Security Basics mailing list archives
http requests getting redirected to coolsavings.com
From: Sonika Malhotra <sonikam () magnum barc ernet in>
Date: Wed, 19 May 2004 10:39:26 +0530
Hello List, I have a user-network which access the Internet through a proxy server (squid - 2.5-stable ) We are facing a problem since few days. Any request for commonly accessed sites like www.google.com,www.rediff.com, www.yahoo.com gets redirected to the www.coolsavings.com The TCPdump for a session is attached for reference.kindly give some pointers to How is this happening? The following attached file is client-pc to proxy-server communication.The extra contents( packet data contents) have been removed considereing the file size.(still it is 51K). From the client PC the site www.google.com is hit and the traffic dump is taken using the ngrep tool. Regards Sonika
filter: ip and ( host clientpc and host proxyserver and port 8080 ) ### T clientpc:34620 -> proxyserver:8080 [AP] GET http://www.google.com/ HTTP/1.1..Host: www.google.com..User-Agent: Mozi ### T proxyserver:8080 -> clientpc:34620 [AP] HTTP/1.0 302 Moved Temporarily..Location: http://www.google.co.in/..Content ###### T clientpc:34628 -> proxyserver:8080 [AP] GET http://www.google.co.in/ HTTP/1.1..Host: www.google.co.in..User-Agent: ###### T clientpc:34642 -> proxyserver:8080 [AP] GET http://www.google.co.in/images/hp3.gif HTTP/1.1..Host: www.google.co.in ##### T proxyserver:8080 -> clientpc:34628 [A] HTTP/1.0 200 OK..Content-Type: image/gif..Last-Modified: Mon, 22 Mar 2004 2 ## T proxyserver:8080 -> clientpc:34628 [A] !7l...@...... q....Cp...#...3l........6p(....$9n..q"......0......2|Pb....9. .l.q..@ $ \.P...'<n.@ b.....p..A....<8y2......D...H..... Q!C..N...q.......H @%C..%>xp......".....L.....p@.D..%<8..........HP....0h...../Cf$8@0..1,p$ .. ....JxpR........8....%<8q.E.....F.2F.....\..AC......q. () aT.....'N...q.... Q.l.q...4.,`.P....Zn.8P..@/.*d(....'gn.@ b`.-i...!f.....p...C..FB.(XP ...2. ### T clientpc:34628 -> proxyserver:8080 [AP] GET http://www.coolsavings.com/ HTTP/1.1..Host: www.coolsavings.com..User-A gent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20030225..Acc ept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/pl ain;q=0.8,video/x-mng,image/png,image/jpeg,image/gif;q=0.2,text/css,*/*;q=0 .1..Accept-Language: en-us, en;q=0.50..Accept-Encoding: gzip, deflate, comp ress;q=0.9..Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q=0.66..Keep-Alive: 300..Proxy-Connection: keep-alive..Proxy-Authorization: Basic c29uaWthbTol cm9nZXI3..Cookie: ASPSESSIONIDACQQADSQ=DNEBBKIAEDIABMKGONKCDGAA; ASPSESSION IDCARSCDQT=KBBPIKIAABBAKPEBGIHJBLBJ.... ## T proxyserver:8080 -> clientpc:34628 [AP] HTTP/1.0 302 Moved Temporarily..Date: Tue, 18 May 2004 09:39:19 GMT..Server : Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Location: http://www110.coolsav ings.com/scripts/first.aspx?&RefURL=..Content-Length: 182..Content-Type: te xt/html..Expires: Tue, 18 May 2004 09:39:19 GMT..Cache-Control: private..X- ## T proxyserver:8080 -> clientpc:34628 [AP] <head><title>Object moved</title></head>.<body><h1>Object Moved</h1>This ob ject may be found <a HREF="http://www110.coolsavings.com/scripts/first.aspx ?&RefURL=">here</a>.</body>. #### T clientpc:34641 -> proxyserver:8080 [AP] GET http://www110.coolsavings.com/scripts/first.aspx?&RefURL= HTTP/1.1..Hos t: www110.coolsavings.com..User-Agent: Mozilla/5.0 (X11; U; Linux i686; en- US; rv:1.2.1) Gecko/20030225..Accept: text/xml,application/xml,application/ xhtml+xml,text/html;q=0.9,text/plain;q=0.8,video/x-mng,image/png,image/jpeg ,image/gif;q=0.2,text/css,*/*;q=0.1..Accept-Language: en-us, en;q=0.50..Acc ept-Encoding: gzip, deflate, compress;q=0.9..Accept-Charset: ISO-8859-1, ut f-8;q=0.66, *;q=0.66..Keep-Alive: 300..Proxy-Connection: keep-alive..Proxy- Authorization: Basic c29uaWthbTolcm9nZXI3..Cookie: RndCookie=1391217342; AS PSESSIONIDQQRCCQDR=OHMABJKAEAKBDLGFAHDIFLDL.... # T proxyserver:8080 -> clientpc:34641 [AP] HTTP/1.0 302 Moved Temporarily..Date: Tue, 18 May 2004 09:38:51 GMT..Server : Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Loc ation: /scripts/welenroll.aspx?SessionID=1346014086&&RefURL=..Cache-Control : private..Expires: Tue, 18 May 2004 09:38:51 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 178..X-Cache: MISS from proxy-server n..Proxy-Connection: keep-alive.... ## T proxyserver:8080 -> clientpc:34641 [AP] <html><head><title>Object moved</title></head><body>..<h2>Object moved to < a href='/scripts/welenroll.aspx?SessionID=1346014086&&RefURL='>here </a>.