Overview

URLhttp://nargesi.persianblog.ir/1389/5/16
IP174.120.93.132
ASNAS21844 ThePlanet.com Internet Services, Inc.
Location United States
Report completed2012-11-06 02:54:58 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Source IP Destination IP Severity Alert
2012-11-06 02:54:20 174.120.93.132 urlQuery Client2ET WEB_CLIENT Hex Obfuscation of unescape % Encoding
2012-11-06 02:54:20 174.120.93.132 urlQuery Client2ET WEB_CLIENT Hex Obfuscation of parseInt % Encoding
2012-11-06 02:54:20 174.120.93.132 urlQuery Client2ET WEB_CLIENT Hex Obfuscation of document.write % Encoding
2012-11-06 02:54:20 174.120.93.132 urlQuery Client2ET WEB_CLIENT Hex Obfuscation of charCodeAt % Encoding
2012-11-06 02:54:20 174.120.93.132 urlQuery Client2ET WEB_CLIENT Hex Obfuscation of String.fromCharCode % Encoding
Snort /w Sourcefire VRT
Timestamp Source IP Destination IP Severity Alert
2012-11-06 02:54:19 174.120.93.132 urlQuery Client3INDICATOR-OBFUSCATION Potential obfuscated javascript eval unescape attack attempt


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 174.120.93.132

Date Alerts / IDS URL IP
2013-03-03 06:07:140 / 7http://persianblog.ir174.120.93.132
2013-02-12 09:07:050 / 0http://kayvan.persianblog.ir/174.120.93.132
2013-01-05 08:20:180 / 4http://oldmanclub.persianblog.ir/post/287174.120.93.132
2012-12-18 23:53:340 / 1http://parnian.persianblog.ir/post/64/174.120.93.132
2012-12-07 02:08:400 / 6http://parnian.persianblog.ir/post/109174.120.93.132
2012-12-06 01:15:520 / 5http://shakhehnabat.persianblog.ir/post/186174.120.93.132

Last 6 reports on ASN: AS21844 ThePlanet.com Internet Services, Inc.

Date Alerts / IDS URL IP
2013-03-06 05:37:531 / 5http://connectplus.degrootdesignwp.com/images/luke-bodley174.120.169.34
2013-03-06 05:36:291 / 4http://medidordeumidadegraosmtpro.com.br/wordpress/austria-government-building74.52.234.154
2013-03-06 05:35:251 / 5http://sirtarieres.gr/3/false-chinch-bug174.122.148.158
2013-03-06 05:34:553 / 12http://symptomsofhotflashes.com/tag/pajamas74.52.31.184
2013-03-06 05:31:520 / 11http://www.speedspanishblog.com/contact70.84.7.114
2013-03-06 05:31:321 / 4http://purchasetabletpc3gbsale.mybestprice.info/atb11/рÐÂ&frac (...)174.121.10.195

Last 6 reports on domain: nargesi.persianblog.ir

Date Alerts / IDS URL IP
2012-11-07 23:40:550 / 6http://nargesi.persianblog.ir/post/59174.120.93.132
2012-11-07 17:54:450 / 7http://nargesi.persianblog.ir/1388/2/26174.120.93.132
2012-11-07 17:20:230 / 5http://nargesi.persianblog.ir/post/51174.120.93.132
2012-11-07 17:20:090 / 6http://nargesi.persianblog.ir/post/58174.120.93.132
2012-11-07 11:06:550 / 6http://nargesi.persianblog.ir/174.120.93.132
2012-11-07 09:21:160 / 6http://nargesi.persianblog.ir/1388/3/9174.120.93.132



JavaScript

Executed Scripts (15)


Executed Evals (2)

#1 JavaScript::Eval (size: 1313, repeated: 1) 

