b....$..6...#00
...V([email protected]@.........#.j&9.y.v..H.[.....#...3r."(...3
.8..............r.?~$A.f.(h.Oi..r.....D.....s.B.u/.....]..........
<<< skipped >>>

GET /common/hf/24h.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg4.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 244
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 06:58:37 GMT
Last-Modified: Tue, 15 Apr 2014 07:10:04 GMT
Expires: Fri, 01 Aug 2014 06:58:37 GMT
Age: 8758
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR................R....gAMA......a.....sRGB........-PLTE
....f..i.......`..x..J...........*........*r..m.O...eIDAT..c``9.......
T.[.&000./`a.....T...I.P..... #. .2..e.D........(.....(.D.90p....Az...
......8%.........b........IEND.B`...



GET /pic/spacegif.gif HTTP/1.1
Accept: */*
Referer: hXXp://p.tuigoo.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A60AAB6420FBCFD38A74E8F7A85C55E29907E532FC72AB49DAD&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: js.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
Last-Modified: Tue, 06 Sep 2011 15:04:12 GMT
Accept-Ranges: bytes
ETag: "0fe5c3ca66ccc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:16 GMT
Content-Length: 60
GIF89a.............!.......,............................S..;HTTP/1.1 2
00 OK..Content-Type: image/gif..Last-Modified: Tue, 06 Sep 2011 15:04:
12 GMT..Accept-Ranges: bytes..ETag: "0fe5c3ca66ccc1:0"..Server: Micros
oft-IIS/7.5..X-Powered-By: ASP.NET..Date: Thu, 26 Jun 2014 09:24:16 GM
T..Content-Length: 60..GIF89a.............!.......,...................
.........S..;..



GET /event/promimg/?src=pming393 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Thu, 26 Jun 2014 09:31:47 GMT
Date: Thu, 26 Jun 2014 09:23:27 GMT
Server: wswaf
Content-Type: text/html
Content-Length: 5885
Last-Modified: Thu, 26 Jun 2014 09:19:37 GMT
Cache-Control: max-age=500
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 4
Age: 61
X-Via: 1.1 jszjsx51:8080 (Cdn Cache Server V2.0), 1.1 yfdx32:6 (Cdn Cache Server V2.0)
Connection: keep-alive
...........\{wS......;l....&;;i.4m..........UG.N........I).1.#.8.TD.^.
....sD,...@../......3..*.q..d=...5.\s9...7'&...I(Z%m|..1.-..ie3.*ZV%-.
.....DT7.EiddD.McBl."..wI.d@.*.eWU.eB.z.R.Vdr........Y.nK...B.(..be.V!
.......W.....v..r...M......I...L$.C.7.,..L( ..j.T-%RS....dK..>..k..
l~hz....7v.kt....iMY.H.*........P..:2.Y.9SHn........[......O$7n..w.7.r
^1....eV..T-.RK.4e.~.../n6.?."B....._Z.?~..'......O.. oo.?Z....u......
...X7..w......T...._F[6e..4Z.y.S....._.~........-..G..n^1s.Zi.......K.
W...5.../^n~.Qs...;w..|Z?z....m^._?v.........w.]`..w.5N_o........!@..:
...V}.J...?.........z.../.._....D`[email protected]....#g......
.....v.........i.(M-...E....nX..%.P..P4..k.5C.&.......S,.5...?!...fBjI
.V...>......7..T.9.@..~..5jA..,. ..^.MK.d..*.....|......&<....lT
...EME6r.(Z..o..}9].d...q!"..~(..\....E.NU.>.._ ....g..s.o.. .F.#{&
.M..^2..$...S.. .a....=...\.. S.^..L.Eg...1.O. .....D_.(..].vo..>.d
[email protected]._...h..[.o.
.E%......S......,d.....P......X.0.}q...]U...H.T4>U.$...6.7..'.[U1].
E....i..(|9..;*..L...0p...........1uL,..KV.....Wk....*.d.,.!..&.U...D,
8."e.(....l..H?...#%......\....A`.m8..&.x{..j*.v...$!.~.b.nC.........u
.D"|....c.|%.....X8.%[email protected].
...1`?.......I.....T.....eB~Ooo6..}&.^:$...Zq..R....F.Q9V....r..Y.....
....?...?.........}Slp...Wt.d;..M....lL#0.Me5..34...r....[,.$..[I..uD.
.....D.....>w..a.j ....yU,.k....1...l.u.N...73#.dnd.........x......
.\n.....L0.....Q.......t./.G(v.R.......6k.....C..gk.i.....[./N>
<<< skipped >>>


GET /imges/live/index/firstpay.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vr6.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Content-Length: 5084
Cache-Control: max-age=31104000
Date: Wed, 04 Jun 2014 04:35:40 GMT
Content-Type: image/jpeg
Expires: Sat, 30 May 2015 04:35:40 GMT
Last-Modified: Fri, 24 May 2013 06:57:11 GMT
ETag: "1483540164"
Powered-By-ChinaCache: HIT from 13002013S5
Age: 1918130
Powered-By-ChinaCache: HIT from 06047153PC
......Exif..II*.................Ducky.......F..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
1 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmp
MM:InstanceID="xmp.iid:162404BBC43C11E2AF6EBF574F926D9C" xmpMM:Documen
tID="xmp.did:162404BCC43C11E2AF6EBF574F926D9C"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:162404B9C43C11E2AF6EBF574F926D9C" stRef:d
ocumentID="xmp.did:162404BAC43C11E2AF6EBF574F926D9C"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................#.n...............................................
............................................!..1AQ".a2#3..BR4q...b5...
CSc6.....................!..1A.Qa"q...2B.......Rr3bc....#..4..........
..?.....N."c.-..8..S.%.)....q<MMu..[q..;..?W.5..Z...#vT6..X|T....{.
...E.....!L<8.)Wr..F..RB...j..A..|...Oz{...n.M.e..6.)F...nd...:....
N..Q.k.'T]y......u.{...q.y..5}.......].\.`&C.6.Q.u.....J}..T}. yx..I..
o..[U..A.II.~2...`.)!...D........yS}S..Sm........*t:.A. D.......P.
<<< skipped >>>


GET /app.gif?&cna=x9QyDBpdXF0CAcGK9OfjJSLK HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com


HTTP/1.1 200 OK
Server: Tengine
Date: Thu, 26 Jun 2014 09:24:26 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=x9QyDBpdXF0CAcGK9OfjJSLK; expires=Sun, 23-Jun-24 09:24:26 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Te
ngine..Date: Thu, 26 Jun 2014 09:24:26 GMT..Content-Type: image/gif..C
ontent-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa A
DMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=x9QyDBpdXF0CA
cGK9OfjJSLK; expires=Sun, 23-Jun-24 09:24:26 GMT; path=/; domain=.cnzz
.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache.
.Pragma: no-cache..GIF89a.............!.......,...........L..;..



GET /live/08/80/a7e7de85243a438ba91ea4d3d8a017b2.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi1.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Tue, 27 May 2014 08:34:44 GMT
Content-Type: image/jpeg
Content-Length: 55300
Expires: Fri, 22 May 2015 08:34:44 GMT
Cache-Control: max-age=31104000
ETag: "1184062621"
Last-Modified: Fri, 20 Dec 2013 09:21:16 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 2594987
Powered-By-ChinaCache: HIT from 06010923Sf
......JFIF.............<CREATOR: gd-jpeg v1.0 (using IJG JPEG v62),
 quality = 100....C...................................................
.................C....................................................
...................f....".............................................
...............}........!1A..Qa."q.2....#B...R..$3br........%&'()*4567
89:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...................................
......................................................................
.....................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&
'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz............................
........................................................?...L...`....0
e.A.. ...q....N.....A...O.\Zn.h.T$_DW)".$2.}...Lu.#.o..9......R.......
I;C....S.. ......[...)......m&.0...Q..o^}y.....Fq.-f.{.Y...*.i&..R2...
.1|..Q...c1....T.(bp...V....<......v...:..c.8B."#~.D..;...?.`.._...
..........V..6777.d..w..Vlu [email protected]..<.*C&.a.8.}.C...bd.X..8..s...?
...V...=. ...%....r<.;v.1..o.......t2...u(J.]:...{){6..K..Q.Zvq....
..f_.....2.....,V_.S...W.jF..UUi.Q....T....o_........?......."].K,z..}
=..,a....;K...m..22......?i.........<A...&...[^.]>.9.o.C....b.D.
4o.._...........h.......0........[[.:H_j:3.r.<.,.:...I.efeE.]..t.f.
.......0~...../.Z...~....5.3....}.......}3\......:d...y......j.j>..
U.4...|T.;c.....x.P.J.}.,6..U!9.m.T.niQ.....*.....[.8....9.OO3...|..q4
(8...ygx.&.....X.5....5..B.k.T.(I.h....;.C......,.~....x.......W...i$.
..;.....:lv.>..k:E...o..8hz......n.E...m...._...N..;.h.o.4.....
<<< skipped >>>


GET /lowerPrice.jcp?&callback=DomesticLowPriceHome.showLowPrice HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:37 GMT
Content-Type: application/x-javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
Content-Encoding: gzip
d4e..............KoW.....W..../t.........He.:2TQ.X..`l..!6..H.@U,n....
.....-......{...x.-3z/..<.33.....<}...?M....S.O.q........._|rv..
.3.......=._.N.5s......SG.rv..._M..J.r........:............:q.........
o..._.;3..Y.....pVO.;...:...<.r......g.w.?..L.k.s._...7.....S.N}8..
.y....3a...S.v.....k..,>..z.c..<.......i..v.p=m....y./.....<|
..~....I.........N~$5......k...C;.XM..r..jt.Z.q....D.^.mx:......vJ...y
....7...aW..U.#.B.../...=..O9-...........'.....J>V8uV...=..........
G.=.qg.N..........x!z.......=.Ow=.....b.......xm.9G..&).....K...Mxa...
n.<..4.T$...O..........h.[..."......Z.~....W.n....v.CZD....~....gT.
.../..3.yg....#...O..]s=..q..N;...~.*.#.=..%2...........]..... ..o..Q.
...j. .}.^.....!..;.........4........S..Z......%v....o....m....5......
.....;E...F8Qn.o....nT.W....E....^O.}.../..}. ..^_h% ...\.._... ......
7....V;i...*..TJg.cf[.x..R.a.T8.Px.w^....,....4./ ..qR.}.....K..[.....
.<..'.........=Mx_.O.v..#..........}.N.;..U.d...J......2W..l2d.....
(.E...{......Z....~...=Y.(d...n..n.K..~..........D(.h.v.......CY...JB.
.1.z......5D.p....R4..q.U.F.n...... ...G...}...r...x.....zK.K0.\[...i'
.t....P...n.S...Nd....... ..&Q_.x...^..G...H....8.:..FkPn..).&....2w..
....}......*..P.......)%...|(%IK.D.!JW.;.......b....Wx_...v.......Wy_*
.P!..(.!.~d'...>,........Q..v.c.... .....a...,...l..\.?m.w!.../ ...
B(....P..&.4-(.9..~..F'.@........ [email protected]..@I
R...Lb..FJ'.i.`.0R...*.....Bl....1(h....m...B.8.mbe.n1.Ut.....S..9....
z.v.-*ORQ.....AK.$...M...]&..\......G..X.. .c........\..J:.Hr"...4
<<< skipped >>>

GET /lpisearchd?callback=jQuery15208817795147039577_1403774679880&from=&to=Hot&month=All&cachefrom=&cacheto=&type=ow&source=fhome&_=1403774683911 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: application/x-javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
Content-Encoding: gzip
1a4...............J.P...w9W.....g[O.uD..d ..."^X..H.J ..EV....P.e<s
{.f)...y.o..?..........cI"..".(..".;D.QJ...%......H1....TFM.9. f~..U..
....P"n....GIc...{e...?..)UC...dR.O.#.>p..(a........L#8....`.%....Y
.!..j.....7C0`..3..........W7}....'....".3?....n..._.......\5...G.`...
bO....pk!.p...4.Cgu.'p-...I."R...8..c.$b...$q.-6.9..Z..XH.Ga....N.....
.u......4\........ RH..fr.6ym....=K,.K.r.. [........ii......!5..j._.*.
o|...........0..HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 09:24:39 GMT..
Content-Type: application/x-javascript; charset=utf8..Transfer-Encodin
g: chunked..Connection: keep-alive..Server: QWS/1.0..Content-Encoding:
 gzip..1a4...............J.P...w9W.....g[O.uD..d ..."^X..H.J ..EV....P
.e<s{.f)...y.o..?..........cI"..".(..".;D.QJ...%......H1....TFM.9. 
f~..U......P"n....GIc...{e...?..)UC...dR.O.#.>p..(a........L#8....`
.%....Y.!..j.....7C0`..3..........W7}....'....".3?....n..._.......\5..
.G.`...bO....pk!.p...4.Cgu.'p-...I."R...8..c.$b...$q.-6.9..Z..XH.Ga...
.N......u......4\........ RH..fr.6ym....=K,.K.r.. [........ii......!5.
.j._.*.o|...........0......


GET /crossdomain.xml HTTP/1.1


Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:42 GMT
Content-Type: text/xml; charset=utf8
Connection: keep-alive
Content-Length: 476
Last-Modified: Fri, 09 May 2014 06:37:41 GMT
Accept-Ranges: bytes
Server: QWS/1.0
<?xml version="1.0"?>.<!DOCTYPE cross-domain-policy.  SYSTEM 
"hXXp://VVV.macromedia.com/xml/dtds/cross-domain-policy.dtd">.<c
ross-domain-policy>.  <allow-access-from domain="*.qunar.com" se
cure="false" />.  <allow-access-from domain="*.shandongair.com.c
n" secure="false" />.  <allow-access-from domain="*.baidu.com" s
ecure="false" />.  <allow-access-from domain="*.sogou.com" secur
e="false" />.  <allow-access-from domain="*.soso.com" secure="fa
lse" />.</cross-domain-policy>.HTTP/1.1 200 OK..Date: Thu, 26
 Jun 2014 09:24:42 GMT..Content-Type: text/xml; charset=utf8..Connecti
on: keep-alive..Content-Length: 476..Last-Modified: Fri, 09 May 2014 0
6:37:41 GMT..Accept-Ranges: bytes..Server: QWS/1.0..<?xml version="
1.0"?>.<!DOCTYPE cross-domain-policy.  SYSTEM "hXXp://VVV.macrom
edia.com/xml/dtds/cross-domain-policy.dtd">.<cross-domain-policy
>.  <allow-access-from domain="*.qunar.com" secure="false" />
.  <allow-access-from domain="*.shandongair.com.cn" secure="false" 
/>.  <allow-access-from domain="*.baidu.com" secure="false" />
;.  <allow-access-from domain="*.sogou.com" secure="false" />.  
<allow-access-from domain="*.soso.com" secure="false" />.</cr
oss-domain-policy>...