</h2>..</body></html>.. #### T clientpc:34642 -> proxyserver:8080 [AP] GET http://www110.coolsavings.com/scripts/welenroll.aspx?SessionID=13460140 86&&RefURL= HTTP/1.1..Host: www110.coolsavings.com..User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20030225..Accept: text/xml,app lication/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,video/x -mng,image/png,image/jpeg,image/gif;q=0.2,text/css,*/*;q=0.1..Accept-Langua ge: en-us, en;q=0.50..Accept-Encoding: gzip, deflate, compress;q=0.9..Accep t-Charset: ISO-8859-1, utf-8;q=0.66, *;q=0.66..Keep-Alive: 300..Proxy-Conne ction: keep-alive..Proxy-Authorization: Basic c29uaWthbTolcm9nZXI3..Cookie: RndCookie=1391217342; ASPSESSIONIDQQRCCQDR=OHMABJKAEAKBDLGFAHDIFLDL.... # T proxyserver:8080 -> clientpc:34642 [AP] HTTP/1.0 200 OK..Date: Tue, 18 May 2004 09:38:51 GMT..Server: Microsoft-IIS /6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Control: no- cache..Pragma: no-cache..Expires: -1..Content-Type: text/html; charset=utf- nnection: keep-alive.... ### T proxyserver:8080 -> clientpc:34642 [A] ..<html>...<head>....<LINK REL="STYLESHEET" TYPE="text/css" HREF="/media/cs s/main.css">....<title>CoolSavings: Grocery Coupons, Online Coupons, Baby C oupons, Free Stuff, Free Samples - Print FREE Coupons</title>....<meta http -equiv="pragma" content="no-cache">....<script language="JavaScript">..var newWindow = null....var clientInterfaceExists = true;..function makeNewWind ow(fname,winname,w,h,t) {...if (String(t)=='no')....newWindow = window.open (fname,winname,"toolbar=" + t + ",scrollbars=yes,resizable=yes,width=" + w + ",height=" + h )...else....newWindow = window.open(fname,winname,"scrollb ars=yes,resizable=yes,menubar=yes,status=yes,toolbar=yes,personalbar=yes,lo cation=yes,hotkeys=yes,width=" + w + ",height=" + h )..} ....function Mouse OverColorChange() {...coolbrowser = ( (navigator.appName == "Microsoft Inte rnet Explorer") && (parseInt(navigator.appVersion) >= 4 ));...if ( coolbrow ser ) {....document.body.onmouseover=HighlightIt;....document.body.onmouseo ut=UnHighlightIt;...}..}....function setCSHomePage (HomePage, link) ..{.. flag=0.. HomePage.style.behavior='url(#default#homepage)'; .. HomePage .setHomePage('http://www.coolsavings.com'); // jjkxxx.. parent.location=l ink;..}....function ClearFields() { ...document.forms[0].UserName.value = " ";...document.forms[0].LoginPassword.value = "";...document.location = "#to p";...}....</script>....<script language="JavaScript">..function rootUpdate () {}....</script>...</ ## T proxyserver:8080 -> clientpc:34642 [A] head>...<body bgcolor="#ffffff" onLoad='' onUnload='javascript:return PopUp Leave()' marginwidth="0" marginheight="0" topmargin="0" leftmargin="0" text ="#660099" link="#663399" vlink="#9900ff" alink="#ff3300">....<form name="_ ctl0" method="post" action="welenroll.aspx?SessionID=1346014086&&Re fURL=" id="_ctl0" onSubmit="flag=0">..<input type="hidden" name="__VIEWSTAT E" value="dDwxOTQ2NjA1MjQ1O3Q8O2w8aTwwPjs+O2w8dDw7bDxpPDI4PjtpPDM0PjtpPDM2P js+O2w8dDxwPHA8bDxJbWFnZVVybDs+O2w8aHR0cDovL2ltZzEwLmNvb2xzYXZpbmdzLmNvbS9t ZWRpYS9iX3N1Ym1pdC5naWY7Pj47Pjs7Pjt0PHA8cDxsPEltYWdlVXJsOz47bDxodHRwOi8vaW1 nMTAuY29vbHNhdmluZ3MuY29tL21lZGlhL2JfbG9nb24uZ2lmOz4+Oz47Oz47dDw7bDxpPDA+Oz 47bDx0PHA8bDxWaXNpYmxlOz47bDxvPGY+Oz4+Ozs+Oz4+Oz4+Oz4+O2w8UmVnQnV0dG9uO1Nhd mVMb2dpblllcztTYXZlTG9naW5ObztTYXZlTG9naW5ObztMb2dpbjs+PsBeMpxVQqN6xmAO7/vI IAkJJv+r" />...<script language=JavaScript>.flag = 1;.function PopUpLeave() {..if (flag==1) ..{ ...open('http://www110.coolsavings.com/scripts/PopUpWin dow.asp?SessionID=1346014086&WindowID=121&pwTabID=0&pwTagID=127&pwTagTypeID =23','PopUpLeave','width=250,height=250,resizable=no,toolbar=no,scrollbars= no,menubars=no'); ..} .}.function SetFlagtoZero(){ flag = 0; }.</script>... .......<script language="JavaScript"> ....coolbrowser = ( (navigator.appNam e == "Microsoft Internet Explorer") && ....(parseInt(navigator.appVersion) >= 4 )); ....if ( coolbrowser ) ....{ .....document.body.onmouseover=Highl ightIt; .....document.b ### T proxyserver:8080 -> clientpc:34642 [AP] ody.onmouseout=UnHighlightIt; ....} ....function HighlightIt() ....{ if ( c oolbrowser ) .....{.src = event.toElement ......if (src.tagName == "A") ... ....{.src.oldcol = src.style.color ........src.style.color = "339900" } ... ..} ....} ....function UnHighlightIt() ....{ if ( coolbrowser ) .....{.src =event.fromElement ......if (src.tagName == "A") ......{ src.style.color = src.oldcol } .....} ....} .....