document.write(q55694e74('%31%5c%60%77%1e%6b%6d%76%64%5d%32%1a%6e%58%70%6d%20%5f%60%60%64%6a%36%58%59%68%69%5d%6f%32%75%65%5d%6b%60%36%2a%2a%2f%32%62%65%6e%5f%68%37%69%61%63%67%68%1c%3f%34%58%1d%66%6a%5c%65%35%1e%67%68%6e%6d%36%2a%2e%75%77%72%2d%5e%64%6c%67%6d%62%61%6b%2f%67%6a%2a%19%18%6c%5e%6a%61%58%6c%34%1b%5d%5a%65%5e%6a%67%19%3e%36%5b%3a%35%67%6d%6e%6d%1f%5f%6b%63%6f%6c%30%1e%1e%58%2f%35%28%2e%62%1e%1f%6b%63%73%5d%34%1b%2f%1a%3b%2d%36%34%2c%66%69%6f%6c%3b%31%2d%5a%3b%33%62%6b%6d%68%1a%5a%6b%65%6e%68%31%1f%18%42%42%45%3d%3d%35%1e%19%6a%6a%75%65%5a%35%1e%65%6f%68%69%25%6e%64%70%59%37%37%68%6c%30%1a%38%1d%53%5c%5b%62%6f%62%1f%4c%60%5a%61%5f%6a%18%3f%74%1e%30%5f%3d%3e%64%6c%67%1a%4a%67%60%6f%1e%30%2a%65%6b%6a%6b%3e%36%67%6b%6b%69%1e%5b%6a%63%6b%6e%32%1a%1d%58%29%30%2c%2f%66%1f%1f%6f%61%71%59%37%1b%29%1f%3f%30%2e%35%2c%62%6b%6d%68%38%31%2b%5f%3f%32%2f%58%3d%34%2b%5b%65%70%3f%34%5d%64%74%1c%6e%6b%71%64%5a%31%1c%76%61%5d%69%66%32%2f%2e%28%37%65%60%69%5c%6c%37%6b%67%67%61%6b%37%1e%3d%26%68%5b%6f%69%32%24%6e%5f%68%68%37%25%6e%5c%6a%68%36%27%6c%5a%6e%6f%37%34%2c%58%63%77%3a%35%2e%5a%65%73%3d%34%2b%6b%58%38%31%6c%5d%1d%59%60%58%68%6f%35%69%65%61%65%6c%3b%31%5a%65%73%1f%5f%64%5e%6b%6d%30%6c%6a%6d%28%3e%35%2c%5c%61%75%3e%36%59%61%73%1d%59%60%58%68%6f%35%62%59%68%68%3a16663535%37%32%33%37%34%36%33'));

#2 JavaScript::Eval (size: 260, repeated: 1) 

function q55694e74(s) {
    var r = "";
    var tmp = s.split("16663535");
    s = unescape(tmp[0]);
    k = unescape(tmp[1] + "522560");
    for (var i = 0; i < s.length; i++) {
        r += String.fromCharCode((parseInt(k.charAt(i % k.length)) ^ s.charCodeAt(i)) + 6);
    }
    return r;
}

Executed Writes (8)

#1 JavaScript::Write (size: 2, repeated: 1) 

31

#2 JavaScript::Write (size: 762, repeated: 1) 

<div style="border-right: #c6c8ca 1px solid; border-top: #c6c8ca 1px solid; left: 0px;z-index: 4000; border-left: #c6c8ca 1px solid; width: 485px; border-bottom: #c6c8ca 1px solid;position: absolute; top: 0px; height: 60px; background-color: #e9e9e9" id="divADV"><table border="0" cellpadding="0" cellspacing="0" width="485"><tr><td style="width:468px" id="tdAdv"><iframe style="z-index:4000; width:468px; height:60px; margin:0" src="http://persianbox.com/s.aspx?pscn=0&pscr=-&psct=-&psep=0" frameborder="0" scrolling="no" target="_top"></iframe></td><td style="width:16px; text-align:center; vertical-align:top"><img alt="close" src="http://persianbox.com/close.gif" id="imgClose" onclick="javascript:closeWindow();"style="cursor: hand"></td></tr></table></div>

#3 JavaScript::Write (size: 418, repeated: 1) 

<div style="text-align:center;width:525;float:right"><a href="http://www.blogskin.ir/" target="_blank"><b><font color="#e1911f" size="1">.:</font></b><font color="#FFFAC8" style="font-size:8pt;"> Weblog Themes By <b>Blog Skin </font><font color="#e1911f" size="1">:.</font></b></a></div><div style="width:210;float:right;">&nbsp;&nbsp;&nbsp;&nbsp;</div></div></td><td class=right><div class=top2></div><div class=menu>

#4 JavaScript::Write (size: 301, repeated: 1) 