GET /lw/images/login/login140616/tab.jpg?v=1 HTTP/1.1
Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:30:51 GMT
Cache-Control: max-age=2678400
Content-Length: 8443
Content-Type: image/jpeg
Last-Modified: Mon, 16 Jun 2014 13:00:09 GMT
Accept-Ranges: bytes
ETag: "74e22ce76289cf1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 fjpt182:10 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......<.....)hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xm
pMM:InstanceID="xmp.iid:74FE44FBF52B11E3839AF3514C80E50F" xmpMM:Docume
ntID="xmp.did:74FE44FCF52B11E3839AF3514C80E50F"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:74FE44F9F52B11E3839AF3514C80E50F" stRef:
documentID="xmp.did:74FE44FAF52B11E3839AF3514C80E50F"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
......................................................................
.......................................!1.AQ"..aq.2....3...Br..#s4....
.c.$.....................!1..A".Qa...2..qB..R#............?.....h....i
.}..(..,1..P..........................................................
...m..wx-....Z........v.U.#[[Y..us.S......sDOLV..U...Y.....Z...Y/..._.
.Vgz<x...m...........Q..Xc-J.......................................
............................U.RYa.C...6Y..&....n.s..6.... ..yk...,
<<< skipped >>>


GET /9.gif?abc=1&rnd=312679588 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
Cookie: atpsida=69687743fd8102e8c2d45a6b_1403774663; cna=x9QyDBpdXF0CAcGK9OfjJSLK


HTTP/1.1 302 Found
Server: Tengine
Date: Thu, 26 Jun 2014 09:24:31 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: sca=a7e6c521; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=69687743fd8102e8c2d45a6b_1403774671; expires=Sun, 23-Jun-24 09:24:31 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=x9QyDBpdXF0CAcGK9OfjJSLK
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Thu, 26 Jun 2014 09:24:31 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: sca=a7e6c521; 
path=/; domain=.cnzz.mmstat.com..Set-Cookie: atpsida=69687743fd8102e8c
2d45a6b_1403774671; expires=Sun, 23-Jun-24 09:24:31 GMT; path=/; domai
n=.cnzz.mmstat.com..Location: hXXp://pcookie.cnzz.com/app.gif?&cna=x9Q
yDBpdXF0CAcGK9OfjJSLK..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-C
ontrol: no-cache..Pragma: no-cache..GIF89a.............!.......,......
.....L..;..



GET /pic/spacegif.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
Last-Modified: Tue, 06 Sep 2011 15:04:12 GMT
Accept-Ranges: bytes
ETag: "0fe5c3ca66ccc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:11 GMT
Content-Length: 60
GIF89a.............!.......,............................S..;...
.


GET /showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A60AAB6420FBCFD38A7F6627464F0F92ABDBDDFF92A5BAD7034&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Wed, 31 Jul 2013 15:22:38 GMT
Accept-Ranges: bytes
ETag: "0b345ca18ece1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:13 GMT
Content-Length: 2942
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...L_~....I..
.....wr...7O....o.x...w.7u.l....Yy........m.zt........../..yu..`..e.u.
......GG.q.._......,.g......4...~..6#\..v.....g..T.6_..o.W.G.T....6...
....t..M.~.n...>J..L[.e~.........&..:m..2...EV_..G;.w..D3..U{....eV
...U1k..g.E...M...9}........(.I.../....v...</..m..|N..........V[]T.
....lW?YTM.*......}..-.y.f..g..*}.....1A.C.o..F.....E/...e%s.._....q..
)....*.....g~&....;....u.L...G...=J...../9.%. hG......'.........0&.We.
<?o...W...R....3..M.J.`.W........p._T.9............^..Yu5./..CK^.._
..E`i...j.-....F........e..2[.....f/.:[4...ZV..o...q..4m..{g........~.
D~.........0-............'.p7^?....|.......wR....<........>...U3
..e.L.Un..~.. ...,.Wu...r..............GP.....W.X.K.n...........~.1>
;......|...x.M..\.9..c.!u~..G.......j]..............?)..........}...E.
.......~.6..j..n........Z.]....*........Q:..Y^..Cz)...=.x...%.......J[
.w..~:......n*....fok.]..Y[..l....n..c&...[.}........Y..{.4L[.sR'.Y.. 
......BX.........V.`y.............9..VJ.N....1 z]e5..{..?..Y~.........
W....vF{.....z....3b.k4..T...o/........=..._3....J..U..;$'........>
%.a.HTTP/1.1 200 OK..Content-Type: text/html..Content-Encoding: gzip..
Last-Modified: Wed, 31 Jul 2013 15:22:38 GMT..Accept-Ranges: bytes..ET
ag: "0b345ca18ece1:0"..Vary: Accept-Encoding..Server: Microsoft-IIS/7.
5..X-Powered-By: ASP.NET..Date: Thu, 26 Jun 2014 09:24:13 GMT..Content
-Length: 2942...............`.I.%&/m.{.J.J..t...`[email protected]#
<<< skipped >>>

GET /pic/logo.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Wed, 31 Jul 2013 14:28:10 GMT
Accept-Ranges: bytes
ETag: "079642efa8dce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:19 GMT
Content-Length: 3639
.PNG........IHDR..............:......pHYs...#...#.x.?v...MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>


GET /pic/close.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Mon, 31 Aug 2009 17:03:48 GMT
Accept-Ranges: bytes
ETag: "0b28f15d2aca1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:13 GMT
Content-Length: 286
.PNG........IHDR.............\.......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<....IDATx..S... ...?...>;.Y{........D.`.......-.
_w{..A8......O..>f.<`*V..1..N..........R.....`;."HJd...6..\...d.
I.... ..x...\q...D.....l..;.bw.Q=...)..h... .NR.......$.X........%..*.
.0.J......IEND.B`.....


GET /pic/logo.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Wed, 31 Jul 2013 14:28:10 GMT
Accept-Ranges: bytes
ETag: "079642efa8dce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:14 GMT
Content-Length: 3639
.PNG........IHDR..............:......pHYs...#...#.x.?v...MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>


GET /stat.htm?id=4693566&r=&lg=en-us&ntime=1403774661&cnzz_eid=2026431406-1403774660-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1873693337 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hzs9.cnzz.com
Connection: Keep-Alive
Cookie: cna=x9QyDBpdXF0CAcGK9OfjJSLK


HTTP/1.1 200 OK
Server: Tengine/1.4.1
Date: Thu, 26 Jun 2014 09:24:31 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 28 May 2013 02:57:17 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..



GET /twell/cookie/allocateCookie.jsp HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:33 GMT
Content-Type: text/html;charset=utf-8
Connection: keep-alive
P3P: CP="NON DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa IND UNI COM NAV INT DEM CNT PRE LOC"
Set-Cookie: QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; Domain=.qunar.com; Expires=Tue, 14-Jul-2082 12:38:40 GMT; Path=/
Set-Cookie: _q=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: _v=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: _t=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: QN21=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: QN15=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: QN16=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Content-Length: 4
Server: QWS/1.0
....HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 09:24:33 GMT..Content-Type
: text/html;charset=utf-8..Connection: keep-alive..P3P: CP="NON DSP CO
R CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa
 IND UNI COM NAV INT DEM CNT PRE LOC"..Set-Cookie: QunarGlobal=192.168
.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; Domain=.qunar.com; E
xpires=Tue, 14-Jul-2082 12:38:40 GMT; Path=/..Set-Cookie: _q=""; Domai
n=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cooki
e: _v=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Pa
th=/..Set-Cookie: _t=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 0
0:00:10 GMT; Path=/..Set-Cookie: QN21=""; Domain=.qunar.com; Expires=T
hu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: QN15=""; Domain=.qun
ar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: QN1
6=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
..Content-Length: 4..Server: QWS/1.0..........
<<< skipped >>>

GET /vataframe/b.html?_=20120830&rnd=flight_float_layer HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=ad_home_leftAD_middle HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:40 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=topicLinkL HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:40 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Jun 2014 09:46:24 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /suggest/livesearch2.jsp?lang=zh&q=北京&sa=true&callback=top.XQS_1403774683926 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743; QN1=wKgZEVOr5tZJRS5XMP7WAg==; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:41 GMT
Content-Type: application/x-javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
84..top.XQS_1403774683926({"userInput":"......","c":0,"result":[{"type
":3,"country":"......","key":"......","display":"......(BJ)"}]}.);..0.
.HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 09:24:41 GMT..Content-Type: a
pplication/x-javascript; charset=UTF-8..Transfer-Encoding: chunked..Co
nnection: keep-alive..Server: QWS/1.0..84..top.XQS_1403774683926({"use
rInput":"......","c":0,"result":[{"type":3,"country":"......","key":".
.....","display":"......(BJ)"}]}.);..0..



GET /app.gif?&cna=x9QyDBpdXF0CAcGK9OfjJSLK HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pcookie.cnzz.com
Connection: Keep-Alive
Cookie: cna=x9QyDBpdXF0CAcGK9OfjJSLK


HTTP/1.1 200 OK
Server: Tengine
Date: Thu, 26 Jun 2014 09:24:31 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=x9QyDBpdXF0CAcGK9OfjJSLK; expires=Sun, 23-Jun-24 09:24:31 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;....



GET /68503.html?sid=10352 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gm2468.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:22 GMT
Content-Type: text/html; charset=utf8
Last-Modified: Thu, 19 Jun 2014 02:15:10 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 26 Jun 2015 09:24:22 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
547............}VOo.E..#..&......kB...q%.HDjKU..d....xw....8v.Z..hU...
.p..J.8...*5./.8.....Y.q.i...7......?~.........>...".&......n#\..O.
.m...5..G{7.....=N.2.q....wnb.#!..m.F#k.n.<..n.c..!.g..X.....6z....
r.&YIV8jlmmU.3mF.e&b......._.|}....G'.=...?./_N.?}s.....'...~....o..}.
.........8..78m.... e.B......x...<.,.....a.W;....[.u..Q^2A.bP...V..
8..8K......(P...E.........,?O....J......y..<[email protected]..}...y>...{...
....x....#N.<..........F,.#Q..._.I.fM..c...O.HF...L....r.)......t#.
Z...B.d.r.A..DP...4e.......y........e.....1...R..,..8............ ....
..IB.W]..u...,..;....1(xq.K..i.....D.....h..{V.....g.8c.v.i...}.u.yI.p
'.7.z@..%...oP.YR...qQ.c\...d.`.G.Q`... .>9s........N.D......U.M%4.
..{.Z....8...U.t.^G....../.t"....... ..cx.s. .%.Y{[email protected]}N.iu.....H
..y.Y.....[....../{...6.P*..r?"A..SHo .}*[email protected]@.g$c#t..;.B.....6...w
...[....V..e.R.G..c*[....W> .X..$.0I............V...........E..D}.h
f.i..H%...t...n.l.L.[O...d......#w2.4.Kq...'...$......U].kwm..k7{.. ..
..q8..K..NXR..H..ZW..d..ya-....s..<8'Z..9...\...{%..<-t.v..*....
V.,.......Ft.LFv.~...]h..'.........VN.UD.U_......j..l.....l.cj]..J.L.j
.....x......;.......[jx.3Y..f..*DX......T.KC.......5Y.RU..b.j.Q(......
.J...`.p.s.@.`.h.y......`[email protected].`...|....eW..!p.a>!...a.....C3'A\.
.=hfP; ..Jh..i......6R.h....4..#k.7.E.pad..,..s..XX...GccSQ-.r.......S
>..z...5.;A&..C..9l9....[>.\.t.^?........./..=.....M.^.......0..
<<< skipped >>>


GET /stat.php?id=1360447&web_id=1360447 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s94.cnzz.com
Connection: Keep-Alive
Cookie: cna=x9QyDBpdXF0CAcGK9OfjJSLK


HTTP/1.1 200 OK
Server: Tengine
Date: Thu, 26 Jun 2014 09:24:38 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 26 Jun 2014 09:24:38 GMT
Expires: Thu, 26 Jun 2014 10:54:38 GMT
2469..(function(){function l(){this.c="1360447";this.O="z";this.K="";t
his.H="";this.J="";this.o="1403774678";this.M="hzs7.cnzz.com";this.I="
";this.q="CNZZDATA" this.c;this.p="_CNZZDbridge_" this.c;this.C="_cnzz
_CV" this.c;this.s="0";this.v={};this.a={};this.ia()}function g(a,c){t
ry{var b=[];b.push("siteid=1360447");.b.push("name=" f(a.name));b.push
("msg=" f(a.message));b.push("r=" f(h.referrer));b.push("page=" f(d.lo
cation.href));b.push("agent=" f(d.navigator.userAgent));b.push("ex=" f
(c));b.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).s
rc="hXXp://jserr.cnzz.com/log.php?" b.join("&")}catch(e){}}var h=docum
ent,d=window,f=encodeURIComponent,k=decodeURIComponent,p=unescape,q=es
cape;l.prototype={ia:function(){try{this.R(),this.G(),this.fa(),this.D
(),this.l(),this.da(),this.ca(),this.ga(),this.i(),.this.ba(),this.ea(
),this.ha(),this.$(),this.Y(),this.aa(),this.na(),d[this.p]=d[this.p]|
|{},this.Z("_cnzz_CV")}catch(a){g(a,"i failed")}},la:function(){try{va
r a=this;d._czc={push:function(){return a.w.apply(a,arguments)}}}catch
(c){g(c,"oP failed")}},Y:function(){try{var a=d._czc;if("[object Array
]"==={}.toString.call(a))for(var c=0;c<a.length;c  ){var b=a[c];swi
tch(b[0]){case "_setAccount":d._cz_account="[object String]"==={}.toSt
ring.call(b[1])?b[1]:String(b[1]);break;case "_setAutoPageview":"boole
an"===.typeof b[1]&&(d._cz_autoPageview=b[1])}}}catch(e){g(e,"cS faile
d")}},na:function(){try{if("undefined"===typeof d._cz_account||d._cz_a
ccount===this.c){d._cz_account=this.c;if("[object Array]"==={}.toS
<<< skipped >>>


GET /AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F4733086193DA6C7674EE3CE64247F7ACDE395F580416FB00BA92BF05A&Url=&referer=http://VVV.cfmogu.com/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=1805; expires=Thu, 26-Jun-2014 12:24:13 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:13 GMT
Content-Length: 372
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~..q3..U.........]{....L>...
7N~..|...E.L/..'.y}..........".Z.?w~.o..x..:..f]..giYM3.7n............
U.*.8}....{..........~...'.G.m}...O>.......;w..nq.e.~...e....hG.2_^
...q.k..S...^..}d`...._......a..'..o.........H?j ..# U..[..w..z..^..Yu
5.#[email protected]/1.1 200 OK..Cache-Control: no-cache..
Pragma: no-cache..Content-Type: text/html; charset=utf-8..Content-Enco
ding: gzip..Expires: -1..Vary: Accept-Encoding..Server: Microsoft-IIS/
7.5..X-AspNet-Version: 2.0.50727..Set-Cookie: UnionADShowTG=1805; expi
res=Thu, 26-Jun-2014 12:24:13 GMT; path=/..X-Powered-By: ASP.NET..Date
: Thu, 26 Jun 2014 09:24:13 GMT..Content-Length: 372...............`.I
.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...
?\fd.l..J...!....?~|.?"~..q3..U.........]{....L>...7N~..|...E.L/..'
.y}..........".Z.?w~.o..x..:..f]..giYM3.7n............U.*.8}....{.....
.....~...'.G.m}...O>.......;w..nq.e.~...e....hG.2_^...q.k..S...^..}
d`...._......a..'..o.........H?j ..# U..[..w..z..^..Yu5.#[email protected]
.....z..q.......


GET /AP5Min.aspx?AID=9842&TID=667&Auth=1D705CD055EE5F1DA0B198994432BDDA07BB81A80E94952E8948A87D08F39E23&referer=http://VVV.cfmogu.com/&utz=1403774671270 HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShowTG=1805


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:22 GMT
Content-Length: 164
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://fligh
t.qunar.com/?ex_track=auto_52283dc6">here</a>.</h2>..&l
t;/body></html>..HTTP/1.1 302 Found..Cache-Control: no-cache.
.Pragma: no-cache..Content-Type: text/html; charset=utf-8..Expires: -1
..Location: hXXp://flight.qunar.com/?ex_track=auto_52283dc6..Server: M
icrosoft-IIS/7.5..X-AspNet-Version: 2.0.50727..X-Powered-By: ASP.NET..
Date: Thu, 26 Jun 2014 09:24:22 GMT..Content-Length: 164..<html>
<head><title>Object moved</title></head><bo
dy>..<h2>Object moved to <a href="hXXp://flight.qunar.com/
?ex_track=auto_52283dc6">here</a>.</h2>..</body>&
lt;/html>......