</script>.....<a name="top"></a>......<tabl e width="100%" border="0" cellspacing="0" cellpadding="0" bgcolor="#d7eda9" >.......<tr>........<td align="middle">.........<table width="750" border=" 0" cellspacing="0" cellpadding="0">..........<tr>...........<td width="376" valign="bottom">............<table width="100%" border="0" cellspacing="0" cellpadding="0">.............<tr>..............<td width="91" valign="bott om"><img src="http://img10.coolsavings.com/media/csavLogo001a.gif"; width="9 1" height="96" alt="Welcome to CoolSavings.com!"></td>..............<td val ign="bottom"><img src="http://img10.coolsavings.com/media/intro_sam1_text.g if" width="282" height="60" alt="Welcome to CoolSavings.com!"></td>........ .....</tr>............</table>...........</td>...........<td align="middle" ### T proxyserver:8080 -> clientpc:34642 [A] ><img src="http://img10.coolsavings.com/media/tagline.gif"; width="300" heig ht="17" vspace="2" alt="Fun & Free place to print coupons!">........... .<table width="90%" border="0" cellspacing="0" cellpadding="0">............ .<tr align="middle">..............<td><img src="http://img10.coolsavings.co m/media/pic_005.gif" width="74" height="75" alt="picture 01"></td>......... .....<td><img src="http://img10.coolsavings.com/media/pic_006.gif"; width="7 4" height="75" alt="picture 02"></td>..............<td><img src="http://img 10.coolsavings.com/media/pic_010.gif" width="74" height="75" alt="picture 0 3"></td>..............<td><img src="http://img10.coolsavings.com/media/pic_ 013.gif" width="74" height="75" alt="picture 04"></td>.............</tr>... .........</table>...............</td>............</tr>.........</table>.... ....</td>.......</tr>.......<tr>........<td align="middle" background="http ://img10.coolsavings.com/media/bg_line01.gif"><img src="http://img10.coolsa vings.com/media/spacer.gif" width="1" height="2"></td>.......</tr>......</t able>......<!--Start of main shell table-->........ <table width="660" bor der="0" align="center" cellpadding="0" cellspacing="0">...<!--Begin row 1 o f shell-->...<tr>....<td width="278" colspan="2" align="middle" valign="top " rowspan="6">.....<table width="100%" border="0" cellpadding="0" cellspaci ng="0">......<tr>.......<td colspan="2"><font face="Arial, Helvetica, sans- serif" color="#990000" ### T proxyserver:8080 -> clientpc:34642 [A] size="2"><b></b></font></td>......</tr>......<tr>.......<td width="10"><img src="http://img10.coolsavings.com/media/spacer.gif"; width="10" height="14" ></td>.......<td align="center"><font face="Arial, Helvetica, sans-serif" s ize="2">.........<BR>...<TABLE cellSpacing="0" cellPadding="0" align="cente r" border="0" ID="Table1">....<TR>.....<TD><IMG height=124 src="http://img1 0.coolsavings.com/media/couponSample07a.gif" width=82></TD>.....<TD align=" middle"><IMG height=124 alt="Save money with tons of coupons you can print from your computer every time you go shopping!" src="http://img10.coolsavin gs.com/media/couponSample06b.gif" width=195 ></TD>....</TR>...</TABLE>..<BR >...........</font>.......</td>......</tr>..................<tr>.......<td width="10"> </td>.......<td>........<table border="0" cellspacing="2" cellpadding="0">.........<tr bgcolor="#ffffff">..........<td>..<!--Begin Ch eckmark Table -->...................<table width="100%" cellspacing="0" cel lpadding="0" align="center">.......... <tr>.. <td><img src="http://img10.coolsavings.com/media/header_SaveBigWith. gif" width="204" height="34" hspace="1"></td>.. </tr>.. <tr>.. <td><img src="http://img10.coolsavings.com/media/spacer_s_yel low.gif" width="100%" height="2" hspace="2"></td>.. </tr>.. #### T proxyserver:8080 -> clientpc:34642 [A] <tr>.. <td>< img src="http://img10.coolsavings.com/media/spacer.gif"; width="20" height=" 4"></td>.. </tr>.. <tr>.. <td align="center"><tab le border="0" cellspacing="2" cellpadding="0">.. <tr>.. <td><img src=" http://img10.coolsavings.com/media/intro_grocery_100.jpg"; width="100" heigh t="100"></td>.. <td><img src="http ://img10.coolsavings.com/media/intro_pets_100.jpg" width="100" height="100" ></td>.. <td><img src="http://img1 0.coolsavings.com/media/intro_free_100.jpg" width="100" height="100"></td>. . </tr>.. <tr align="center" bgcolor="#660099">.. <td><img src="http://img10.coolsavings.com/media/intro_g rocery_text.gif" alt="Grocery Coupons" width="100" height="50"></td>.. <td><img src="http://img10.coolsaving s.com/media/intro_pet_text.gif" alt="Pet Coupons" width="100" height="50">< /td>.. <td><img