<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head> <center>  <FONT style="FONT-SIZE: 9pt" face="Tahoma"> <a target=_blank href="http://bahar-20.com/ftp/amar-ads/ads/text/box/index2.htm">  <span style="text-decoration: none">¯1/F (F/ E'G *HD/</span></a></FONT></center>

#5 JavaScript::Write (size: 286, repeated: 1) 

<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head> <center> <FONT style="FONT-SIZE: 9pt" face="Tahoma"> <a target=_blank href="http://forosh.biz/Detail.aspx?q=cd1122&s=9178"> 	<span style="text-decoration: none">*1'FG 4'/ CH/C'FG</span></a></FONT></center>

#6 JavaScript::Write (size: 269, repeated: 1) 

<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head> <center> <FONT style="FONT-SIZE: 9pt" face="Tahoma"> <a target=_blank href="http://pichak.net/code-music"><span style="text-decoration: none">"EH24 3'.* C/ EH2JC</span></a></FONT></center>

#7 JavaScript::Write (size: 288, repeated: 1) 

<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><center>  <FONT style="FONT-SIZE: 9pt" face="Tahoma"> <a target=_blank href="http://forosh.biz/Detail.aspx?q=cd16&s=9178">  <span style="text-decoration: none">'A2'Ì4 B/ (' H124</span></a></FONT></center>

#8 JavaScript::Write (size: 541, repeated: 1) 

<p align='center'><a target='_blank' href='http://www.bahar-20.com'><span style='text-decoration: none'>3'J* '5DÌ C/G'Ì EH2JC</span></a></p><p align='center'><script language='JavaScript' type='text/javascript' src='http://bahar-20.com/ftp/amar-ads/ads/musics/tabligh3.js' ></script></p><map name="lebanon1" id="lebanon1"> <p align='center'><embed type='application/x-shockwave-flash' pluginspage='http://www.macromedia.com/go/getflashplayer' src='http://djcat40.persiangig.ir/02.swf' swLiveConnect='true' width='150' height='100'></p>


HTTP Transactions (36)


Request Response 
GET /blog.js HTTP/1.1

Host: blogskin.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 301 Moved Permanently

Content-Type: text/html

Date: Tue, 06 Nov 2012 01:54:20 GMT
Server: LiteSpeed
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Location: http://www.blogskin.ir/blog.js
Content-Length: 413
GET /37/style.css HTTP/1.1

Host: topskin.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: text/css

Content-Encoding: gzip
Vary: Accept-Encoding
Date: Tue, 06 Nov 2012 01:54:20 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Etag: &quot;828-4c34d5b8-0&quot;
Last-Modified: Wed, 07 Jul 2010 19:30:00 GMT
Content-Length: 775
Cache-Control: max-age=604800
Expires: Tue, 13 Nov 2012 01:54:20 GMT
GET /ads.js HTTP/1.1

Host: persianblog.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip
Last-Modified: Mon, 05 Sep 2011 12:16:02 GMT
Accept-Ranges: bytes
Etag: &quot;06dd793c56bcc1:0&quot;
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:53:30 GMT
Content-Length: 1974
GET /cc/57140/?rnd=40829.3275694444 HTTP/1.1

Host: nargesi.persianblog.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Cache-Control: private
Content-Length: 1110
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
PersianBlog: 2.0
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:53:30 GMT
GET /1389/5/16 HTTP/1.1

Host: nargesi.persianblog.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/html

Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:53:30 GMT
Content-Length: 28116
GET /blog.js HTTP/1.1

Host: www.blogskin.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 404 Not Found

Content-Type: application/octet-stream

Date: Tue, 06 Nov 2012 01:54:20 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: close
Etag: &quot;28e-4c5187a4-0&quot;
Last-Modified: Thu, 29 Jul 2010 13:52:36 GMT
Content-Length: 654
GET /Navbar.aspx?blogID=57140&blogName=nargesi&navbarColor=808080 HTTP/1.1

Host: persianblog.ir
GET /Navbar.aspx?blogID=57140&amp;blogName=nargesi&amp;navbarColor=808080 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Cache-Control: private
Content-Length: 3684
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
PersianBlog: 2.0
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:53:31 GMT
GET /ftp/cod.musics/page/22/js/02.js HTTP/1.1