GET /AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1DA0B198994432BDDA01EC416CFBC47FB8F19D49E35E521FAA&referer=http://VVV.cfmogu.com/&utz=1403774663192 HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShowTG=1805


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://img.34wan.com/ad.html?cid=1012706&sid=14516
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShowTG=1805|2036; expires=Thu, 26-Jun-2014 12:24:44 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:43 GMT
Content-Length: 171
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://img.3
4wan.com/ad.html?cid=1012706&sid=14516">here</a>.</h2&
gt;..</body></html>..HTTP/1.1 302 Found..Cache-Control: no
-cache..Pragma: no-cache..Content-Type: text/html; charset=utf-8..Expi
res: -1..Location: hXXp://img.34wan.com/ad.html?cid=1012706&sid=14516.
.Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.50727..Set-Cookie: U
nionADShowTG=1805|2036; expires=Thu, 26-Jun-2014 12:24:44 GMT; path=/.
.X-Powered-By: ASP.NET..Date: Thu, 26 Jun 2014 09:24:43 GMT..Content-L
ength: 171..<html><head><title>Object moved</titl
e></head><body>..<h2>Object moved to <a href="
hXXp://img.34wan.com/ad.html?cid=1012706&sid=14516">here</a&
gt;.</h2>..</body></html>....



GET /qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p= HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.gm2468.com/68503.html?sid=10352
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gm3579.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:29 GMT
Content-Type: text/html; charset=utf8
Content-Length: 3275
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 09:51:53 GMT
Expires: Thu, 03 Jul 2014 07:07:18 GMT
Cache-Control: max-age=604800
Content-Encoding: gzip
Age: 8232
Via: http/1.1 4399_cluster (CDN CACHE V1.0)
...........Y.n......~..........,.".....I..j."H....<.xw.?.hE.\8...p.
&H.4H.$A..N.......$..|. tfw.x.(...T..........of..-_........].\...3..D.
)./.uEY^[&.zz..g.*..........Y....D.N..eE..zr.(;^[Y..l!/.'..\..)..!...Y
` [email protected].*..;.v.[..T":..J....\.B....4..A 7'....
f`...........sx......?......{w..~...^.5......:..;.s.?_.......6~..(.`i.
...L.s...3M.......M..w.*[email protected]_o{Nh....|..s.......
[email protected]/...z.....n..i...Z..5.r.3.-..ha.T..p..=ji..I.J ..V^.>.o
.Hk......F....UVq.r...l..".R....\*.....-.....,1..N......?..mM"...M3J.t
<.ze.." .i...b...(...6-.kZ...gjV.<M.M....%>...O=....B4..$a..p
.5.,.ps.5G...AU..z..|..|.3...........-Ss4.M-Yw..u..Lp4e......:ZS..../%
.....q.R..b.. ......EMU%p.b~nF..$.mk]j....i..*.....k^...6,...M.......8
...<..2...U.^.r.R....2.4a...j....^.I&=...2R..&...x...-G..ul....wd?l
...V3rW..N..g*f...sU;.......MB.......B..L%.F.p"\e..X...Ke...n...hV....
...1!..N..4[.O..4.......q)3..y.......Z..;a....&.,g...RWk.4....G.J.mP.z
a.....d..^._...`.....O..U.i.....2..k.........1A....`d.'.....lu.8.xy`x"
..'..0F..x.`x"..O&Qq.D.....D...L....J.%...$*=.D3c$../..O$...I4;F......
D.....Y.f...#.........S.d86.M.[......DL.*..*.u$.2,~#0P.]8H.!.a.....\.q
....V.. ,.j.......E.nB@HH...`1..........n...$.;.mj>MeS.hC&..N...9]j
[email protected].<`F..{u>.....y`...|"[email protected] 
. .^.0.f~V.S..i..F.Yf.....Z.p.....B...ai..oR&.P.h'J. .m....q.s...B.k..
...k..:.OVQ............E%......Y...2(.....ql'FA..4.S=.....[.i......K. 
.............\...u.8.......6..Z....d......b.^U........h]....... ..
<<< skipped >>>

GET /qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&p= HTTP/1.1


Accept: */*
Referer: hXXp://VVV.gm2468.com/68503.html?sid=10352
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: VVV.gm3579.com


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:31 GMT
Content-Type: text/html; charset=utf8
Content-Length: 3275
Connection: keep-alive
Last-Modified: Wed, 18 Jun 2014 09:51:53 GMT
Expires: Thu, 03 Jul 2014 07:15:32 GMT
Cache-Control: max-age=604800
Content-Encoding: gzip
Age: 7739
Via: http/1.1 4399_cluster (CDN CACHE V1.0)
...........Y.n......~..........,.".....I..j."H....<.xw.?.hE.\8...p.
&H.4H.$A..N.......$..|. tfw.x.(...T..........of..-_........].\...3..D.
)./.uEY^[&.zz..g.*..........Y....D.N..eE..zr.(;^[Y..l!/.'..\..)..!...Y
` [email protected].*..;.v.[..T":..J....\.B....4..A 7'....
f`...........sx......?......{w..~...^.5......:..;.s.?_.......6~..(.`i.
...L.s...3M.......M..w.*[email protected]_o{Nh....|..s.......
[email protected]/...z.....n..i...Z..5.r.3.-..ha.T..p..=ji..I.J ..V^.>.o
.Hk......F....UVq.r...l..".R....\*.....-.....,1..N......?..mM"...M3J.t
<.ze.." .i...b...(...6-.kZ...gjV.<M.M....%>...O=....B4..$a..p
.5.,.ps.5G...AU..z..|..|.3...........-Ss4.M-Yw..u..Lp4e......:ZS..../%
.....q.R..b.. ......EMU%p.b~nF..$.mk]j....i..*.....k^...6,...M.......8
...<..2...U.^.r.R....2.4a...j....^.I&=...2R..&...x...-G..ul....wd?l
...V3rW..N..g*f...sU;.......MB.......B..L%.F.p"\e..X...Ke...n...hV....
...1!..N..4[.O..4.......q)3..y.......Z..;a....&.,g...RWk.4....G.J.mP.z
a.....d..^._...`.....O..U.i.....2..k.........1A....`d.'.....lu.8.xy`x"
..'..0F..x.`x"..O&Qq.D.....D...L....J.%...$*=.D3c$../..O$...I4;F......
D.....Y.f...#.........S.d86.M.[......DL.*..*.u$.2,~#0P.]8H.!.a.....\.q
....V.. ,.j.......E.nB@HH...`1..........n...$.;.mj>MeS.hC&..N...9]j
[email protected].<`F..{u>.....y`...|"[email protected] 
. .^.0.f~V.S..i..F.Yf.....Z.p.....B...ai..oR&.P.h'J. .m....q.s...B.k..
...k..:.OVQ............E%......Y...2(.....ql'FA..4.S=.....[.i......K. 
.............\...u.8.......6..Z....d......b.^U........h]....... ..
<<< skipped >>>


GET /lw/images/login/login140618/top_02.jpg?v=1 HTTP/1.1
Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:08:57 GMT
Cache-Control: max-age=2678400
Content-Length: 43411
Content-Type: image/jpeg
Last-Modified: Wed, 18 Jun 2014 12:55:10 GMT
Accept-Ranges: bytes
ETag: "b686d489f48acf1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 fuz111:6 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......<.....)hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:BC8D8665F6D211E3A676E0
0ED1AEFBFF" xmpMM:InstanceID="xmp.iid:BC8D8664F6D211E3A676E00ED1AEFBFF
" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:7D2C39AAF52A11E38900F8565E410FA0" stRef:
documentID="xmp.did:7D2C39ABF52A11E38900F8565E410FA0"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
......................................................................
.........................................!.1..AQa".q.2...B#....Rr3.b.$
....4%..CSc.t57..s....Dd&...T.EUeuv'......................!1.A.Qq"a.2B
.....#3..R...brC$..4............?...u.%.EC...%.G....)....6\.......d..4
.....F\.:sD....._Z.......:_.|...Ln.8./#q.# .U.[.vXi]?.....y......3e.y.
.~...7._...I....9-.H.v.a.......T.-~..#.j....9......1........'..v..2.w.
9~.V=-............./.. ......<~./.....'...l...:..'".OqU....z...
<<< skipped >>>

GET /lw/images/login/login140618/top_03.jpg?v=1 HTTP/1.1


Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:08:57 GMT
Cache-Control: max-age=2678400
Content-Length: 54260
Content-Type: image/jpeg
Last-Modified: Wed, 18 Jun 2014 12:55:10 GMT
Accept-Ranges: bytes
ETag: "56acfa89f48acf1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 fuz112:1 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......<.....)hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:C90CDE4AF6D811E3A2D0B2
04D75EC481" xmpMM:InstanceID="xmp.iid:C90CDE49F6D811E3A2D0B204D75EC481
" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:FF86CEBEF54F11E3B077914FA0327B15" stRef:
documentID="xmp.did:FF86CEBFF54F11E3B077914FA0327B15"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
......................................................................
..........................................!..1.AQ.a"..q...2B..R#..br.S
...3Cs.T......$4.5...c..tu&6Dd.%EU.....V'......................!..1AQ.
.a.."2.q...BR....#3..br.S....4..C..$............?....L..;..4.....:.~..
I9J........t...k.<.Q....54...|.t,.A.).|.Q...i.M&45e'A....aC.. .I."3
..4..........F.UM....w....$POyc...m....h...$..</5..n.z...M...Y..hXn
.....$...P.T.........|..8.h.\.>.uj....MV.3...~=.n..F...<w!..
<<< skipped >>>

GET /lw/images/login/login140616/body.jpg?v=1 HTTP/1.1


Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:08:57 GMT
Cache-Control: max-age=2678400
Content-Length: 156161
Content-Type: image/jpeg
Last-Modified: Mon, 16 Jun 2014 13:00:07 GMT
Accept-Ranges: bytes
ETag: "80a5aae56289cf1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 fuz113:3 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......<.....)hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xm
pMM:InstanceID="xmp.iid:C3417E13F52911E3AD7193FD06F79D5D" xmpMM:Docume
ntID="xmp.did:C3417E14F52911E3AD7193FD06F79D5D"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:C3417E11F52911E3AD7193FD06F79D5D" stRef:
documentID="xmp.did:C3417E12F52911E3AD7193FD06F79D5D"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.....................X................................................
..........................................!.1A.Qa"..q.2.....BRr.#.4...
.3s$.6V...b..U...C.%....STt..E.&Fc.d'..D.57..(.....................1.!
.2Aq.Q.".3.a....r...BR#.b..Ccs.S.$4.............?...*R..].e..Gp......E
.....*[email protected].%F.".....m..%a.r..F%....!...dn...e....m..z.)n..'r.."..7#
- ......v.Q.%...... ....q[.........7Y....F.h."...V../..%.u ."..*.O2N4.
.lY.V-6.r`[..ey.Q....q...cu.....v..F.Dgz.&.Z..B?...Q...r.U9.K..j.i
<<< skipped >>>


GET /xm/2013.11.261.gif HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://p.tuigoo.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 115.236.19.58
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
Last-Modified: Wed, 27 Nov 2013 01:42:51 GMT
Accept-Ranges: bytes
ETag: "98ad3afc11ebce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 26 Jun 2014 09:24:26 GMT
Content-Length: 38379
GIF89a...........jQ..nonN...1v.H5(...............`..................d.
...s.P...&.....k..VkHUD//%%mVEiL5s.nN..................V.......-jto.-.
......wd..y...mroKrt0"..F.\..........wRLH....$......X.....q...........
....Oc4.yi.............c.........wl....h.....e....wT...dw4..j....1...}
.....v,KO..y.YL..R......@ .2C..C....$Xe............G...GO..Yl.........
..N............. ....(0....7B..................R:?............Tj......
..\=.7.......&..<...v.iV]./......mCW..i.....P.................Se`7-
I\a.......{p...r..V.....W.}................Qu......}<g....UN....-..
............... .`{.F.!...[...ay......}...............................
..............9.......................................................
.............................................................C.....\..
!..a`..._}R..Hº!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehi
HzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
dobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <
;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> &
lt;rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1
.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" x
mlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.
did:12278B547F56E311BDF0D3EE77448737" xmpMM:DocumentID="xmp.did:B9A0BE
11568111E396F2887EEF4C264B" xmpMM:InstanceID="xmp.iid:B9A0BE10568111E3
96F2887EEF4C264B" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:15278B547F56E311BD
<<< skipped >>>


GET /index.html HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: VVV.cfmogu.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:08 GMT
Content-Length: 13500
Content-Type: text/html
Content-Location: hXXp://VVV.cfmogu.com/index.html
Last-Modified: Sat, 21 Jun 2014 15:45:01 GMT
Accept-Ranges: bytes
ETag: "505b34c3678dcf1:1ad71"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
<link rel="shortcut icon" href="hXXp://VVV.cfmogu.com/.........ico"
 />..<title>CF........ CF.............. CF............ VVV.cf
mogu.com</title>..<meta name="keywords" content="CF....,CF...
.....,CF..........,CF............,CF..............,CF.............." /
>..<meta name="description" content="CF..............VVV.cfmogu.
com....................CF..................!" />..<script type='
text/javascript' charset='utf-8' src='hXXp://c.myzwqwe12.com/AShow.asp
x?AID=9842'></script>..<script type='text/javascript' char
set='utf-8' src='hXXp://c.myzwqwe12.com/AShow.aspx?AID=9756'></s
cript>..<style type="text/css"> ..<!--..body,td,th {...col
or: #333333;...font-family: ....;...font-size: 12px;..}..a {...font-fa
mily: ....;...font-size: 12px;..}..a:link {...text-decoration: none;..
.color: #275cb0;..}..a:visited {...text-decoration: none;...color: #27
5cb0;..}..a:hover {...text-decoration: none;...color: #FF0000;..}..a:a
ctive {...text-decoration: none;..}..body {...background-color: #FFFFF
F;...margin-top: 10px;..}...lffft {color:#000000;}...STYLE40 {font-siz
e: 14px; font-weight: bold; color: #275cb0; }...STYLE43 {color: #00000
0}...STYLE2 {color: #FF6600}...STYLE5 {color: #333333; }...STYLE56 {fo
nt-size: 14px; font-weight: bold; color: #0000FF; }...STYLE66 {...colo
r: #FFFF00;...font-weight: bold;...font-size: 14px;..}...STYLE67 {colo
r: #FF0000}..-->..</style>..<script type="text/JavaScript"
> ..<!--..function MM_findObj(n, d) { //v4.01..  var p,i,x; 
<<< skipped >>>

GET /0.htm HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: VVV.cfmogu.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:15 GMT
Content-Length: 7
Content-Type: text/html
Content-Location: hXXp://VVV.cfmogu.com/0.htm
Last-Modified: Sat, 21 Jun 2014 15:43:04 GMT
Accept-Ranges: bytes
ETag: "1e5cb7d678dcf1:1adb2"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
0622Sp1HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 09:24:15 GMT..Content-L
ength: 7..Content-Type: text/html..Content-Location: hXXp://VVV.cfmogu
.com/0.htm..Last-Modified: Sat, 21 Jun 2014 15:43:04 GMT..Accept-Range
s: bytes..ETag: "1e5cb7d678dcf1:1adb2"..Server: Microsoft-IIS/6.0..X-P
owered-By: ASP.NET..0622Sp1....