src="http://img10. coolsavings.com/media/intro_free_text.gif" alt="Free Stuff" width="100" hei ght="50"></td>.. ## T proxyserver:8080 -> clientpc:34642 [A] </tr>.. <tr>.. <td><img src="http://i mg10.coolsavings.com/media/intro_baby_100.jpg" width="100" height="100"></t d>.. <td><img src="http://img10.co olsavings.com/media/intro_travel_100.jpg" width="100" height="100"></td>.. <td><img src="http://img10.coolsav ings.com/media/intro_beauty_100.jpg" width="100" height="100"></td>.. </tr>.. <tr bgcolor="#660099">.. <td ><img src="http://img10.coolsavings.com/media/intro_baby_text.gif"; alt="Bab y Coupons" width="100" height="50"></td>.. <td><img src="http://img10.coolsavings.com/media/intro_travel_text .gif" alt="Travel Deals" width="100" height="50"></td>.. <td><img src="http://img10.coolsavings.com/media/int ro_beauty_text.gif" alt="Beauty Coupons" width="100" height="50"></td>.. </tr>.. </table></td>.. </tr>.. </table>............<!--Closes the Checkmark table-->.... .....<tr> ......... <td> ..........<!--Begin already member table-->...... ....<table width="100%" ### T proxyserver:8080 -> clientpc:34642 [A] border="0" cellpadding="2" cellspacing="0" bgcolor="#FFFFFF">.. .<tr>.. . <td><img src ="http://img10.coolsavings.com/media/spacer_s_yellow.gif"; width="100%" heig ht="2"></td>.. ..</tr>.. .<tr>.. ..<td height="36" nowra p><font face="Arial, Helvetica, sans-serif" size="2"><b>Already a Member? < a href="#memberlogin">Click Here to log on</a></b></font> </td>.. .</tr>.. </table>..... .....<!--End already member border--> .........</td> ........</tr> ........ .</table>.......</td>......</tr>......</table>........</td>........<!--Midd le column of main shell-->........<td width="2%" rowspan="4"> </td>... .....<br>........<td width="320" align="left" valign="top" bgcolor="#ffeda6 ">.........<table border="0" cellspacing="0" cellpadding="0" width="100%" b gcolor="#ffeda6" align="center">..........<tr>...........<td align="left" v align="top" width="9"><img src="http://img10.coolsavings.com/media/corner_F FEDA6_01.gif" width="9" height="9"></td>...........<td><img src="http://img 10.coolsavings.com/media/spacer.gif" width="1" height="1"></td>...........< td align="right" valign="top" width="9"><img src="http://img10.coolsavings. com/media/corner_FFEDA6_02.gif" width="9" height="9"></td>..........</tr>.. .......</table>........ ### T proxyserver:8080 -> clientpc:34642 [A] </td>.......</tr>.......<tr>........... <td width="320" align="right" vali gn="top" bgcolor="#ffeda6"> <table width="100%" bgcolor="#ffeda6" cellpaddi ng="3" cellspacing="0" border="0">.... <tr> .....<td valign="top" align="l eft"> </td>.....<td valign="top" align="left"><font face="Arial, Helve tica" size="2">One minute to enroll <br>will get you a lifetime of savings! </font></td>.... </tr>.... <tr> .....<td valign="top" align="left"> </td>..........<td valign="MIDDLE" align="LEFT" ><a href="https://www110.co olsavings.com/scripts/welenroll.aspx?OpType=intro&&RefURL=&SessionID=134601 4086" target="_top" onClick="flag=0"><img src="http://img10.coolsavings.com /media/b_ssl_no.gif" width="22" height="22" align="ABSMIDDLE" vspace="2" bo rder="0" alt="enable secure enrollment" hspace="3"><font face="Verdana, Ari al, Helvetica, sans-serif" size="1">enable ..... secure enrollment</font>< /a></td>......... </tr>.... <tr> .....<td align="middle" colspan="3">.... .... <tr> .....<td valign="top" align="left"> </td>.....<td width=" 320" valign="top" align="left" bgcolor="#ffeda6" colspan="2"><font face="Ar ial, Helvetica" size="2"><b><font color="#ff3300" face="Verdana, Arial, Hel vetica, sans-serif" size="1">*</font></b></font><font face="Verdana, Arial, Helvetica, sans-serif" size="1"> ..... required fields</font></td>.... < /tr>.... <tr><td colspan="3"></td></tr>.... <tr> .....<td valign="top" al ign="left"></td>.....<t ### T proxyserver:8080 -> clientpc:34642 [A] d valign="top" align="left" colspan="2"><font face="Arial, Helvetica" size= "2"><b>First ..... Name<font color="#ff3300">*</font> <br>..... <input na me="FirstName" type="text" maxlength="20" size="20" id="FirstName" />..... </b></font> </td>.....<td valign="top" align="left" rowspan="3"> </t d>.... </tr>.... <tr><td colspan="3"></td></tr>.... <tr> .....<td valig n="top" align="left"> </td>.....<td valign="top" align="left" colspan="2">< font face="Arial, Helvetica" size="2"><b>Last ..... Name<font color="#ff33 00">*</font></b><br>..... <b> ..... <input name="LastName" type="text" ma xlength="30" size="20" id="LastName" />..... </b></font> </td>.... </tr>. ... <tr><td colspan="3"></td></tr>.... <tr> .....