Host: k3cod.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Encoding: gzip
Vary: Accept-Encoding
Date: Tue, 06 Nov 2012 01:54:21 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: close
Etag: &quot;27a-4d3e7acc-0&quot;
Last-Modified: Tue, 25 Jan 2011 07:25:00 GMT
Content-Length: 432
Cache-Control: max-age=604800
Expires: Tue, 13 Nov 2012 01:54:21 GMT
GET /ga.js HTTP/1.1

Host: www.google-analytics.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
If-Modified-Since: Wed, 19 Sep 2012 11:51:40 GMT
 
HTTP/1.1 200 OK

Content-Type: text/javascript

Content-Length: 14888
Content-Encoding: gzip
Last-Modified: Mon, 22 Oct 2012 15:51:19 GMT
X-Content-Type-Options: nosniff, nosniff
Date: Tue, 06 Nov 2012 01:21:09 GMT
Expires: Tue, 06 Nov 2012 13:21:09 GMT
Vary: Accept-Encoding
Age: 1991
Cache-Control: max-age=43200, public
Server: GFE/2.0
GET /images/stat.gif HTTP/1.1

Host: www.persianblog.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Thu, 24 Apr 2008 16:46:00 GMT
Accept-Ranges: bytes
Etag: &quot;054ebac2aa6c81:0&quot;
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:53:31 GMT
Content-Length: 1094
GET /ps.js HTTP/1.1

Host: persianblog.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip
Last-Modified: Mon, 22 Dec 2008 16:48:00 GMT
Accept-Ranges: bytes
Etag: &quot;06069c5564c91:0&quot;
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:53:31 GMT
Content-Length: 2707
GET /37/bg.jpg HTTP/1.1

Host: topskin.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://topskin.ir/37/style.css
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Date: Tue, 06 Nov 2012 01:54:20 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Etag: &quot;b7b-4c34d5b8-0&quot;
Last-Modified: Wed, 07 Jul 2010 19:30:00 GMT
Content-Length: 2939
Cache-Control: max-age=604800
Expires: Tue, 13 Nov 2012 01:54:20 GMT
GET /37/m.gif HTTP/1.1

Host: topskin.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://topskin.ir/37/style.css
 
HTTP/1.1 200 OK

Content-Type: image/gif

Date: Tue, 06 Nov 2012 01:54:20 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Etag: &quot;43e-4c34d5b8-0&quot;
Last-Modified: Wed, 07 Jul 2010 19:30:00 GMT
Content-Length: 1086
Cache-Control: max-age=604800
Expires: Tue, 13 Nov 2012 01:54:20 GMT
GET /close.gif HTTP/1.1

Host: persianbox.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 176
Last-Modified: Mon, 15 Nov 2010 10:23:44 GMT
Accept-Ranges: bytes
Etag: &quot;4193a12eaf84cb1:4208&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:54:04 GMT
GET /toolbar/bg.gif HTTP/1.1

Host: persianbox.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://persianblog.ir/Navbar.aspx?blogID=57140&amp;blogName=nargesi&amp;navbarColor=808080
 
HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 46
Last-Modified: Mon, 15 Nov 2010 10:25:40 GMT
Accept-Ranges: bytes
Etag: &quot;cd4bb473af84cb1:420a&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:54:04 GMT
GET /toolbar/pb-small.gif HTTP/1.1

Host: persianbox.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://persianblog.ir/Navbar.aspx?blogID=57140&amp;blogName=nargesi&amp;navbarColor=808080
 
HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1480
Last-Modified: Mon, 15 Nov 2010 10:28:20 GMT
Accept-Ranges: bytes
Etag: &quot;b7ecdbd2af84cb1:420a&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:54:04 GMT
GET /__utm.gif?utmwv=5.3.7&utms=1&utmn=1386603588&utmhn=nargesi.persianblog.ir&utmcs=UTF-8&utmsr=1176x885&utmvp=1159x778&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=10.0%20r45&utmdt=%D8%A7%D8%B2%20%D9%85%D9%86%20%D8%A8%D8%AE%D9%88%D8%A7%D9%87%20%DA%A9%D9%87%20%D8%A8%D8%A7%D8%B4%D9%85...&utmhid=723177345&utmr=-&utmp=%2F1389%2F5%2F16&utmac=UA-9749048-4&utmcc=__utma%3D224929925.901432470.1352166861.1352166861.1352166861.1%3B%2B__utmz%3D224929925.1352166861.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmu=qB~ HTTP/1.1