GET /Ä¢¹½Í¼Æ¬.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.cfmogu.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 26 Jun 2014 09:24:22 GMT
Content-Length: 1308
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "hXXp://VVV.w3.or
g/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>.....
.......</TITLE>..<META HTTP-EQUIV="Content-Type" Content="tex
t/html; charset=GB2312">..<STYLE type="text/css">..  BODY { f
ont: 9pt/12pt .... }..  H1 { font: 12pt/15pt .... }..  H2 { font: 9pt/
12pt .... }..  A:link { color: red }..  A:visited { color: maroon }..&
lt;/STYLE>..</HEAD><BODY><TABLE width=500 border=0 c
ellspacing=10><TR><TD>..<h1>............</h1&g
t;....................................................<hr>..<
p>................</p>..<ul>..<li>...............
.........................................</li>..<li>......
......................................................................
......</li>..<li>....<a href="javascript:history.back(1
)">....</a>....................</li>..</ul>..<
h2>HTTP .... 404 - ..................<br>Internet ........ (I
IS)</h2>..<hr>..<p>..............................<
;/p>..<ul>..<li>.... <a href="hXXp://go.microsoft.co
m/fwlink/?linkid=8180">Microsoft ............</a>..........&l
dquo;HTTP”..“404”........</li>..<li>....
“IIS ....”...... IIS ...... (inetmgr) ....................
....“........”..“............”..“.......
...........”........</li>..</ul>..</TD><
<<< skipped >>>


GET /css/base_MIN_11.12.css HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vj1.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 25 Jul 2014 21:23:07 GMT
Date: Wed, 25 Jun 2014 21:23:07 GMT
Server: ngx_openresty
Content-Type: text/css
Content-Length: 14889
Last-Modified: Fri, 20 Jun 2014 06:06:10 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 58
Age: 1
X-Via: 1.1 bjzw89:80 (Cdn Cache Server V2.0), 1.1 yfdx32:1 (Cdn Cache Server V2.0)
Connection: keep-alive
...........}.n#......`..(S...(........{.{..'"I&....dJ.....i.....0.....
..v.b.5.Dd$..n{@..JfD.8q..D..../g....E.t..\./W....r5...w...}.5...P].w.
......c.\......u}.X_......)g......UU....n.......Y<o..C......bQo.&..
|.y..6..`..U..../W.My.......w.w........7../......xs?..w...p8.........v
1i....<T..>.X.>.M.]........mS...<V..b.L?.h.|Yn........aw.-
....UU..<B...:...z..<......~l.....:4..\....v....uu?.<......6.
......Kl.|]~o.....d........`...&! *v../......O.jr.....<.X/.....A...
..~.b..?d.......r........f?..z:...a.....ns....W....z..w_~.. ..K....b.}
.m....j_.M..z...........z.1.4)...cc2.7.|......>.....v..^..v..u}.U..
.S.<Y..f....j._^...Ye..L.......$..cU?...M.w.....|w(.z......c.......
...u.;Y..t..{@....{.6..2...\...g......E..{..o.....4.....}Q........"D..
.....X.A....8... [...ja..R....Of...s.....}..K......_..^.nv.?.O.......^
....@`.)....x.~.{`^\...S}.g..n>MV.....E....rQ.C..3....._.F.?.....m/
..<.....CuY..?...z)..w /.tBB..z.....B........K.z.5_.E...w......K?6.
...u...8...<..`.Y.w. .6Q....S.L........W.q=.M.F1g.. ...>?K......
-..B.^.9.r..l1.4.......).d.S.L.w.@......,....-7>.o....%..(.`.r.PM..
.y.c.....7..Zg.....-.p..B.~.|..i....._.u.pQ5...j....A...d....b[>A.[
.% .>./G...UV.w..#!...ws.%7.b7.<.h.....[..i_euj......V~.P....0..
8UC....:.....^......O..-N....,...][email protected]~...
..#.T;.c...\.Mv1.K.............E5{..Mk...t...........C.O....>x.AI.T
..............],<.,[email protected]<}.../N.>.....b.M%......"...
.....T!.M...;....C.Z...kJTD...X.w...0.!..V,...w.....~r............
<<< skipped >>>


GET /tuigoo/1.html?uid=14516 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:19 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 11608
Last-Modified: Thu, 26 Jun 2014 01:50:37 GMT
Connection: keep-alive
Accept-Ranges: bytes
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"..   
     "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..&l
t;html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<met
a http-equiv="Content-Type" content="text/html; charset=utf-8"/>..&
lt;title></title>..<style type="text/css">..    body {.
.        background-color: #000;..        font-size: 12px;..    }..   
 td img {..        display: block;..    }..    input {..        width:
 150px;..        height: 16px;..    }..    #main {..        width: 100
0px;..        margin: 0 auto;..    }..    #show {..        position: r
elative;..        top: 230px;..        left: 290px;..        width: 48
0px;..        height: 400px;..        padding-left: 20px;..    }..    
#show strong {..        color: #ff6600;..    }..    #submitbtn {..    
    margin-left: 100px;..        width: 160px;..        height: 50px;.
.    }..    .normal {..        padding-left: 15px;..        color: bla
ck;..    }..    .error {..        padding-left: 15px;..        color: 
red;..    }..</style>..<script type="text/javascript">..  
  function getParam(param) {..        var uri = window.location.search
;..        var re = new RegExp(""   param   "=([^&?]*)", "ig");..     
   return ((uri.match(re)) ? (decodeURIComponent(uri.match(re)[0].subs
tr(param.length   1))) : '');..    }..    var ref_s = getParam("uid");
..    var uri = "/tuigoo/1.html";..    var loadedjs = "/tuigoo/1.html.
2.js?uid="   ref_s;..    var clickedjs = "/tuigoo/1.html.3.js?uid=
<<< skipped >>>

GET /swfd/54/58/2629/index.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/tuigoo/1.html?uid=14516
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:26 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 903
Last-Modified: Mon, 31 Mar 2014 08:01:44 GMT
Connection: keep-alive
Expires: Thu, 26 Jun 2014 10:24:26 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes
CWS.B...x.eR.o.T.>v....h7`.k:`.Z..&..B.......7J4.[t..&F...o.VB...x.
.%...x.......{..)D......;.............n...&._.V..~.c.AO......#...U#8.y
2..K"...........&p....B9.L.B.HTKD..J..({...*.."N.....n.'.?..9.|...v...
cu....b..S....h.^.C..........1...eO.....A.Cw7..I .1....GN...~..y.M....
...t8...R*..."t....OP..Q29.D.C.,_.%...kOrk;...V...("..d...8t`.........
.O7..Nd......?<...a..b.....#%.....J...:/.....5....87_r.....r.....@.
.~...CH<...>..=:.....8.p.RL.`n........7g0..&0..gf.NZ...aV".E.../
.....4,[....9Ci...M..*...Z.c];....a.....*D.........?.e....../...M..!.3
..KL..K9.q..Q8........'..<...#..Z.Aj.\M:..^$Y...3}Y.V2aF.HP._...P.D
0e../.ov..m....d.{.....[.......aX.n......{..;..Pv..c.h..*{...qP....P..
YW.....sl.........[gw.....!..>b..O.........Y......&.........O...a.Z
.o..G..Yo&.7..[E...-z.j3..[......H......(QE...z.."..%.zU.g..Mce.3)jU.0
.U'...^.V.Xg.{=.............l...^/.....O.......}.o....!..[.~.._)...].6
.6.......>.HTTP/1.1 200 OK..Server: nginx/1.0.10..Date: Thu, 26 Jun
 2014 09:24:26 GMT..Content-Type: application/x-shockwave-flash..Conte
nt-Length: 903..Last-Modified: Mon, 31 Mar 2014 08:01:44 GMT..Connecti
on: keep-alive..Expires: Thu, 26 Jun 2014 10:24:26 GMT..Cache-Control:
 max-age=3600..Accept-Ranges: bytes..CWS.B...x.eR.o.T.>v....h7`.k:`
.Z..&..B.......7J4.[t..&F...o.VB...x..%...x.......{..)D......;........
.....n...&._.V..~.c.AO......#...U#8.y2..K"...........&p....B9.L.B.HTKD
..J..({...*.."N.....n.'.?..9.|...v...cu....b..S....h.^.C..........1...
eO.....A.Cw7..I .1....GN...~..y.M.......t8...R*..."t....OP..Q29.D.
<<< skipped >>>

GET /swfd/54/58/2629/bg.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/swfd/54/58/2629/index.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:27 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 66221
Last-Modified: Thu, 22 May 2014 07:48:20 GMT
Connection: keep-alive
Expires: Thu, 26 Jun 2014 10:24:27 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes
CWS.'...x...wT.].-.TD.(.H...H....[......zQ.. ".Jo.-..T..k.B. %.{......
.>{.....>.....9.Xk..[e...........f........F.......w.6PRa...A....
...}|<........D......RRRB.O..<[email protected].
.u......C..../Y..........;D...C.((,..................._(V.7.ogV=/wG.o.
?.6n........0.7{VQI....f..-..?E..0PT@XL....(*-"&............C..U......
.....0.....H........8.......* ....?...._.z...../{;!.7..............vt.
.....xx.....%(./...n..g.. .....B........ik..........c...?....<.....
.a^v.....X0....Po.......................sqeae. PA\REY.()!*)%.\E.o..w.?
....`....5...j...O5]/.'.?K..QU....VV.x...U...........^.....,x.xy;.....
[email protected]..?6.?J..kb....~I..c..g.(.....#d....]..
..x.....  ....\c.........$t......HH......9..1> '.{.....O....ig...."
...-.w.O.K........B...HKAIAM...-....HACA.........`ddd.......f.....K...
......7...7..n..\w....7.........[....4J>.3..7.o....'n....n<.*...
..|.......-.'.K{...m.......R.a....'......I.W...q........S.x..b.J..x=. 
..x..&9.)..w.w.wa..8.=^..We..%7...H..s..<.p. >..(j..7._......s.N
q......n.i.f.y..d.&S......d=x.W.{P.`?_\K.6...yJ.....Q.....6..[F....<
;.k...JK.....C#pS....5a.s1..w...xlV..B...q.W.u..l....YI....L.|.(k....F
.@!.^.!.....v.>..g..{UDc.K..P.d0...:).....dd)..&..'.o7%=....;Kpp...
&..P(M.qM...;..(....0u... jd%..|t.8...gb.KZ...M.e."]$..%^Kj.....9x\..M
...Krvi .......^....yF...|..P'.6v BO....=.j.W.......ZT....PTp..m..0Bk.
.t*r.\Q:O....i....._E:....6.JA..q?.W..#n7_...Z#C.>.`..O.G.D.xa.D.5.
..]m.....jQ.Q..q`._....%.|m..@... ZW.SQ....k..RI .........r.K..3..
<<< skipped >>>

GET /swfd/54/58/2629/ren01.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/swfd/54/58/2629/index.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:30 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 23231
Last-Modified: Thu, 22 May 2014 07:48:20 GMT
Connection: keep-alive
Expires: Thu, 26 Jun 2014 10:24:30 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes
CWS.F...x..z.\Tk....F..a..%.N.A........D@B:%..I)E:eh0QZ...DR..........
........3{.Z.g=...z...`....@^[email protected]....."%....7Kk1.Y9........J.....E...
...........OTT......^Bj\r.q.0......(... k.n.f..a...A]..;{zH22...vt....
.mf.ln.m....m........A*...Y.y8.i9;;HI.. r.f...57gk ww$...DFS.r.b.i.`..
.....G.3XV..C...'p.W...O.O@._D._..WD.....w....V.f.f.f.d,(.....5.M.....
....d..&D..........E......xYZ.X9X9Z9y.#...F...........................
M/3..%k...<.(.U..3SV.......S..C...?.v..q....rw.t..B.3.H.ee1.'w.3'. 
.Y).....RL.*" (#.{E.*.U~>>i!....|".."..W...q...O4Yg.O.o?.,./....
DSu...C.........K..^........W 7;........(....[...d.I...o.....M.......'
.._..?..Ds.....B@~.....<.y~.A). ....!...,..$.....`.. .Y.9.;[{@...Y.
A.8;X........,..h...........Kb.c.c.c.c].......-.c..'.$`'$.....P..)q_..
.<.g.<.I.hXu..x.I.........Z..R.F...& .....z..'...j.....N..F..J.7
. .. ...\.....N.~..4.1..}.=X..S>.DE>.....!.......\.%Z..w.(..ycah
.u...........<......M3....9..,s..,#......8..I...-..;..F.Q..........
.}7Rmn.O...ZC.{..%5.<.z.eA.aZ.............U<......:..E..gGO.....
7..xM.|.....E...\SMg../...1}...sTo....XI.!...0..x.N.R...^q..l..E...C.S
..!..O..k.9v.S"..........m.\.n.V{d.Y..b.5...rF..sV...W........4.zG:o&l
t;Te..S.c..fk6..5,.@s...!..B...n....L].=\..{#P....e.....e.....Qs....u.
..x5.L..\....d.9=_.......t%Y.Z.k..v..=...L*.v.....e.*.U..9e.d..I...m&g
t;w..W.)]...B.p...^.C<.4........}D........).LM....o..3B.t...5A6.B..
0d......59..e./~......Gg..R..L.Si...."[email protected].....% d..LV*=i.tR.
#....OM.....g..8.KP\[....{..jWy&_sIq\..........af6:>.5....7.MI.
<<< skipped >>>

GET /swfd/54/58/2629/ren02.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/swfd/54/58/2629/index.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:30 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 571
Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx/1.0.
10</center>..</body>..</html>..<!-- a padding to 
disable MSIE and Chrome friendly error page -->..<!-- a padding 
to disable MSIE and Chrome friendly error page -->..<!-- a paddi
ng to disable MSIE and Chrome friendly error page -->..<!-- a pa
dding to disable MSIE and Chrome friendly error page -->..<!-- a
 padding to disable MSIE and Chrome friendly error page -->..<!-
- a padding to disable MSIE and Chrome friendly error page -->..ont>....


GET /swfd/54/58/2629/ren03.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/swfd/54/58/2629/index.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:31 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 571
Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx/1.0.
10</center>..</body>..</html>..<!-- a padding to 
disable MSIE and Chrome friendly error page -->..<!-- a padding 
to disable MSIE and Chrome friendly error page -->..<!-- a paddi
ng to disable MSIE and Chrome friendly error page -->..<!-- a pa
dding to disable MSIE and Chrome friendly error page -->..<!-- a
 padding to disable MSIE and Chrome friendly error page -->..<!-
- a padding to disable MSIE and Chrome friendly error page -->..ont>....


GET /swfd/54/58/2629/ren04.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/swfd/54/58/2629/index.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:31 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 571
Connection: keep-alive
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx/1.0.
10</center>..</body>..</html>..<!-- a padding to 
disable MSIE and Chrome friendly error page -->..<!-- a padding 
to disable MSIE and Chrome friendly error page -->..<!-- a paddi
ng to disable MSIE and Chrome friendly error page -->..<!-- a pa
dding to disable MSIE and Chrome friendly error page -->..<!-- a
 padding to disable MSIE and Chrome friendly error page -->..<!-
- a padding to disable MSIE and Chrome friendly error page -->..ont>....