<td valign="top" align= "left"></td>.....<td valign="top" align="left" colspan="2"><font face="Aria l, Helvetica, sans-serif" size="2"><b>Address<font color="#ff3300">*</font> <br>..... <input name="Address" type="text" maxlength="30" size="20" id="A ddress" />..... </b></font> </td>.... </tr>.... <tr><td colspan="3"></t d></tr>.... <tr> .....<td valign="top" align="left"> </td>.....<td valign= "top" align="left" colspan="2"><font face="Arial, Helvetica, sans-serif" si ze="2"><b>City</b><font color="#ff3300">*</font></font><br> ..... <input n ame="City" type="text" maxlength="39" size="20" id="City" /> .....</td>.... </tr>.... <tr><td colspan="3"> ..... </td></tr>.... <tr> .....<td val ign="top" align="left"> ### T proxyserver:8080 -> clientpc:34642 [A] </td>.....<td valign="top" align="left" colspan="2"> <table border="0" cell padding="0" cellspacing="0">......<tr> ...... <td><font face="Arial, Helve tica, sans-serif" size="2"><b>State<font color="#ff3300">*</font></b></font ><br> ...... </td>...... <td><img src="http://img10.coolsavings.com/media /spacer.gif" width="20" height="1"></td>...... <td><font face="Arial, Helv etica" size="2"><b>Zip<font color="#ff3300">*</font></b></font><br> ...... </td>......</tr>......<tr> ...... <td> <select name="State" id="State">.. .<option selected="selected" value="">Select</option>...<option value="AK"> AK</option>...<option value="AL">AL</option>...<option value="AR">AR</optio n>...<option value="AZ">AZ</option>...<option value="CA">CA</option>...<opt ion value="CO">CO</option>...<option value="CT">CT</option>...<option value ="DC">DC</option>...<option value="DE">DE</option>...<option value="FL">FL< /option>...<option value="GA">GA</option>...<option value="HI">HI</option>. ..<option value="IA">IA</option>...<option value="ID">ID</option>...<option value="IL">IL</option>...<option value="IN">IN</option>...<option value="K S">KS</option>...<option value="KY">KY</option>...<option value="LA">LA</op tion>...<option value="MA">MA</option>...<option value="ME">ME</option>...< option value="MD">MD</option>...<option value="MI">MI</option>...<option va lue="MO">MO</option>...<option value="MN">MN</option>...<option value="MS"> MS</option>...<option v ### T proxyserver:8080 -> clientpc:34642 [A] alue="MT">MT</option>...<option value="NC">NC</option>...<option value="ND" >ND</option>...<option value="NE">NE</option>...<option value="NH">NH</opti on>...<option value="NJ">NJ</option>...<option value="NM">NM</option>...<op tion value="NV">NV</option>...<option value="NY">NY</option>...<option valu e="OH">OH</option>...<option value="OK">OK</option>...<option value="OR">OR </option>...<option value="PA">PA</option>...<option value="RI">RI</option> ...<option value="SC">SC</option>...<option value="SD">SD</option>...<optio n value="TN">TN</option>...<option value="TX">TX</option>...<option value=" UT">UT</option>...<option value="VA">VA</option>...<option value="VT">VT</o ption>...<option value="WA">WA</option>...<option value="WI">WI</option>... <option value="WV">WV</option>...<option value="WY">WY</option>....</select > </td>...... <td> <img src="http://img10.coolsavings.com/media/spacer.gif " width="20" height="1"></td>...... <td> <input name="Zipcode" type="text" maxlength="5" size="6" id="Zipcode" /> ...... </td>......</tr>..... </ta ble></td>.... </tr>.... <tr><td colspan="3"> </td></tr>.... <tr> .....< td valign="top" align="left"></td>.....<td valign="top" align="left" colspa n="2"> <table width="75%" border="0" cellpadding="0" cellspacing="0">...... <tr> ...... <td valign="top" align="left" colspan="2"><font face="Arial, H elvetica" size="2"><b>Your Gender<font color="#ff3300">*</font></b></f ont></td>...... <td va ### T proxyserver:8080 -> clientpc:34642 [A] lign="top" align="left"><img src="http://img10.coolsavings.com/media/spacer .gif" width="20" height="1"></td>...... <td valign="top" align="left" cols pan="2"><font face="Arial, Helvetica" size="2"><b>Have Children?</b></ font></td>......</tr>......<tr> ...... <td valign="top" align="left" colsp an="2"> <select name="Gender" id="Gender">...<option selected="selected" va lue="">Select</option>...<option value="M">male</option>...<option value="F ">female</option>....</select> </td>...... <td valign="top" align="left">< img src="http://img10.coolsavings.com/media/spacer.gif"; width="20" height=" 1"></td>...... <td valign="top" align="left" colspan="2"> <select name="Nu mChildren" id="NumChildren">...