Host: www.google-analytics.com
GET /__utm.gif?utmwv=5.3.7&amp;utms=1&amp;utmn=1386603588&amp;utmhn=nargesi.persianblog.ir&amp;utmcs=UTF-8&amp;utmsr=1176x885&amp;utmvp=1159x778&amp;utmsc=24-bit&amp;utmul=en-us&amp;utmje=1&amp;utmfl=10.0%20r45&amp;utmdt=%D8%A7%D8%B2%20%D9%85%D9%86%20%D8%A8%D8%AE%D9%88%D8%A7%D9%87%20%DA%A9%D9%87%20%D8%A8%D8%A7%D8%B4%D9%85...&amp;utmhid=723177345&amp;utmr=-&amp;utmp=%2F1389%2F5%2F16&amp;utmac=UA-9749048-4&amp;utmcc=__utma%3D224929925.901432470.1352166861.1352166861.1352166861.1%3B%2B__utmz%3D224929925.1352166861.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&amp;utmu=qB~ HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: image/gif

Date: Thu, 01 Nov 2012 01:09:14 GMT
Content-Length: 35
X-Content-Type-Options: nosniff
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 434706
Server: GFE/2.0
GET /toolbar/left.gif HTTP/1.1

Host: persianbox.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://persianblog.ir/Navbar.aspx?blogID=57140&amp;blogName=nargesi&amp;navbarColor=808080
 
HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 57
Last-Modified: Mon, 15 Nov 2010 10:25:40 GMT
Accept-Ranges: bytes
Etag: &quot;4910b973af84cb1:420a&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:54:04 GMT
GET /toolbar/right.gif HTTP/1.1

Host: persianbox.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://persianblog.ir/Navbar.aspx?blogID=57140&amp;blogName=nargesi&amp;navbarColor=808080
 
HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 56
Last-Modified: Mon, 15 Nov 2010 10:28:20 GMT
Accept-Ranges: bytes
Etag: &quot;39d225d3af84cb1:420a&quot;
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:54:04 GMT
GET /s.aspx?pscn=0&pscr=-&psct=-&psep=0 HTTP/1.1

Host: persianbox.com
GET /s.aspx?pscn=0&amp;pscr=-&amp;psct=-&amp;psep=0 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 302 Found

Content-Type: text/html; charset=utf-8

Date: Tue, 06 Nov 2012 01:54:05 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Location: http://74.52.87.212/abmw.aspx?z=165&amp;isframe=true
Cache-Control: private
Content-Length: 169
GET /37/p2.jpg HTTP/1.1

Host: topskin.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://topskin.ir/37/style.css
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Date: Tue, 06 Nov 2012 01:54:20 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Etag: &quot;bd7-4c34d5b8-0&quot;
Last-Modified: Wed, 07 Jul 2010 19:30:00 GMT
Content-Length: 3031
Cache-Control: max-age=604800
Expires: Tue, 13 Nov 2012 01:54:20 GMT
GET /37/p1.jpg HTTP/1.1

Host: topskin.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://topskin.ir/37/style.css
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Date: Tue, 06 Nov 2012 01:54:20 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Etag: &quot;178f-4c34d5b8-0&quot;
Last-Modified: Wed, 07 Jul 2010 19:30:00 GMT
Content-Length: 6031
Cache-Control: max-age=604800
Expires: Tue, 13 Nov 2012 01:54:20 GMT
GET /online?u=moomikitty&m=g&t=1 HTTP/1.1

Host: opi.yahoo.com
GET /online?u=moomikitty&amp;m=g&amp;t=1 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: image/gif

Date: Tue, 06 Nov 2012 01:54:20 GMT
Set-Cookie: B=3ctsvtt89grec&amp;b=3&amp;s=3s; expires=Tue, 07-Nov-2014 20:00:00 GMT; path=/; domain=.yahoo.com
P3P: policyref=&quot;http://info.yahoo.com/w3c/p3p.xml&quot;, CP=&quot;CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV&quot;
Expires: Thu, 05 Jan 1995 22:00:00 GMT
Cache-Control: private
Connection: close
Transfer-Encoding: chunked
GET /js/plusone.js HTTP/1.1