GET /swfd/54/58/2629/sound.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.you1ad.com/swfd/54/58/2629/index.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.you1ad.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.0.10
Date: Thu, 26 Jun 2014 09:24:32 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 56701
Last-Modified: Thu, 22 May 2014 07:48:20 GMT
Connection: keep-alive
Expires: Thu, 26 Jun 2014 10:24:32 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes
CWS.....x....T._..=8.]..M..n.5.kp...2.... ....$.{p".&......<.......
.7..C..._....V.[..B......@.. .|<...&.C..D..l.5e.h|..:{..=.....t....
..a..awq............f. .....i....AO...............3.......S..._f}.\..Y
g.vs ..kvK.'._sW..vN....B...........o_I..h...{......X{x.5o..FZ........
.... .(.....lY...{......)...... .-(....)(....t...GU........?..........
9........$./u. {......H..r./....................~k.d......\......qqw2.
|e.......n................jQ........-SQ...p''..K{xjZ....=..\.94.=\..-.
...........w{ok 9w...kq5w.......[...H..w..4w..V.y.W....JXV...K..G...S.
..K..og............../...f.b..w...Y.... $..#. .....&.).'-#.-)'(.....ok
.I...\..m...o..w....4............xd.d......O../....._..........Oj.....
4........_.......2.....Hu.... ...2(..8.... .....x........C@!.!b.z.S>
;....L.N=.B.F}h>..2..=........{g....0.O<.`....7 l".Q..8&.{......
I...T........F.d...]; Ly.;...P..............L5J;.O^y^.r.mD......{4./..
..o..N.*.I.....bQ..9.vZ.........>.fSk...s<X.fcS..h"h._....&...).
[email protected]{....=.....g........."r....K..^..k{.u.u4
.*ltl.S8..<..Xw$....(....B..[.....d.'..'...D}....)..{V.<...8rP..
[email protected]../^[w)..........a..^O.!z.mt..W=.L....
.MYI.....bO.5._.?.........!..]X.c....n./..e.D.vU`7._...;g.M...P.:..d..
..h....%.CK.Dik.g0.p...h..n....#[email protected].(.Y*
......_.\Di.t*r......`<~.^y~"..c. .........!l.E...K.G/zc.d..Y...e.f
.8$#-..qU..N.........ep..2/0.}.p..w~..Wv.zi.A....ea....x....B.;..a...|
..zm..s.q.NIa...H0Xu*..nw.J..z.|......J{9l.......V.5..Hd.....S0.._
<<< skipped >>>


GET /login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: lw.q1.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:17 GMT
Cache-Control: max-age=180
Content-Length: 17039
Content-Type: text/html
Last-Modified: Wed, 25 Jun 2014 14:32:55 GMT
Accept-Ranges: bytes
ETag: W/"36c1885a8290cf1:10c8"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P: CP=CAO PSA OUR IDC DSP COR ADM DEVi TAIi PSD IVAi IVDi CONi HIS IND CNT
Very: Accept-Encoding
X-Via: 1.1 tzwl39:8106 (Cdn Cache Server V2.0), 1.1 fjpt183:3 (Cdn Cache Server V2.0)
Connection: keep-alive
<!DOCTYPE html>..<html>..<head>..<meta http-equiv
="Content-Type" content="text/html; charset=utf-8" />..<title>
;.................._........................_............</title>
;..<meta name="keywords" content="......,..................,.......
.................,.................." />..<meta name="descriptio
n" content="..............................4..................2013.....
......................................................................
......................................................................
..............................................................1......1
0......" />..<link href="hXXp://css.res.szgla.com/lw/css/login/l
ogin_140618.css?v=2" rel="stylesheet" type="text/css">..<script 
src="hXXp://css.res.szgla.com/jquery/jquery-1.4.4.min.js?v=1"></
script>..<script type="text/javascript"> ..document.domain="q
1.com";..</script>..<script type="text/javascript" src="/js/r
equest.js" ></script>..<script type="text/javascript">.
.function ShowDownLoad(exeurl,clickname,linkText,title)..{...var radid
 = GetCookie("radid");...var rsid = GetCookie("rsid");....if(!title) t
itle="...........................";...if(radid && rsid)...{....exeurl=
exeurl.replace(".exe","_z4v" radid "z3v" rsid ".exe");...}...else if(r
adid)...{....exeurl=exeurl.replace(".exe","_z4v" radid "z3v" ".exe");.
..}...document.write("<a onClick=\"addWebClick('" clickname "')\"  
href=\"" exeurl "\" title='" title "'>" linkText "</a>").
<<< skipped >>>

GET /js/request.js HTTP/1.1


Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: lw.q1.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 10 Jun 2014 05:51:38 GMT
Cache-Control: max-age=2678400
Content-Length: 2822
Content-Type: application/x-javascript
Last-Modified: Wed, 26 Mar 2014 08:54:01 GMT
Accept-Ranges: bytes
ETag: "60cb4efd048cf1:10c1"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P: CP=CAO PSA OUR IDC DSP COR ADM DEVi TAIi PSD IVAi IVDi CONi HIS IND CNT
Very: Accept-Encoding
Age: 1
X-Via: 1.1 tzwl38:8107 (Cdn Cache Server V2.0), 1.1 fjpt233:10 (Cdn Cache Server V2.0)
Connection: keep-alive
...var curgameid = 3; //............ID,2.........,3...........function
 Request(name) {..    try {..        var reg = new RegExp("(^|&)"   na
me   "=([^&]*)(&|$)", "i");..        var r = window.location.search.su
bstr(1).match(reg);..        if (r != null) return decodeURIComponent(
r[2]); return "";..    }..    catch (e) { return "" }..}..function Get
Cookie(name) {..    try {..        var arr, reg = new RegExp("(^| )"  
 name   "=([^;]*)(;|$)");..        if (arr = document.cookie.match(reg
))..            return decodeURIComponent(arr[2]);..        else..    
        return "";..    }..    catch (e) { return "" }..}....var wl = 
window.location;..var dr = document.referrer;..var pto = new Date();..
//var fid = dr.match(new RegExp(".*fad=([^&]*)(&|$)", "i"));..//if (!f
id) fid = wl.href.match(new RegExp(".*radid=([^&]*)(&|$)", "i"));..//i
f (fid && fid[1] != "" && fid[1] != "0") {..var fid = Request("radid")
;..if (fid != "") {..    if (fid.toLowerCase() == "client") {..       
 if (GetCookie("radid") == "") {..            pto.setTime((new Date())
.getTime()   24 * 60 * 60 * 1000);..            document.cookie = "rad
id="   fid   ";path=/;domain=q1.com;expires="   pto.toGMTString();..  
      }..    }..    else {..        pto.setTime((new Date()).getTime()
   24 * 60 * 60 * 1000);..        document.cookie = "radid="   fid   "
;path=/;domain=q1.com;expires="   pto.toGMTString();..    }..};..var p
to2 = new Date();..//var fid2 = wl.href.match(new RegExp(".*rsid=([^&]
*)(&|$)", "i"));..var fid2 = Request("rsid");..if (fid2 != "") {..
<<< skipped >>>


GET /site/images/flight/flight_v1/bg_bao.png HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 3430
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 08:26:25 GMT
Last-Modified: Wed, 28 May 2014 04:10:05 GMT
Expires: Fri, 01 Aug 2014 08:26:25 GMT
Age: 3488
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR.......l.....I.>7....tEXtSoftware.Adobe ImageReadyq
.e<...#PLTE...I........>......v..y.............g.....:..*.......
.....w.............w.....................v..........X.....7..`.....(..
E.....J..d..G..\..(...z.............7......}..........l...........}...
...........]....................v.....T.................J.....,.......
....................w...............IDATx...._.8...e.......-.R..f.@Oz.
.........)..I.....&.kYk..qlG.....(s.O..Z....l1[...........{{...{{{....
\?.....y.8.u.........v..........7n.........y.???...w..O..u..s...raaa..
[Ws.2J.....;.-.$.....}..N.....$..s...J.d...).k......0$.c..ts.U..8.(\..
..l>..H...x/..8R...t&..r......N...G..V.So.Su.K.5d...\..l../(d...*..
$f.P.'$......&......m....^7.Y.T.......7.W.....0..L.....Pm.L...#s.0..L.
.....G.....6f.*@...fL...h.rF(Wb...3...f.;...`...qf..Z..k/..KU;..:.:..1
mNI...M.E....m..b... 5f...m.N.%.h...'b._.bi.jKb........,*.`0b.......0.
c.....f$h..4%..70).b..9y8........j.-..uT.~..k....y...#N.v.KC-[.y..h...
z....../?....8.I.....o..7.G..rA..HL..ZF..X0."..u1.|.Lap..~..flc.Q1/)).
Y...t%S..|.f&.H...KJ.f...=.Y.1s....Du...%.af..j"........ .....19..yo.1
E#f. ..$.27.sH.E.r$0Q..._.1... ES.....03%....~..0.0..-Ur.&......S.8..-
L.^hdb&6..Jq^$....<)..&h..g}uC.).&......S.M.o`..!/.......3...f.9...
...T.I..L...\I.d7...{...P.7VY....B.,..4ZT......"....t..F!...E.e..~....
[email protected]....:...".L.7..............P
<.HU..,O.:%.r....C.H..9.y...aJc.6........V^..g.y.....x......I...4.Y
.,a...../..&.)-.."...t,n...W^..1.7..;...j.^..rm...............6.ZE
<<< skipped >>>

GET /site/images/flight/flight_v1/postmk_wf.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 2575
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 07:48:05 GMT
Last-Modified: Fri, 16 Aug 2013 09:25:06 GMT
Expires: Fri, 01 Aug 2014 07:48:05 GMT
Age: 5788
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR...G...F.............tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..\]n.8.u.._.y....t...H.XXAa.... ...t....F"... h.0..YA..tn
{...;....A.......8....).......Z.....Co=.....q...|..........4..z..k.%.c
.......3.......... .1.......3....z[. s.g.G.{....m...c....f5.(.!f...d..
..}=.x.f.m.U...0....fv.......^ ...i.....0.s.p....Q.|...p.....v....g..$
..1f....g....o.~.....LY2g.?1(......i3......`.Bt...M...w...P...c"......
...c.X;..u.h`F`.7...........h.9`...m....0.......m4......T..0.C..`....`
_T3.Y.%...J..7.G..1o....Ys......:Z..............k...F.X...)8;t..0.3g..
;..`.,..j.k.)...1.!.q.....|.Y...O. .1m./...,x).!..UE.k.....8.*....w..'
.L*X.`..B>j..qU...6 .O..U.. ..1............W.....a...s2.6..V.N.....
&...#..!.`.@v..#..D...=......s.AT.n..CO.....i*Gd..".j<.c.7Q...`...5
;..`H..W0..0.dWW.. ..>..-.......cU.......Z..".8ca.K.HH.n...,....g
8....7...c.........._.02...D....a...P.4bQM2j........3xf..*...d.....ks.
..}[email protected]}Gf=.p.T..XYB.J-.)..9(%...*f..RH.D1..8{......>
;..E._..,$..t*.....,...zr..C...F(W.kp2.Xi..B.%F..Z.@^....N1......^PL..
.>.Q*.MJ.."...).>..`..B.iMBF..D.wE)..6 ^k.N.?...cL.;0uZ.;8....z&
v.0.1st...&....;s0.....c.mk...p....6.*.X..<..., vM.c...K...X0...E..
n.9.5}....wk.Ll.:eC._..[;.`RR.s...VtR..P.KY......K...B...T.`..1.. .|.#
.Q.jQ....I,.l.......G./"5.Z:=E.&..'...vs.>..., ......)U....`Mm.....
..Q......xVK...2.[G...s.p..d..4.. ......4.U..u...S.6.&....`[email protected].$.
y../..)..yE42,Z...`<U,-:...PIP..cVL...%.H..$.".te...{]q...#.....m..
Hm.g(.-.F.,..8.r.k.NV.^.dN.~..ntn.".d.T...|R<.u|.......9.7|...q
<<< skipped >>>

GET /site/images/flight/home/bg_bd.jpg HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 62155
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 07:48:03 GMT
Last-Modified: Tue, 11 Mar 2014 13:52:42 GMT
Expires: Fri, 01 Aug 2014 07:48:03 GMT
Age: 5791
X-Cache: HIT from qunar_cdn_01
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
.......................................................&..............
......................................................................
...!..1A.Qa.q..."....2.....BR..br#..s........................!..1A.Qa"
.............?...?............P....!..................h.).A...........
`. ..A......T!....H. [email protected].`............H.}.!.AA.....J!.... .>...h.
..A..P.} [email protected]/..o...D4...............1..8r.......8........k.(J.[.C...
:..K.Q..P...P%...N..CR.D..........8. ..>...Yu.}..Kb}.=.=.......-Z..
.9..........~._...5..\.I.....a.3.`.z..].J.v; m..O[..8..Z/.Cx./..]..k..
[email protected].....................!..
....P.............@.@@[email protected]......"... ...H.....P.....DQ.
..!.B...... [email protected].!.B......!.@...@[email protected].$....b*......b)O
.JX.S.R.E(..S.)K.)F(R..h)F(R.B.b..(....B...P.F....(.B........{.. ..c..
[email protected]..(HT8..-.1...<W..;caA.r......n...R.....P.v....(
.c....~D.......j(1SU...;.......#U....V./u....P..!]l-)...h.T.....'...SW
..(M........M.....M.....V[..og......z.<(i...:=N;.uN-....C.......l.-
.nH.....U.{*...p.u.9..(Im.7.........N.-s.......`.uS..sr%...Lc..B.. .@.
.!....J..J........."..@..!.B....... [email protected].... ....!.B......!.B p.!.G
`Q....8@..!.%].).BR.".b)F".b*Q....S.R.".....)O.)F(R.P...J1R)F(R.P...E(
..Q.R.W....JP.(.JX.UB.)D....oAJM-.iJ;.Q..N;....)F".c.R....U..J1.).E(.R
....)F(R."...*Q..b*........].C]..E. .@&..AD"... [email protected]%Bh.........(
<<< skipped >>>

GET /site/images/flight/flight_search/qn1cs1_disable.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 05:45:51 GMT
Content-Type: image/gif
Content-Length: 97
Last-Modified: Thu, 27 Dec 2012 04:15:02 GMT
Expires: Fri, 01 Aug 2014 05:45:51 GMT
Accept-Ranges: bytes
Age: 13124
X-Cache: HIT from qunar_cdn_01
GIF89a...................!.......,..........2..i....d.&...y...........
...6...13..y.....D...d....;....


GET /site/images/flight/home/ico_la_yy_ie6.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 1066
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 02:47:46 GMT
Last-Modified: Thu, 29 May 2014 08:45:05 GMT
Expires: Fri, 01 Aug 2014 02:47:46 GMT
Age: 23810
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR...d..........M......tEXtSoftware.Adobe ImageReadyq.e&
lt;...YPLTE..-....................xq...k............6.................
..h......*...n............m...<s............z!.....K.t...l.....3...
........Q.........................j.z..............|..........im....H.
.B...p...v..~(.......................`.......q..........v......w...~..
....}..m...g...............T........c..............Z.........q...g..k.
l...f....^|.....stRNS.................................................
.....................................................................~
[email protected])PGZ*X)uwwVVV.......$....O...L...........AS..eR..c
.M.|.......c..bO..:..MBzH....S.G.$$IH!C.L..X.)......JH.!.x...".......G
.E..Q.evd...W. ..B.(.#7...(..o.Z...#E.j...B.R...aJE3`D.......P ..1`.V2
.....P .b.J...... ..F..........&Y.--W.H.6(......`H}UX.....Tc.7....2...
..1}W..#.!(.yd....A1.#...aX.u...!.a).....X.W..k..d.Yk..X.Wb....x.Yk...
e..V.:..;.. v.=k0...._...\... .....#?a.#...Q....#.xG ..0_Fur...eT'..%.
..h%$!.W.>.....$./......O..V.$d...8:..C...7(!,..p..9.....q..5.o.7..
.....-.N...E.....IEND.B`.....