<option selected="selected" value="-1">selec t</option>...<option value="0">0</option>...<option value="1">1</option>... <option value="2">2</option>...<option value="3">3</option>...<option value ="4">4</option>...<option value="5">5+</option>....</select> </td>......</t r>..... </table></td>.... </tr>.... <tr><td colspan="3"> </td></tr>.... <tr> .....<td valign="top" align="left"></td>.....<td valign="top" align= "left" colspan="2"><font face="Arial, Helvetica" size="2"><b>Birthday</b><f ont color="#ff3300">*</font></font> ..... <br> <table cellspacing="0" cell padding="0">......<tr> ...... <td align="left"> <select name="BirthMonth" id="BirthMonth">...<option selected="selected" value="">Select</option>...< option value="1">Jan</o ### T proxyserver:8080 -> clientpc:34642 [A] ption>...<option value="2">Feb</option>...<option value="3">Mar</option>... <option value="4">Apr</option>...<option value="5">May</option>...<option v alue="6">Jun</option>...<option value="7">Jul</option>...<option value="8"> Aug</option>...<option value="9">Sep</option>...<option value="10">Oct</opt ion>...<option value="11">Nov</option>...<option value="12">Dec</option>... .</select> </td>...... <td align="left"> <input name="BirthDa yOfMonth" type="text" maxlength="2" size="2" id="BirthDayOfMonth" /> ...... </td>...... <td align="left"> <input name="BirthYear" type= "text" maxlength="4" size="4" id="BirthYear" /> ...... </td>......</tr>... ...<tr> ...... <td align="left"><font face="Verdana, Arial, Helvetica" siz e="1" color="#804040">month</font></td>...... <td align="left"><font face= "Verdana, Arial, Helvetica" size="1" color="#804040"> .......da y</font></td>...... <td align="left"><font face="Verdana, Arial, Helvetica " size="1" color="#804040"> .......year</font></td>......</tr>. .... </table></td>.... </tr>.... <tr><td colspan="3"></td></tr>.... <t r> .....<td valign="top" align="left"> </td>.....<td valign="top" align="le ft" colspan="2">..... <table width="97%" border="0" cellspacing="0" cellpa dding="0">......<tr>...... <td><p><font face="Arial, Helvetica" size="2">< b>E-mail ......Address<font color="#ff3300">*</font></b></font><br>......<i nput name="Email" type= ### T proxyserver:8080 -> clientpc:34642 [A] "text" maxlength="80" size="20" id="Email" />..... <br></td>......</tr>.... ..<tr>...... <td><font face="Arial, Helvetica" size="2"><b><nobr>Periodic ..... e-mail offers from coolsavings.com?</nobr></b></font> <select name= "EmailOptions" id="EmailOptions">...<option value="1">yes, just text</optio n>...<option selected="selected" value="2">yes, with graphics (HTML) ...... </option>...<option value="0">no </option>....</select></td>......</tr>.... . </table>....</td>.... </tr>.... .... <tr>.....<td colspan="3"></td>... . </tr>.... <tr> .....<td valign="top" align="left"> </td>.....<td valign="top" align="left" colspan="2"><font face="Arial, Helvetica" size="2 "><b>Create ..... Password<font color="#ff3300">*</font></b></font> <br> < input name="Password1" type="password" maxlength="21" size="20" id="Passwor d1" /> .....</td>.... </tr>.... <tr> .....<td valign="top" align="left">& nbsp;</td>.....<td valign="top" align="left" colspan="2"><font face="Arial, Helvetica" size="2"><b>Confirm ..... Password<font color="#ff3300">*</fon t></b></font> <br> <input name="Password2" type="password" maxlength="21" s ize="20" id="Password2" /> .....</td>.... </tr>.... <tr> .....<td valign= "top" align="left"> </td>.....<td valign="top" align="left" colspan="2 "><font face="Arial, Helvetica" size="2"><b>Save ..... password?</b></font ><br> <select name="AutoLogin" id="AutoLogin">...<option selected="selected " value="true">yes</opt ### T proxyserver:8080 -> clientpc:34642 [A] ion>...<option value="false">no</option>....</select> <font face="Verdana, Arial, Helvetica" size=1> ..... <a href="JavaScript:makeNewWindow('http:// coolsavings.custhelp.com/cgi-bin/coolsavings.cfg/php/enduser/std_alp.php?p_ search_text=password','techsupport',750,400,'yes')"><img src="http://img10. coolsavings.com/media/bullet_faq.gif" width="18" height="15" border="0" alt ="help" align="absmiddle" hspace="2"></a> ..... <a href="JavaScript:makeNe wWindow('http://coolsavings.custhelp.com/cgi-bin/coolsavings.cfg/php/enduse r/std_alp.php?p_search_text=password','techsupport',750,400,'yes')">tell .. ... me more</a> </font> </td>.... </tr>.... <tr> .....<td valign="center " align="middle"> </td>.....