Host: apis.google.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
Cookie: PREF=ID=18d07d2c5ecbbb08:U=205ee10a10512bfa:FF=0:TM=1350344350:LM=1350344627:S=oVTvNjgbzbFNBNUF; NID=64=UOjfkeau7k9dzmFvAsFwVqmD4s7g_bdUMaEnGOlKRSTKCit3R_G5xg2kMKTOgRf2IL0DzvimBbfFpj1mIHK6cKNk76wCsEyOlULvzyFq8aklSyHHGXGPdMpqcZCr8LfK
 
HTTP/1.1 200 OK

Content-Type: application/javascript; charset=utf-8

X-UA-Compatible: IE=edge, chrome=1
Etag: &quot;26816fd9182cadb8fccf1abb015f2c0a&quot;
Expires: Tue, 06 Nov 2012 01:54:21 GMT
Date: Tue, 06 Nov 2012 01:54:21 GMT
Cache-Control: private, max-age=1800
Content-Encoding: gzip
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
GET /Avatar/55858.png?rnd=40829.0776892593 HTTP/1.1

Host: www.persianblog.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Wed, 01 Jul 2009 18:58:51 GMT
Accept-Ranges: bytes
Etag: &quot;6ebf58f97dfac91:0&quot;
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:53:31 GMT
Content-Length: 31435
GET /37/top-l.jpg HTTP/1.1

Host: topskin.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://topskin.ir/37/style.css
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Date: Tue, 06 Nov 2012 01:54:20 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Etag: &quot;31f0-4c34d5b8-0&quot;
Last-Modified: Wed, 07 Jul 2010 19:30:00 GMT
Content-Length: 12784
Cache-Control: max-age=604800
Expires: Tue, 13 Nov 2012 01:54:20 GMT
GET /ftp/amar-ads/ads/musics/tabligh3.js HTTP/1.1

Host: bahar-20.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Encoding: gzip
Vary: Accept-Encoding
Date: Tue, 06 Nov 2012 01:54:22 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: close
Etag: &quot;52a-4e27000a-0&quot;
Last-Modified: Wed, 20 Jul 2011 16:19:22 GMT
Content-Length: 486
Cache-Control: max-age=604800
Expires: Tue, 13 Nov 2012 01:54:22 GMT
GET /_/apps-static/_/js/gapi/plusone/rt=j/ver=LVKXSTHtfNo.no./sv=1/am=!EjuVRaiyNaqIjBsSTg/d=1/rs=AItRSTMaHj7RZX2LeVz2LCZZ1iNU9jXqGw/cb=gapi.loaded_0 HTTP/1.1

Host: apis.google.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
Cookie: PREF=ID=18d07d2c5ecbbb08:U=205ee10a10512bfa:FF=0:TM=1350344350:LM=1350344627:S=oVTvNjgbzbFNBNUF; NID=64=UOjfkeau7k9dzmFvAsFwVqmD4s7g_bdUMaEnGOlKRSTKCit3R_G5xg2kMKTOgRf2IL0DzvimBbfFpj1mIHK6cKNk76wCsEyOlULvzyFq8aklSyHHGXGPdMpqcZCr8LfK
 
HTTP/1.1 200 OK

Content-Type: text/javascript; charset=UTF-8

Etag: &quot;1084316013&quot;
Expires: Mon, 03 Dec 2012 02:46:58 GMT
Date: Sat, 03 Nov 2012 02:46:58 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Cache-Control: public, max-age=2592000
Content-Length: 27793
Age: 256043
GET /abmw.aspx?z=165&isframe=true HTTP/1.1

Host: 74.52.87.212
GET /abmw.aspx?z=165&amp;isframe=true HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Date: Tue, 06 Nov 2012 01:54:34 GMT
Server: Microsoft-IIS/6.0
P3P: policyref=&quot;http://adsready.persianblog.com/w3c/p3p.xml&quot;, CP=&quot;NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA&quot;
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Set-Cookie: xlaABMclient=country=; path=/
Cache-Control: private
Content-Length: 938
GET /Stats.aspx?psid=40057140&psop=4&pscn=direct&pscr=-&psct=-&psep=-&psuq=0&psuu=0&psrd=1019313191&pscs=UTF-8&pswh=1176x885&pssc=24&psul=en-us&psje=1&pspl=1&pstl=%D8%A7%D8%B2%20%D9%85%D9%86%20%D8%A8%D8%AE%D9%88%D8%A7%D9%87%20%DA%A9%D9%87%20%D8%A8%D8%A7%D8%B4%D9%85...&pshn=nargesi.persianblog.ir&pspt=%2F1389%2F5%2F16&psrf=- HTTP/1.1