GET /site/images/flight/flight_search/btn_normal.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:48:05 GMT
Content-Type: image/png
Content-Length: 2662
Last-Modified: Wed, 26 Dec 2012 08:35:14 GMT
Expires: Fri, 01 Aug 2014 07:48:05 GMT
Accept-Ranges: bytes
Age: 5791
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR.......X.......<.....tEXtSoftware.Adobe ImageReadyq
.e<...pPLTE........................................................
............................................Q...&{.$/.. {.............
.a...."r.......$t..h.h...~.)y...2m...Z...*.`..b..f.(x..d.y.#.....3.|..
.....y.............. p..n.{.!.w..v.....V......).S..j...)u..|."s....'.j
..t.w."m..}.%,}..X.....p.q...f..z..\..b..~..r....q...^.k...d.i..r. %v.
.U...'o.... .h.../.n..m...5..-w....... ..0.k.~.$u.!o...l.l..._..P..q.f
....6....q.0.......,.O..p..r.k..1.......7..-.^.e.................... .
.E....I...,........|.5......y.1..Y....................a...............
 `.D...........s. v./..@.............~........}..m....!a.0o......./o..
n.#b............tRNS..................................................
......................................................................
......................................................................
....................9.....IDATx....r.g.E...<.II.H.-..ff.'.3s.ff&33.
.......r..}.R...LyU.z....bW...p.......qy .....P...)..K.B?.@....}..._W 
.....L...*..y.B_.@....}....V ....>^........l...B..f..F...BO..ha..k^
XM9...SXM9...SXM9...SXM9...SXM9...SXM9...SXM9...SXM9...SXM9...S..k[...
[email protected] .....R..o)..\.B..@.[..}....U 
.}..>O...*..*[email protected].....<.z....<!.m..F..K.i...K.ym..)...r..)
...r..)...r..)...r..)...r..)...r..)...r..)...r..)...rJ#x..f..m.w...6.h
..6..R....,...)e..5....]!t-.].'..n%.....z..<.z0.....B.!.......DtsS.
..E/...B/'........Y...6.h...%t.W........C/.....6..UGD....L..^.....
<<< skipped >>>

GET /site/images/flight/home/img_qnkhd.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:48:04 GMT
Content-Type: image/png
Content-Length: 8490
Last-Modified: Tue, 11 Mar 2014 13:52:41 GMT
Expires: Fri, 01 Aug 2014 07:48:04 GMT
Accept-Ranges: bytes
Age: 5793
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR...z...z.....G.......tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE***........................................................
......................................................................
SSS............===......888))){{{....q..........MMM..................x
xx...DDD.o.000...___mmmJJJ...............---...............&%%GGGjjjLL
Laaa...ggg...POO............}}}.......{.:::666.l........v.UUUAAACCC222
......(((uuu...\\\.x.......WWW...ddd...QQQ...$$$...###444...rrr...""".
.....ppp..................'''.........FFF......vvvYYY.Pn....PX........
.......!!!............z............s....#...i........-8...7..k...4>
....",.............z..ENb........Y...d.;..S..}........1|.<..u..K...
.........Sf...B75n...BL............e..o..0'%...%..sSP...&fp.OZh][!PU..
....1$ 3(&R@<......V........'S^... =ES........7....................
..IDATx.|[w\[email protected]>.i.`...8g....~......6....s.w/.
.........a|e.p.5..tuu..QM.U!...8-,..F...;P|...,.kT.F[h.*....^s...dr...
C..Wpx..m$.;\R20{../,H.s....&a.:'B....$.....ll.`{......B#....j..c.$.s.
a4.TB...8z.... .B:A.0&A...@..?$...F.{..0.a..B....Y..n..:.Y.......##...
..?lAn_.7#..4.y....oY...........7...-.<5.O..~z_.02.o.!..&"#........
..I.....Q.E...6.(.2.....[.6B....n1a.R.2..^...a..>k.j5Z.u..^.......F
...........}....Gfl..Q4} ..L/!0<.#..."t$...z.999..h...E....C.K.4H..
&...5......$V7.BIu...[.)KM.$.>%c..# o...j..C....^..#E.ho~..C;.A"E.(
R'....1.z..K1.fd.nA....zD.J.^.......... Ni.:.c.Y[..w.......)D..M).CB.B
....V. v.....i.-.p.......>....A....Z..K(.O..*3...T.......N...z.
<<< skipped >>>

GET /site/images/airlines/CA.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 1206
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 07:48:51 GMT
Last-Modified: Wed, 01 Jan 2014 13:56:04 GMT
Expires: Fri, 01 Aug 2014 07:48:51 GMT
Age: 5748
X-Cache: HIT from qunar_cdn_01
GIF89a................................................................
......................................................................
..................................x....................r.....|........
x........d.}t.x..v..xA.tQ.q{[email protected]<.iZ.ff.jD.l7.fO.dL.`s.dZ.cB.b=
.\r.e3.Zm.[[.Zd.\A.Vd.Tl.TU.SZ.X).U0.IW.M .JI.HA.EQ.EX.EB.I!.=:.;B.6#.
[email protected](.2..)@.*:....)".%6.)..$2.%0.&..$-.!...3. .. ...!..(........
...&..................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..............!.......,...............H............)...T....2q......D.
[email protected]`|..dRIBUp.......F$IJ......B..RB....@. .(R$G.l.(.......HR.A.
#I..<.AA...E... .$...$%...A.H~L.|..../.....F.....`Z...$..B0.2..A...
.P......*.Pa.R$Ir0......A....tI..K7...D...IV"......G..."`.po.....0|...
..,......T...`..S...*x.C..P.T*[email protected]'A.'......\.... ....%.D..4..
&5.P...|..`[email protected]....=..B....Q..\p..Z....tX!.J...E.l8a.
.aLa.J.!.....p..S%...;....


GET /site/images/airlines/SC.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:48:51 GMT
Content-Type: image/gif
Content-Length: 1232
Last-Modified: Wed, 01 Jan 2014 14:03:10 GMT
Expires: Fri, 01 Aug 2014 07:48:51 GMT
Accept-Ranges: bytes
Age: 5748
X-Cache: HIT from qunar_cdn_01
GIF89a................................................................
......................................................................
......................................................................
......................................................................
......................................................||.}}.xx.yy.{w.u
u.vv..j.ll.sj.olvllzll.ii.pjwikwkkw{d.ff.ta.ee.dd~l^.xY.ccdb`.[^.^^.c\
.X].WY.ZZ_XX}XXpWV.TU.WVrUUwTTx\Q}QRx^G.bHv_EpKKoII.OH[VAfGDlEF`BDoJCc
DDeSAOAAo@@jO:a>>t==g><`==e>=G::d<>@9;[F4O35`81U3
3Y//`..[--S  b,*Q''S&&Q%%N"#F..[..I..T..J..G..Y..M..F..E.. ..?..6..O..
B..?..>..8..$..*..<..9..G..0..?..B..4..3..2..1..0../.....-..*..)
..(..'..&..%..$..#.."..!..............................................
......................................!.......,...............8...)Q..
 ....&.z]..-..........4i}..\.&c.*..Q.......!\.u##.r.s.. [email protected]... .cY.iH
...3.O,..5,.3..,nI.A &C..a1.zp....'[email protected]`.6....0pA.
`..N..A ...Y..X...$..3.!P....z..2N.....Y.('.@U>.:.vl.......2I . .7]
C...bp..JQ$.......2...brx.*.$........r.,sVmE..!#.........I.Zp.....H...
u0.....2..6<.........h!......@[email protected],......a.(.... ..s....
..9..........h.aF.DfA....CK.....8Pv#..Sv.B..$QJ3....)[email protected].$c..CT
.Q@.;..



GET /js/reg_gg_rpc_nope.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.huowan.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:36 GMT
Content-Type: application/x-javascript; charset=utf8
Last-Modified: Sun, 04 May 2014 07:31:55 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 26 Jun 2014 10:24:36 GMT
Cache-Control: max-age=3600
Content-Encoding: gzip
dc2.............Z[s...~.f..V....4..E7.]IV.wR...<T.9 .$.....-..g....
L..?..<...}h;.1...S.B...`.R.|.t....v...9{.2..'^..G....%c..e........
3....O:..'...{...q.LGS.....'.8.>F.}o...7Ny...K..8.*.../..Y2...F.g.~
[email protected].`...v.j.g.K...I...#@..?..(s....Ne..i...e<.
.........Nm......".-.........V.YC.i..x.t.`.B..S......f|...)....6....)4
Z....3%...G............i.A:{A.By.~..|...P.?.smQ.}..Q.%$..J.4.>...&g
t;...].,.#.....'...V..0.9....B;...\w..|.F<h...6...!.H......,...lZ..
[.$.C..[-.-..!.gQ$0..Hg.I..8.......-.UQ6s&g[.7o......a8........x...O..
fI...^.\.5..~|...Z..%..Z.^=.....j.w..0...j|8`=..{...S.u.DP....G.......
.7.........S.......(.'.....Q.:...=.....U?..............4............F.
...).3.-....L...1...wv/..q....0.......5&..pU...~...W.> ...l...$-..c
...2...J?x6.,...<...L.8O.s.......<.....kJ.dV._.$..'v..k... .....
\.....--y.5....1aEeO..N.E<y...?p.[.8......=....r.u[8......!Ya...q..
. 5.h.}..\...*...}.....Z.b.F..s0N.Ur.9K.us....e\..m..t....cw........Q.
..7ZD..Fa..H.LN.s...G..(...]i..w..J.q7..O4.@...)..]J..........E..\#.;.
[email protected].=..]w....I.;.....O.." ..^{.5j......F...P....|....6.M.x.h
yu.E...eO.U..IC..h....^?..at.....d...y|.]......].y.l.........0.x..2.|"
2.5&D=.?.............h.cF=.m..5|o.v......nt7}<...G.-N-...M.'\...4u.
..<.j..k.n[.$'S3......$NT..3..e;...?'....ao.[}.m#p..r.1}?.s.T......
.T..XHL....If.&.L..Uk...Viu!4.6Z.e.Vc..4.|..}.v.4......<.......VQ2.
$..K....6.f...Qo... .w...%....].&.=....ce.`.0Pk...d..\..f8.....V8..4.1
i..t..f..B. .3*@.,...............^.........Ev,........y......^..sU
<<< skipped >>>


GET /vataplan?framId=topicLinkL&f=s&cur_page_num=0&rep=1&tag=99&vataposition=QNR_ZTc=_CN&vatacon=&rows=1&qtype=js&vataframe=bannerDefault&callback=QNR._AD.topicLinkL&ab=b&tile=14037746817393432272&city=北京 HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:38 GMT
Content-Type: text/plain;charset=UTF-8
Connection: keep-alive
Set-Cookie: sn=1403774678_1; path=/; expires=Thu, 26-Jun-2014 17:54:38 GMT; HttpOnly
Content-Length: 934
Server: QWS/1.0
QNR._AD.topicLinkL({.  "response_stat": {.    "elapsed": "2718",.    "
url": "notshown",.    "stat": "success".  },.  "key_data": [.    {.   
   "description": "............ ..................",.      "e": "A8Cep
Yf7/5lw5l1WrUN380FvSY7KzRpc63itW0NscZG8Hs ufgv3E7nEg80xDOCJ8azXLZ4hLlr
5U6wC2zkOaMG1hHFxETytkubaH1uISJSAxEUyTspuYstWNi2wAGaA GAtqv70vQS7HmHs4
7zLqw7LgUmNZaoRoThS4vegrfVFcahiriyRQgxGk0EFznQ1xRvCBPQRl3UEPLyc7GQ3LK0
YRcMR zMoqaStGbYPqAe0vKKBk0B87XfYetOM UT6gR3STmi951rGHdSWpxIwI/B3xvgVZ
lvMgw/RaBYoA PE8pTqRd2QH6mKkzpHyr  LXt/3yGmSEy4aw836SQuhFblvoBhkfWYkSb
R/udnxsOfMPVEVs0QJdKC4ZH1r3t1tSLR70oaYCcAQ8Hhz9o QOMfVmZq1mXFPOl/B9a24
ktN9mX9 vJZwAFxdW5hcg==",.      "img": "hXXp://img1.qunarzz.com/qs/201
405/08/f1f51d8b645559506886324a.png",.      "show": "VVV.qunar.com",. 
     "title": "............ ..................",.      "sale_price": "
",.      "cus": "",.      "s": 8741865,.      "margin": false,.      "
phone": "".    }.  ].}.)....


GET /vataplan?framId=ifmRightFlightOwner&vataposition=QNR_ZTU=_CN&tag=99&rows=1&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightFlightOwner&ab=b&tile=14037746817393432272&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: text/plain;charset=UTF-8
Connection: keep-alive
Set-Cookie: sn=1403774679_1; path=/; expires=Thu, 26-Jun-2014 17:54:39 GMT; HttpOnly
Content-Length: 898
Server: QWS/1.0
QNR._AD.ifmRightFlightOwner({.  "response_stat": {.    "elapsed": "228
2",.    "url": "notshown",.    "stat": "success".  },.  "key_data": [.
    {.      "description": "..................",.      "e": "AqzsRgaB0
wHhUw6 0BsF5fwmpN7KcnWSkdzPx/DUUlsJVzU5Ds4UWWJ3S5JzUtggkqE6wPVl5rLGWDR
BiT1hecYse5A7jU nYmZgNEf/gbyhPkQE/LSvklECiJwgkolDiXIieU/SUwAqygimDV5WV
8H6R1My0jFmnzIBt67CF3etSHabhkt4ByGlh1Y9jY43Of4FvoIiq/ZPQ8wzCSax/uvJSQ/
PvnJGJ3uvkDwjyGguT9fcP63COWUs0wfIkthPVI/n/n1NELb2NfYhriS8mYQtvmzk1 dkV
oeaefwsOYsTKbOv LkMOyQzR34gkmdClaDHa/fgddRHjyStWx2Zyo8NwSG2SEE/LtQwFoH
gVNQQ5sPl4w2MqCuI2QhDuA/Jk6fdCw7pga9mZaqEj74EMajaShBLmgbYbmFy",.      
"img": "hXXp://img1.qunarzz.com/qs/201406/16/69042343885abe176886324a.
jpg",.      "show": "tejia.flight.qunar.com",.      "title": "........
..........",.      "sale_price": "",.      "cus": "",.      "s": 96782
83,.      "margin": false,.      "phone": "".    }.  ].}.)....


GET /vataplan?framId=ifmRightFlightExt&vataposition=QNR_NmE=_CN&tag=99&rows=1&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightFlightExt&ab=b&tile=14037746817393432272&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=4688; csrfToken=it6M9Atyeg9B48ikvPRA65UYg8zFnFqC; QunarGlobal=192.168.50.30_-11c2070b_146d7744a37_-2a30|1403774673743


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 09:24:39 GMT
Content-Type: text/plain;charset=UTF-8
Connection: keep-alive
Set-Cookie: sn=1403774679_1; path=/; expires=Thu, 26-Jun-2014 17:54:39 GMT; HttpOnly
Content-Length: 910
Server: QWS/1.0
QNR._AD.ifmRightFlightExt({.  "response_stat": {.    "elapsed": "3512"
,.    "url": "notshown",.    "stat": "success".  },.  "key_data": [.  
  {.      "description": "......",.      "e": "TVY4NFaC8xh5WlcrenUz8rC
PWgJu4Bm Tmj7xjnGFIPbvSMxpEBXbRg6zGVcEQrrWhmgZGb2RNP5YVn/Ow1ieF/Ieicnp
LvdPiaoO4He1FgJtpsojTltW3RqVsFVvimDUSB2mO8Oal/LdByPpsXqJU J8L0m5XgIz2t
x9rVVBoskgmmrNZCMPT/SWd7PVLtQZU2aiafi1wrDNh9mKhec8t8LzKufQtTeepXwELEjQ
c5VgUMkpjnLrsRjkpd2L19kJ7Zy24Sit8if LIReAXXRxAlTdYpCuYXeXqmFoZNYjOsbUR
PHd6s3u19Wwb OodYfo4KYm3UZvBS1vJkI1mrWXPAzxVuNoQ5KcUBTWB/U6q35wRo51KMp
mw7brsob Y/2cSOUO85EncUU2WROeWEmaodAWgDC7PrIg3HCDJIxlbAlEwbm228O OK5J1
0LIpuiFakb0UWjF9hcg==",.      "img": "hXXp://img1.qunarzz.com/qs/20140
6/25/abff041c31dd85546886324a.jpg",.      "show": "flight.qunar.com",.
      "title": "......",.      "sale_price": "",.      "cus": "",.    
  "s": 5786337,.      "margin": false,.      "phone": "".    }.  ].}.)
HTTP/1.1 200 OK..Date: Thu, 26 Jun 2014 09:24:39 GMT..Content-Type: te
xt/plain;charset=UTF-8..Connection: keep-alive..Set-Cookie: sn=1403774
679_1; path=/; expires=Thu, 26-Jun-2014 17:54:39 GMT; HttpOnly..Conten
t-Length: 910..Server: QWS/1.0..QNR._AD.ifmRightFlightExt({.  "respons
e_stat": {.    "elapsed": "3512",.    "url": "notshown",.    "stat": "
success".  },.  "key_data": [.    {.      "description": "......",.   
   "e": "TVY4NFaC8xh5WlcrenUz8rCPWgJu4Bm Tmj7xjnGFIPbvSMxpEBXbRg6zGVcE
QrrWhmgZGb2RNP5YVn/Ow1ieF/IeicnpLvdPiaoO4He1FgJtpsojTltW3RqVsFVvimDUSB
2mO8Oal/LdByPpsXqJU J8L0m5XgIz2tx9rVVBoskgmmrNZCMPT/SWd7PVLtQZU2ai
<<< skipped >>>