<td valign="center" align="middle" colspan ="2"><input type="image" name="RegButton" onclick="if (typeof(Page_ClientVa lidate) == 'function') Page_ClientValidate(); " language="javascript" id="R egButton" src="http://img10.coolsavings.com/media/b_submit.gif"; alt="submit " border="0" style="height:25px;width:75px;" />..... <br> </td>.... </tr> .... <tr> .....<td valign="top" align="left"> </td>.....<td valign="t op" align="left" colspan="2"><font face="Verdana, Arial, Helvetica" color=" #660099" size="1"> .....Laser, ink or bubble jet printer required to print coupons. No printer is necessary to take advantage of other offers. CoolSav ings offers are for use in the U.S. only. Sharing your postal address with us will enable you to r ### T proxyserver:8080 -> clientpc:34642 [A] eceive valuable money-saving offers from our partners by mail.</font><br> . ....</td>.... <tr> .....<td valign="top" align="left"> </td>.....<td valign="top" align="left" colspan="2"> <table width="90%" border="0" cellsp acing="0" cellpadding="0" align="center">......<tr valign="top"> ...... <t d align="middle" width="50%"> <a href="JavaScript:makeNewWindow('guarantee. asp?SessionID=1346014086','guarantee',550,300,'no')"> .......<img src="http ://img10.coolsavings.com/media/TRUSTe.gif" width="116" height="31" border=" 0" alt="reviewed by TRUSTe" vspace="4"></a><br> .......<font face="Verdana, Arial, Helvetica, sans-serif" size="1"><a href="JavaScript:makeNewWindow(' guarantee.asp?SessionID=1346014086','guarantee',550,300,'no')"> .......Priv acy Policy</a></font></td>...... <td align="middle"> <a href="http://www.b bbonline.org/cks.asp?id=101110211354419987" target="_blank"><img src="http: //img10.coolsavings.com/media/ReliabilitySeal4.gif" width="90" height="31" vspace="4" border="0" alt="BBB OnLine Reliability Program"></a><br> ...... .<font face="Verdana, Arial, Helvetica, sans-serif" size="1"><a href="http: //www.bbbonline.org/cks.asp?id=101110211354419987" target="_blank"> ....... Reliability Program</a> </font> </td>......</tr>..... </table></td>.... < /tr>....</table></td>.......</tr>.......<tr>........<td valign="bottom" ali gn="right" bgcolor="#ffeda6"><img src="http://img10.coolsavings.com/media/c orner_FFEDA6_03.gif" wi ## T proxyserver:8080 -> clientpc:34642 [A] dth="12" height="12"></td>.......</tr>.......<tr>........<td width="320" va lign="bottom" align="right"> </td>.......</tr>......</table>......<tab le border="0" cellspacing="0" cellpadding="0" align="center">.......<tr ali gn="middle">........<td><img src="http://img10.coolsavings.com/media/spacer _s_yellow.gif" width="100%" height="1" vspace="4"></td>.......</tr>.......< tr align="middle">........<td>.........<nobr>......... <a href="JavaScript :makeNewWindow('http://coolsavings.custhelp.com','support',750,500,'yes')" class="csi-10px-link" onClick="flag=0">member......... support</a> ....... ..| <a href="JavaScript:makeNewWindow('http://www110.coolsavings.com/script s/guarantee.asp?SessionID=1346014086','guarantee',550,300,'no')" class="csi -10px-link" onClick="flag=0">privacy.........policy</a> .........| <a href= "http://info.coolsavings.com/news/index.asp?CS=http%3A%2F%2Fjjkxxx%2Ecoolsa vings%2Ecom%2Fscripts%2FWelenroll%2Easp%3FSessionID%3D1346014086" class="cs i-10px-link" onClick="flag=0">company.........news</a> .........| <a href=" http://phx.corporate-ir.net/phoenix.zhtml?c=120944&p=irol-irhome"; class="cs i-10px-link" onClick="flag=0">investor.........relations</a> .........| <a href="http://careers.coolsavings.com"; class="csi-10px-link" onClick="flag=0 "> jobs</a> .........</nobr>........</td>.......</tr>.......<tr align="midd le">........<td class="csav_blackSmall">.........<nobr><a href="http://affi liates.coolsavings.com/ # T proxyserver:8080 -> clientpc:34642 [A] affiliate/affiliate.asp?SessionID=1346014086&currIsland=www110" class=" csi-10px-link" onClick="flag=0">............become a coolsavings.com affili ate</a> | <a href="business.asp?SessionID=1346014086" class="csi-10px-link" onClick="flag=0">............partner opportunities</a> | <a href="http://i nfo.coolsavings.com/mediakit/contact_us.asp?tab=4&view=2&ref=2& serv=jjkxxx&sID=jjkxxx&Page=/scripts/Welenroll.asp" class="csi-10px -link" onClick="flag=0">............advertise on coolsavings.com</a></nobr> ........</td>.......</tr>.......<tr>........<td><img src="http://img10.cool savings.com/media/spacer.gif" width="2" height="10"></td>.......</tr>...... .<tr>........<td align="middle">.........<table>..........<tr>...........