Host: service.persianstat.com
GET /Stats.aspx?psid=40057140&amp;psop=4&amp;pscn=direct&amp;pscr=-&amp;psct=-&amp;psep=-&amp;psuq=0&amp;psuu=0&amp;psrd=1019313191&amp;pscs=UTF-8&amp;pswh=1176x885&amp;pssc=24&amp;psul=en-us&amp;psje=1&amp;pspl=1&amp;pstl=%D8%A7%D8%B2%20%D9%85%D9%86%20%D8%A8%D8%AE%D9%88%D8%A7%D9%87%20%DA%A9%D9%87%20%D8%A8%D8%A7%D8%B4%D9%85...&amp;pshn=nargesi.persianblog.ir&amp;pspt=%2F1389%2F5%2F16&amp;psrf=- HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Date: Tue, 06 Nov 2012 01:54:05 GMT
Server: Microsoft-IIS/6.0
P3P: policyref=&quot;http://service.persianstat.com/w3c/p3p.xml&quot;, CP=&quot;NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA&quot;
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Length: 0
GET /37/top-r.jpg HTTP/1.1

Host: topskin.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://topskin.ir/37/style.css
 
HTTP/1.1 200 OK

Content-Type: image/jpeg

Date: Tue, 06 Nov 2012 01:54:20 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Etag: &quot;fc84-4c34d5b8-0&quot;
Last-Modified: Wed, 07 Jul 2010 19:30:00 GMT
Content-Length: 64644
Cache-Control: max-age=604800
Expires: Tue, 13 Nov 2012 01:54:20 GMT
GET /s2/oz/images/stars/po/Publisher/sprite4-a67f741843ffc4220554c34bd01bb0bb.png HTTP/1.1

Host: ssl.gstatic.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16
 
HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Thu, 13 Sep 2012 21:47:55 GMT
Date: Thu, 01 Nov 2012 01:08:52 GMT
Expires: Fri, 01 Nov 2013 01:08:52 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 21399
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 434730
GET /favicon.ico HTTP/1.1

Host: nargesi.persianblog.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: __utma=224929925.901432470.1352166861.1352166861.1352166861.1; __utmb=224929925.1.10.1352166861; __utmc=224929925; __utmz=224929925.1352166861.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); ___ptma=38213564; ___ptmb=38213564; ___ptmc=38213564
 
HTTP/1.1 200 OK

Content-Type: image/x-icon

Last-Modified: Mon, 18 Feb 2008 17:23:00 GMT
Accept-Ranges: bytes
Etag: &quot;0f2e0e85272c81:0&quot;
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:53:33 GMT
Content-Length: 3638
GET /get/flashplayer/update/current/xml/version_en_win_pl.xml HTTP/1.1

Host: fpdownload2.macromedia.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 200 OK

Content-Type: text/xml

Server: Apache
Last-Modified: Wed, 03 Oct 2012 19:48:11 GMT
Etag: &quot;289dff-26c-4cb2ceb2654c0&quot;
Accept-Ranges: bytes
Content-Length: 620
Date: Tue, 06 Nov 2012 01:54:22 GMT
Connection: keep-alive
GET /banners/smspersian/SMSpersian1.swf?url=http%3a%2f%2f74.52.87.212%2fabmc.aspx%3fb%3d2474%26z%3d165 HTTP/1.1

Host: 74.52.87.212

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://74.52.87.212/abmw.aspx?z=165&amp;isframe=true
Cookie: xlaABMclient=country=
 
HTTP/1.1 200 OK

Content-Type: application/x-shockwave-flash

Content-Length: 21221
Last-Modified: Wed, 01 Aug 2012 12:25:30 GMT
Accept-Ranges: bytes
Etag: &quot;a6f33dbde06fcd1:66c3&quot;
Server: Microsoft-IIS/6.0
P3P: policyref=&quot;http://adsready.persianblog.com/w3c/p3p.xml&quot;, CP=&quot;NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA&quot;
X-Powered-By: ASP.NET
Date: Tue, 06 Nov 2012 01:54:35 GMT
GET /02.swf HTTP/1.1

Host: djcat40.persiangig.ir

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://nargesi.persianblog.ir/1389/5/16