GET /qs/201406/16/69042343885abe176886324a.jpg HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Thu, 26 Jun 2014 09:24:50 GMT
Content-Type: image/jpeg
Content-Length: 12308
Connection: keep-alive
Last-Modified: Mon, 16 Jun 2014 10:45:47 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 859140
Via: SX-167-162.fastcdn.com (DLC-3.0), CT-187-196.fastcdn.com (DLC-3.0)
......JFIF.....H.H......Exif..II*.................Ducky.......O.....oX
MP.://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzr
eSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adob
e XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <rd
f:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <
rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/
mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmln
s:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did
:8CDF47D04CF0E3119BEDB5BA158707CD" xmpMM:DocumentID="xmp.did:8E09E9A4F
06F11E3A577CB88857F8F4E" xmpMM:InstanceID="xmp.iid:8E09E9A3F06F11E3A57
7CB88857F8F4E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <
;xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2A177E456F0E3119BEDB5BA1
58707CD" stRef:documentID="xmp.did:8CDF47D04CF0E3119BEDB5BA158707CD"/&
gt; </rdf:Description> </rdf:RDF> </x:xmpmeta> <?
xpacket end="r"?>...C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222...........".....................................
...B..........................!1AQ.aq..."2.....#BR..b3..$s....4CSTcr..
..............................1........................!1.A.Qaq"....2.
...#B3..............?....Xlx.;.....\.... .[....k..Kk~..(<..c.A..G..
{.L:.>..V..kk...}...'.$.R-p~'....(p.f.P....[B<.Xb...Z].S..a_.a.6
7.......:A.^.!Z....!....;.......m.p.II.(...).......M.;..a$....F...
<<< skipped >>>


GET /live/2014/06/21/23/1013v1403362989752327021.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: ngx_openresty
Date: Sat, 21 Jun 2014 15:06:15 GMT
Content-Type: image/jpeg
Content-Length: 53343
Expires: Tue, 16 Jun 2015 15:06:15 GMT
Cache-Control: max-age=31104000
ETag: "3642454993"
Last-Modified: Sat, 21 Jun 2014 15:03:09 GMT
Accept-Ranges: bytes
X-HITS: 0
Powered-By-ChinaCache: HIT from 13002723SH
Age: 411496
Powered-By-ChinaCache: HIT from 06010923S1
......JFIF.....H.H......Exif..II*................ohXXp://ns.adobe.com/
xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011
 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="h
ttp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.ad
obe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:73E6526B69B6E01191
83F6332DACD560" xmpMM:DocumentID="xmp.did:5CBE60A3F2A011E3A1019049CAA2
CD58" xmpMM:InstanceID="xmp.iid:5CBE60A2F2A011E3A1019049CAA2CD58" xmp:
CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:0D63548F9EF2E3119A94DF97BF28E807" stRef:docu
mentID="xmp.did:93EEF2C6B66B11E087A8C6BE9A0D9698"/> </rdf:Descri
ption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
;...C.................................................................
...C..................................................................
......................................................f...............
.................!.$1.."#AMQaq..&235CW.......8V......'6BFRTXdrstSYw.
.....7EGUbc.......................................m...................
.........!1.$AQ..aq...."#24......%DV..&378BSTWdr......56CEFRUt.'bc....
...Gfuv....eg.................?.......:..&I"!...$........2i..'~..|....
|9.Yt......x.k..5...~..#.:....3!.....-...'gn*..>g..cst.O496.j..
<<< skipped >>>


GET /site/images/flight/home/hurryup.gif HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 1265
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 04:44:18 GMT
Last-Modified: Thu, 29 May 2014 08:05:04 GMT
Expires: Fri, 01 Aug 2014 04:44:18 GMT
Age: 16815
X-Cache: HIT from qunar_cdn_01
GIF89a#........T...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin
="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe
:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:0
9:15        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-
rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http:/
/ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" 
xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:Creat
orTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:64242D
D8E70311E3A809E2D4CBC3A918" xmpMM:DocumentID="xmp.did:64242DD9E70311E3
A809E2D4CBC3A918"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:
64242DD6E70311E3A809E2D4CBC3A918" stRef:documentID="xmp.did:64242DD7E7
0311E3A809E2D4CBC3A918"/> </rdf:Description> </rdf:RDF>
 </x:xmpmeta> <?xpacket end="r"?>.........................
......................................................................
...................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\
[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ....
.............................!.......,....#.....BL`.k..X........,E..,W
WV.:...q.j....9......X....2.B...V...?.p.aj....!.......,....#.....C....
..XDs.....B.<"...cX]........-5..Hr~.Cy.D.k....B...!.0...i.R*.C..;font>....
<<< skipped >>>

GET /site/images/flight/home/bg_bd_rex.jpg HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 04:44:18 GMT
Content-Type: image/jpeg
Content-Length: 443
Last-Modified: Tue, 11 Mar 2014 13:52:41 GMT
Expires: Fri, 01 Aug 2014 04:44:18 GMT
Accept-Ranges: bytes
Age: 16815
X-Cache: HIT from qunar_cdn_01
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
.......................................................&..............
.\..................................................................Qa
!q................................?..q..xT...E.....W..:......z&8H.m2..
....=.W...E.Q.....Vj.J.i.j..Z...f.aQ..f..4....u..V... .....V... ......
...........................


GET /site/images/flight/home/bg_tabsel.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 04:44:20 GMT
Content-Type: image/png
Content-Length: 944
Last-Modified: Tue, 11 Mar 2014 13:52:42 GMT
Expires: Fri, 01 Aug 2014 04:44:20 GMT
Accept-Ranges: bytes
Age: 16814
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR...............nG....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:664B9366FBF411E1BC349E27
763C9AF1" xmpMM:DocumentID="xmp.did:664B9367FBF411E1BC349E27763C9AF1"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:664B9364FBF411E1BC
349E27763C9AF1" stRef:documentID="xmp.did:664B9365FBF411E1BC349E27763C
9AF1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..?u....PLTE..d...W1.l....IDATx.b``....l...
.......~{....IEND.B`.....


GET /site/images/flight/flight_v1/postmk_dc.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 2429
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 04:44:20 GMT
Last-Modified: Fri, 16 Aug 2013 09:25:06 GMT
Expires: Fri, 01 Aug 2014 04:44:20 GMT
Age: 16814
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR...E...D.............tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..\Mn.8.f....g....O...`..O...uN...vN`..q...`..UN`f1..'....
..WR.......#....}.......Ul....T..q$.H.q...=J{\.. {<...=...S...?....
a......0`_.......{........d............`.1a..\..<..-.qL..........{m
G=......0....P.d\...../.../....)t.:[..[....x.I..\V1'.....so.{./....X..
.....C.IY_..7........5:y=......8...z6.(n.60..l...W..g.....z.P.Pt..1..L
......Y65.hP.....`.....Z..,X .o.L....h....i.~.6....O..*;.b.I.C....q.9.
.....KK.S...1.......b..^}.u..>.. ..M ....Xub.e......).h..-..bf8...L
HoZ....7./[email protected]...&..Y..Lg.... q..Pu`...0.....h...l(Is.4..k.>.
w.. .....%.. ...h.%S`f..]..2.....u.^....5...<%....XPG.X.bW.0M:..=.m
4..r.;..1........,bR.....>..i]....!...*[email protected].>
;P... )U.=C......U..`r[........vv)2.....].i.9 G...........Gx.....Q.).v
Lt.SbK..m..[WD...&P...H..=..eV..>y..=.U,..\...|>g.G..W.....S....
- ...N.rQp..50..I2U]jLX...h...a.B....*<..c^..L..J=b....$ ."\.<.,
.....a..q.D........i<!.U......fD.L....s..H..c..b|.*k.PyJ.mB...Z(v.e
.S..l...g.....w.5.p.5".E.....Ky..f7............%..g=."<. .<a.9..
...&G.....S.~.UI....9K.....|.k.J...........(Fp....-X...W....z.[?..t.J.
..t..}..:.:....G....{2..z`T%.|.3%g.........d^..%.}K3...."...\z.%.?....
.8c..X!.. G..C..>D.b.......9q.G.p..@..\c.......f.hl<..=.......0.
-.6..w..`E.|[email protected]{,.I{.kf.I*[email protected]
.#L....=nW..!..}.G..}j....i.._."....qBe...)r..0...j[L..Lm.1....M#;.z.~
.}W.)Ul..B..841....q..-{.j.....g(.h.8Ay.... ....0..i8..&.1.w>.x
<<< skipped >>>

GET /site/images/flight/flight_search/bg_sephuan.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 1120
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 05:45:51 GMT
Last-Modified: Wed, 26 Dec 2012 08:35:15 GMT
Expires: Fri, 01 Aug 2014 05:45:51 GMT
Age: 13124
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR.......d.......0.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:288692CE0A0211E29AC582AC
3FB368C2" xmpMM:DocumentID="xmp.did:288692CF0A0211E29AC582AC3FB368C2"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:288692CC0A0211E29A
C582AC3FB368C2" stRef:documentID="xmp.did:288692CD0A0211E29AC582AC3FB3
68C2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.g}.....PLTE....................X.....tRNS.
.............IDATx...Q.. .D]......f-..I...5.O2..m...nMf...:./!. ......
&b{DDG. ..I.I..s....x.pr.$......OqH.j/^....M.~.^X..?..>.j.3.^.6g...
D..":...].D...y.".("....TUa7i......C..`..W#..{I.....IEND.B`....
.


GET /site/images/2011/QN1CS1.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 1283
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 05:45:53 GMT
Last-Modified: Wed, 08 Dec 2010 12:43:00 GMT
Expires: Fri, 01 Aug 2014 05:45:53 GMT
Age: 13122
X-Cache: HIT from qunar_cdn_01
GIF89aN.......-..i...................!..XMP DataXMP<?xpacket begin=
"..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:
ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32
:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-r
df-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://
ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" x
mlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:Creato
rTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:BAA956F7
029411E0AF8680AE74ACE497" xmpMM:DocumentID="xmp.did:BAA956F8029411E0AF
8680AE74ACE497"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BA
A956F5029411E0AF8680AE74ACE497" stRef:documentID="xmp.did:BAA956F60294
11E0AF8680AE74ACE497"/> </rdf:Description> </rdf:RDF> &
lt;/x:xmpmeta> <?xpacket end="r"?>...........................
......................................................................
.................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[Z
YXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ......
...........................!.......,....N......8..S0JG....|..D(..@<
\..l....q.........5.f..T`F...\6y=..D%..Ras9...`..4..lX,x.8i..H..=O....
 ...q.. ebdcY. W&z!m~...t=.*U.#.N..^...n).xe..|..\OQ>Si.l....[.7...
U.1..3.I.H....4...;....
<<< skipped >>>

GET /site/images/flight/home/ico_la_ie6.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 6777
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 04:44:18 GMT
Last-Modified: Thu, 20 Mar 2014 03:40:04 GMT
Expires: Fri, 01 Aug 2014 04:44:18 GMT
Age: 16817
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR...d...^.....D.J.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE........Q..q.......q....z...j.......m..........r.....;.....
B....}'u..............}..u............. .........o......./............
.......v........i.n...................D........9r...........y.........
.............U..............e...........?.~(.................3.....G.y
 ....................O.t........r..k.........\....t..................o
..<....h......`........kw......n..|%.....x........u..5..|..Jq......
..v..............s.............i............{...m.....................
......l........-....|$....x...K..6...........W.................Z......
........T.........p................f.....0....................H...|..x
.......g.z!..].............s..l...........................*...........
.........{..N.v........n...............).........w..........~o........
.o.l...f.......l....tRNS..............................................
......................................................................
......................................................................
......................................................................
S..%....IDATx...w|.....H>.q.....N.....O.$Y...l....-Y....m06...`....
H..............z....7[gwgnw.I.>..|l..z.{;3.:3{...P\.XHZVN:O-.9Yi.{.
f{......6. I~>B.'...2Q.....I..#.\..4%..%.......P..I....e<;..R..~
[email protected]..].]... B.L......\$....o..}^M..P.........~#...r...z.
t6..l.Iw.)t...C.*.... ;GOl..e....4..).C.wq...A3.... ; ...r..bK.u.Q.s..
N.cM.PFM.[R...q...;b8n...%.:..9U...F..7AlI....B.C:.']..Iw......Bh.
<<< skipped >>>

GET /site/images/flight/flight_v1/ico_arrsel.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 249
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 01:35:38 GMT
Last-Modified: Fri, 16 Aug 2013 09:25:06 GMT
Expires: Fri, 01 Aug 2014 01:35:38 GMT
Age: 28138
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR.......d......u......tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTEUUU.i....Z.......tRNS......A...wIDATx...K.. ......m..#N.].n
.....H.h..}......._......0.~..:j2. [email protected]...=9.X..#........H.:/..
....3./.....)....'x.0..... #......IEND.B`.....


GET /site/images/flight/flight_search/ico_a.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 08:04:57 GMT
Content-Type: image/png
Content-Length: 552
Last-Modified: Wed, 26 Dec 2012 08:35:14 GMT
Expires: Fri, 01 Aug 2014 08:04:57 GMT
Accept-Ranges: bytes
Age: 4779
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR................E....tEXtSoftware.Adobe ImageReadyq.e&
lt;...-PLTE ...h....UUUWWW<|..i.G...Z..a.0s.%j.Q..W......y.M....tRN
S......................vIDATx...... .E#.n.6... -*%.#...u.?.c..{.*.=hj.
..$.Jv.s...4l.5[`.2T...JGE&9H8....r4@.\..%.J.>...2g..N...x...T:*2.A
...l....F..8|M%.v?r3gt9.C.("...*.=.O..i"^./..4:..ZGZ...6.<.._...$..
..{....N.XDF...h......L.yd#)'.N...}.p'=A$..pKSNC7")'..wo.{ ......v.G9.
.H....:.Al.O..f.7..Y......`.. [email protected]....;r.w..F..|.m.5m.........
....*...z.0.6.8...}oa.u.......D3.m.`lE2-......C.o........S........IEND
.B`.....


GET /site/images/new_main/tb.bg.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 268
Accept-Ranges: bytes
Date: Thu, 26 Jun 2014 08:31:50 GMT
Last-Modified: Thu, 11 Nov 2010 08:54:59 GMT
Expires: Fri, 01 Aug 2014 08:31:50 GMT
Age: 3167
X-Cache: HIT from qunar_cdn_01
GIF89a2......................................................!.......,
....2........I..8W...`(.di....l..p.>tm.x.......p......r.;8...tJ.Z..
lU..z...x.e....z.n...x.A.....~....{...................................
............................................................;..
..


GET /site/images/airlines/CZ.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:48:07 GMT
Content-Type: image/gif
Content-Length: 1199
Last-Modified: Wed, 01 Jan 2014 13:56:23 GMT
Expires: Fri, 01 Aug 2014 07:48:07 GMT
Accept-Ranges: bytes
Age: 5792
X-Cache: HIT from qunar_cdn_01
GIF89a................................................................
......................................................................
......................................................................
......................................................................
............................~..}~.|}.zz.yz.uu.rs.pr.pq.mo.ln.lm.kk.kl.
km.ll.kl.jl.hi.fg.ce.^`.^_.YZ.WY.WX.XZ.SU.ST.QS.MO.MN.LM.KM.KL.JK.JL.J
L.HI.FG.DE.DD.DE.BC.CE.BD.?@.<<.<=.;;.9:.78.7:.23.24./1.,,.,,
.').$%. ". #.. .......................................................
......................................................................
......................................................................
......................................................................
....................!.......,...............H...C..*\(0H..74i...H...Q 
R....=...B..#A..:. h.S .&....A../.6`i.. ...Dl.D....1.......(.....%...8
p.PX...L|R..4E..I&L....J...........J .XQ...B...9E.)...H..P....~.......
....j%C .N..DPQH..-C.d.`....yPqb!...2;..p4.A."E.4X.(..2N.0...M.....y..
'....40#D...p....i....b......%#.?.....p/....`...*@,...K.pE..a.B..Tp...
........ \... .......`..n..H(...J#..AA..$..(4..J"..'....".(.D......B..
......9..!..@L...;....


GET /site/images/flight/home/ico_arr_ad.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:48:53 GMT
Content-Type: image/png
Content-Length: 247
Last-Modified: Wed, 02 Apr 2014 08:00:04 GMT
Expires: Fri, 01 Aug 2014 07:48:53 GMT
Accept-Ranges: bytes
Age: 5746
X-Cache: HIT from qunar_cdn_01
.PNG........IHDR...$...#.......X.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE....i...............9~....tRNS.............iIDATx...1.. .C.
i.......C......m..A0*x......yA...J.'o:oOG...F...A\)B3.@.!V......c.Xy..
.6.u%..7....n...G.......!3.}....IEND.B`.HTTP/1.1 200 OK..Date: Thu, 26
 Jun 2014 07:48:53 GMT..Content-Type: image/png..Content-Length: 247..
Last-Modified: Wed, 02 Apr 2014 08:00:04 GMT..Expires: Fri, 01 Aug 201
4 07:48:53 GMT..Accept-Ranges: bytes..Age: 5746..X-Cache: HIT from qun
ar_cdn_01...PNG........IHDR...$...#.......X.....tEXtSoftware.Adobe Ima
geReadyq.e<....PLTE....i...............9~....tRNS.............iIDAT
x...1.. .C.i.......C......m..A0*x......yA...J.'o:oOG...F...A\)B3.@.!V.
.....c.Xy...6.u%..7....n...G.......!3.}....IEND.B`...



GET /jsorigin/AC_RunActiveContent.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gm3579.com/qs/hw_ddsb0618/index.html?cid=16850340782&oid=100037893&dirtype=0&sid=68503&site_id=10352&p=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uimg.xiaoangel.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Jun 2014 09:24:31 GMT
Content-Type: application/x-javascript; charset=utf-8
Last-Modified: Tue, 30 Nov 2010 13:33:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
a7f.............Yio....l...7.C%..6o..@q. ...:p....E.$&4..G..7...;.I..S
$.`k..s.9w.a...wN..v.t....>....t!d.....J...4..E.q$.E/[email protected]...[.
Mg.....>.Nh..cA.......M.T.S. .v.FqLzAFR.....v...({..hH.._FS_.....V.
N........;...k..!..[...\.zB.?..S..s.l..._....~&....*J....\H....6...M.I
S.....d.h..i.(....f............,.?...}e 1..{...k......o)~.0...kfJ..i..
......M ....M.L..IC.<.f..1.0~.y..X..b..U....fB.$.t....1..; i.A.."..
.U...gi.u./..]g....b.w..!.Q..P....q,.......F....5EKk.M.....-..........
cXd..4.....6........Q.)[email protected]:3?..
..,.....N*.-.|)&..C....b./b.4..I$3E..8....MZ.....{:n...~...Xj.X.a ....
<..|..".(L.|.* .x.f.....8.H.!....c..._0P...<?^..YYb.O.u.|.}c8...
....b.Mx.._...........jZ.......bK.7._2....F.....?2........T7C.?..0..h.
Q.........C@.....>.j.!..._.:...D...4.."..".o. .zu../.osV.5..k.....!
...&.B6[w..%..k.....!.P0..W.f....9...../.... .....DM0.b...(.fQ.5=Y ~..
.*..X$S5...3....eQd...N.........zW...;[A..W.....V.....<..5.3.]8...8
....wXz.GF..NX....\yp.n....%..l.G..Q.I.....^.....=.L,....[...T=l..q...
%.<.{W.>. ..D3...W).s......c.X...2?.*F&kg..b.d.....{G.e.........
m..d.1:.(.6..SA...:...T...?'.N...d..x...v.zm.W....[.u.C...Q.f..`c...c.
.j.l.:A.4....d....~..O...c..s..Tf...4...P,..m....e...${X(.~.:@..{.)..'
....=.b.8DB4.7.....Z.........b..OI..0.L...Ur....9} U&G.q..>.~.....n
uW.26*.....m....~8H`.K]f.s.(5...S....../..@P:H.c..-5..%.eO[&.. .......
"[.s.#.&[....&...@.(XM}....Kk...h.....Peg'O..^C.!Hr..s>1./...&/[email protected]
6.G. .../..!...ez..kSq....(..........F......oh.6c.m.i........,.5..
<<< skipped >>>


GET /lw/images/login/login140618/top_01.jpg?v=1 HTTP/1.1
Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 07:08:57 GMT
Cache-Control: max-age=2678400
Content-Length: 45561
Content-Type: image/jpeg
Last-Modified: Wed, 18 Jun 2014 12:55:10 GMT
Accept-Ranges: bytes
ETag: "629ca989f48acf1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 fuz114:5 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......<.....)hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A07E0A06F6D211E3B17EAE
722896B44B" xmpMM:InstanceID="xmp.iid:A07E0A05F6D211E3B17EAE722896B44B
" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:D5C042A7F52911E3BF35B2B216D7B72C" stRef:
documentID="xmp.did:D5C042A8F52911E3BF35B2B216D7B72C"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
......................................................................
..........................................!.1A..Q".aq2....B#...Rb3..r.
C$...s4....Sc..t56....D%'....d.u&......................!1..AQ2aq".....
B3......b#R.rC...............?..0.#...9...P.M....>.u.Mb.Q. #/2...1.
OP.......v.b'H.R5....*.....8.b.E..P....n.....i}c...Pi.>7ob.G...#.He
..e .u..h........C.I....ie......4...;v.....C....m....N..2..........V.U
...K,........`.<.#.(%....b..,.>0...[.........n......zFq...~.
<<< skipped >>>

GET /lw/images/login/login140618/right.jpg?v=1 HTTP/1.1


Accept: */*
Referer: hXXp://lw.q1.com/login/login_lianm5.html?radid=lm02_lw&rsid==14516&check=1&track=1974|9842
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.res.szgla.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 26 Jun 2014 05:43:42 GMT
Cache-Control: max-age=2678400
Content-Length: 71367
Content-Type: image/jpeg
Last-Modified: Wed, 18 Jun 2014 12:55:09 GMT
Accept-Ranges: bytes
ETag: "6e8c5889f48acf1:736"
Server: Microsoft-IIS/6.0
access-control-allow-origin: *
access-control-allow-credentials: true
Age: 1
X-Via: 1.1 fuz114:2 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......<.....)hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c060 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:7099A9F1F6D211E3A88ACF
A378A97B53" xmpMM:InstanceID="xmp.iid:7099A9F0F6D211E3A88ACFA378A97B53
" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:03D5A902F53011E3AD72EA2ED1FFDF53" stRef:
documentID="xmp.did:03D5A903F53011E3AD72EA2ED1FFDF53"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.......................#..............................................
...........................................!.1..AQ"..aq2...BR#...br..3
S.....$Cc4...s.Tt%..D&6...d5...U.f'7.......................!1A.Qq2..a"
.......B.#3..Rr.b.......$............?........o.d..jE5Q.e.....{.\t.O.u
D....k......,.CP}.L.K~.Io. Z...VW......OiY.p..-[.%ll.F5.H...8.0..CQ.(.
X..G.y........P.Q\.D6....v."l..060*@4w....U..Q}f.{....A..1..k.@%..(..B
"[&PC...<r...{....h....[v.E.|..SduK.K.kh.}..8....da-...x.H..D..
<<< skipped >>>


GET /live/2014/03/18/15/1013v1395126094590286213.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.6.cn/?src=tuiga834
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi2.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Tue, 27 May 2014 08:34:34 GMT
Content-Type: image/jpeg
Content-Length: 13161
Expires: Fri, 22 May 2015 08:34:34 GMT
Cache-Control: max-age=31104000
ETag: "2584244945"
Last-Modified: Tue, 18 Mar 2014 07:01:34 GMT
Accept-Ranges: bytes
X-HITS: 1
Powered-By-ChinaCache: HIT from 13002723SI.2
Age: 2594997
Powered-By-ChinaCache: HIT from 06010923Sl
......JFIF.....H.H......Exif..II*................ohXXp://ns.adobe.com/
xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011
 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="h
ttp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.ad
obe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EFA4665EB4ADE311B3
5FA31634DF3C17" xmpMM:DocumentID="xmp.did:2AE6F4ABAE4011E396E59173DF2B
38CE" xmpMM:InstanceID="xmp.iid:2AE6F4AAAE4011E396E59173DF2B38CE" xmp:
CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:C1677FF33FAEE3119086B68EA79F3428" stRef:docu
mentID="xmp.did:EFA4665EB4ADE311B35FA31634DF3C17"/> </rdf:Descri
ption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
;...C.....................................%...#... , #&')*)..-0-(0%()(
...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((.
.....f.............................................[..................
.......!1.AQ.aq.".....2.....BCSs........#$3Rbcrt.......%&EF.'456UVd...
................................<........................!Q..."12AB
aq....#R...$S....34.Cbr.............?...'.x........:..!L....3...A.1...
 ....(`.. NS.}400aD.t.t0...c..O..(t.v..A:V.#...`...,.S.p..5..>.....
.........k.......5..}.WwHi..1.....I...H... k...us.....!$...8..erG4
<<< skipped >>>


GET /9.gif?abc=1&rnd=690083581 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Server: Tengine
Date: Thu, 26 Jun 2014 09:24:23 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=x9QyDBpdXF0CAcGK9OfjJSLK; expires=Sun, 23-Jun-24 09:24:23 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=707287fd; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=69687743fd8102e8c2d45a6b_1403774663; expires=Sun, 23-Jun-24 09:24:23 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=x9QyDBpdXF0CAcGK9OfjJSLK
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Thu, 26 Jun 2014 09:24:23 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=x9QyDBpdXF
0CAcGK9OfjJSLK; expires=Sun, 23-Jun-24 09:24:23 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=707287fd; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=69687743fd8102e8c2d45a6b_1403774663; expires=Sun, 
23-Jun-24 09:24:23 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=x9QyDBpdXF0CAcGK9OfjJSLK..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_856:

t$(SSh
~%UVW
u$SShe
advapi32.dll
kernel32.dll
RegOpenKeyA
RegCreateKeyA
www.cfmogu.com
123456789
%System%\drivers\etc\hosts
127.0.0.1 www.cfyuanji.com
127.0.0.1 www.cfyuanji.net
127.0.0.1 www.cfyuanji.cc
127.0.0.1 cfyuanji.com
127.0.0.1 cfyuanji.net
127.0.0.1 cfyuanji.cc
127.0.0.1 www.cfyalan.com
127.0.0.1 www.cfyalan.net
127.0.0.1 www.cfyalan.cc
127.0.0.1 yy.cfyalan.com
127.0.0.1 cc.cfyalan.com
127.0.0.1 cfyalan.com
127.0.0.1 cfyalan.net
127.0.0.1 cfyalan.cc
127.0.0.1 www.cftianyue.com
127.0.0.1 www.cftianyue.net
127.0.0.1 www.cftianyue.cc
127.0.0.1 cftianyue.com
127.0.0.1 cftianyue.net
127.0.0.1 cftianyue.cc
%System%\drivers\etc\
http://www.cfmogu.com/index.html
www.cfmogu.cc
http://www.cfmogu.com/0.htm
.text
`.rdata
@.data
.rsrc
@.reloc
winmm.dll
user32.dll
EnumWindows
GetAsyncKeyState
crossfire.exe
@winmm.dll
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
RASAPI32.dll
GetProcessHeap
WinExec
KERNEL32.dll
GetKeyState
USER32.dll
GetViewportOrgEx
GDI32.dll
WINSPOOL.DRV
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
WSOCK32.dll
WININET.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
VMP.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
#include "l.chs\afxres.rc" // Standard components
3<3M3e3
<-=3=9=?=
7%7u7
64787<7@7
9,:0:4:8:
8%9u9
;";);0;7;
2%2X2w2
2#2(282>2
=$=(=0=4=
; ;(;,;0;4;8;<;
d3d9d.dll
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
(*.htm;*.html)|*.htm;*.html
www.dywt.com.cn
.PAVCOleException@@
.PAVCOleDispatchException@@
c:\%original file name%.exe
GetWindowsDirectoryA
oledlg.dll
InternetCanonicalizeUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
L.DRV
#R.js
.pS8E
.Ix;9
N5'.YV
=:.Af3
J.Igm
'G.zG
j
l
%C}R[2
xR.vZ
.ODDxh
sI.WU
pW%ð
".lu!]
Zj5)R/4?n%D
sG.SF(
%%dQ!Jj
w%SXH
%XAC,u8
(v.idC
Q%U
.Iv,L1
K|.mF
.PD@HG@
wO.TIS
>%Uu=
.Wd;P;(
fZ%Ds
T.Vlt
.cEY'.
B&r.Bf{
!j.il;
MSGL
ID.xQ
\ß@
Ç!YM
xW.bN
CL.Ls
yZ.xUY
(*.*)
1.0.0.0
(http://www.eyuyan.com)

iexplore.exe_1752:




%?9-*09,*19}*09
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
SHLWAPI.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
rsabase.dll
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
watson.microsoft.com
IEWatsonURL
%s -h %u
iedw.exe
Iexplore.XPExceptionFilter
jscript.DLL
mshtml.dll
mlang.dll
urlmon.dll
wininet.dll
shdocvw.DLL
browseui.DLL
comctl32.DLL
IEXPLORE.EXE
iexplore.pdb
ADVAPI32.dll
MsgWaitForMultipleObjects
IExplorer.EXE
IIIIIB(II<.Fg
7?_____ZZSSH%
)z.UUUUUUUU
,....Qym
````2```
{.QLQIIIKGKGKGKGKGKG
;33;33;0
8888880
8887080
browseui.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
Windows
Operating System
6.00.2900.5512


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\close[1].png (286 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\27IFKA1Y\6[1].htm (13145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\promimg[1] (1636 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\stat[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\27IFKA1Y\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\bd5463690a93c57a1039c47e11ab0f97[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\1013v1403682187455450221[1].jpg (3568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WGXTV0YZ\firstpay[1].jpg (1842 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\pixel[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (605 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\base_MIN_11.12[1].css (3277 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\1013v1403362989752327021[1].jpg (392 bytes)
    %System%\drivers\etc\hosts (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WGXTV0YZ\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\AClick[1].aspx (744 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WGXTV0YZ\logo[2].png (826 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\1013v1402152081287210157[1].jpg (5073 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\spacegif[1].gif (60 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WGXTV0YZ\CAG0BO5N.htm (2713 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\logo[1].jpg (921 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (203 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (464 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\base_MIN_11.12[2].css (4429 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\b744ef7cf7616402b9cd75cd3b296755[1].jpg (3694 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\1013v1395126094590286213[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\2013.11.261[1].gif (3825 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\stat[1].php (4285 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (149 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S1MR25I3\promimg[1].htm (756 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\a7e7de85243a438ba91ea4d3d8a017b2[1].jpg (612 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (249 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (5056 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8K6D3CJA\1013v1402565661143534317[1].jpg (1591 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (149 bytes)

  4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
    127.0.0.1 localhost
  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now