<t d class="csi-black-10px"><img src="http://img10.coolsavings.com/media/copyr ight.gif" width="120" height="32" align="left" border="0" alt="..Copyright CoolSavings, Inc. 1996-2004">covered .............by United States patent n umber: 5,761,648, also patents<br>.............pending yellow & purple are trademark colors of CoolSavings, Inc.</td>..........</tr>.........</tab le>........</td>.......</tr>......</table>......<script language="JAVASCRIP T">..if (typeof(clientInterfaceExists) != "undefined" && clientInterfaceExi sts == true)...MouseOverColorChange();......</script>......<p> </p>... ...<img src="http://img10.coolsavings.com/media/spacer.gif"; width="1" heigh t="2000"><br>..<table w # T proxyserver:8080 -> clientpc:34642 [A] idth="100%" border="0" cellspacing="0" cellpadding="0" bgcolor="#d7eda9">.. .....<tr>........<td><a name="memberlogin"></a></td>.......</tr>.......<tr> ........<td align="middle">.........<table width="750" border="0" cellspaci ng="0" cellpadding="0">..........<tr>...........<td width="376" valign="bot tom">............<table width="100%" border="0" cellspacing="0" cellpadding ="0">.............<tr>..............<td width="91" valign="bottom"><img src ="http://img10.coolsavings.com/media/csavLogo001a.gif"; width="91" height="9 6" alt="Welcome to CoolSavings.com!"></td>..............<td valign="bottom" ><img src="http://img10.coolsavings.com/media/intro_sam1_text.gif"; width="2 82" height="60" alt="Welcome to CoolSavings.com!"></td>.............</tr>.. ..........</table>...........</td>...........<td align="middle"><img src="h ttp://img10.coolsavings.com/media/tagline.gif" width="300" height="17" vspa ce="2" alt="Fun & Free place to print coupons!">............<table widt h="90%" border="0" cellspacing="0" cellpadding="0">.............<tr align=" middle">..............<td><img src="http://img10.coolsavings.com/media/pic_ 005.gif" width="74" height="75" alt="picture 01"></td>..............<td><im g src="http://img10.coolsavings.com/media/pic_006.gif"; width="74" height="7 5" alt="picture 02"></td>..............<td><img src="http://img10.coolsavin gs.com/media/pic_010.gif" width="74" height="75" alt="picture 03"></td>.... ..........<td><img src= # T proxyserver:8080 -> clientpc:34642 [A] "http://img10.coolsavings.com/media/pic_013.gif"; width="74" height="75" alt ="picture 04"></td>.............</tr>............</table>...........</td>.. ........</tr>.........</table>........</td>.......</tr>.......<tr>........< td align="middle" background="http://img10.coolsavings.com/media/bg_line01. gif"><img src="http://img10.coolsavings.com/media/spacer.gif"; width="1" hei ght="2"></td>.......</tr>......</table>......<br>......... <table width="35 0" border="0" align="center" cellpadding="2" cellspacing="0" bgcolor="#FFED A6">..... .<tr>.. ..<td bgcolor="#FFFFFF"> </td>.. ..<td cols pan="2" bgcolor="#660099"> <a href="JavaScript:makeNewWindow('http://coolsa vings.custhelp.com/cgi-bin/coolsavings.cfg/php/enduser/std_alp.php?p_search _text=login','login',750,400,'yes')"><img src="http://img10.coolsavings.com /media/bullet_faq_inv.gif" width="18" height="15" align="RIGHT" border="0"> </a><font face="Arial, Helvetica, sans-serif" size="2" color="#FFFFCC"><b>m ember login</b></font> </td>.. ..<td bgcolor="#FFFFFF"> </td>.. . .</tr>.. .<tr>.. ..<td bgcolor="#FFFFFF"><img src="http://img10.cools avings.com/media/spacer.gif" width="1" height="6"></td>.. ..<td colspan= "2"><img src="http://img10.coolsavings.com/media/spacer.gif"; width="1" heig ht="6"></td>.. ..<td bgcolor="#FFFFFF"><img src="http://img10.coolsaving s.com/media/spacer.gif" width="1" height="6"></td>.. ..</tr>.. .<tr>.. ..<td bgcolor="#FFF # T proxyserver:8080 -> clientpc:34642 [A] FFF"> </td>.. ..<td colspan="2" align="middle">.. ...<table wid th="94%" border="0" align="center" cellpadding="0" cellspacing="0" bgcolor= "#ffffff">.. ....<tr>.. .....<td align="left" valign="top" width="4"> <img src="http://img10.coolsavings.com/media/corner_member_01a.gif"; width=" 4" height="4"></td>.. .....<td><img src="http://img10.coolsavings.com/me dia/spacer.gif" width="1" height="4"></td>.. .....<td align="right" vali gn="top" width="4"><img src="http://img10.coolsavings.com/media/corner_memb er_02a.gif" width="4" height="4"></td>.. .....</tr>.. ....<tr>.. .. ...<td width="4"><img src="http://img10.coolsavings.com/media/spacer.gif"; w idth="4" height="1"></td>.. .....<td nowrap align="middle"><font face="A rial, Helvetica, sans-serif" size="2"><b><font color="#990000">Lost.Your Pa ssword? </font><a href="JavaScript:makeNewWindow('forgot.asp','forgot',325, 240,'no')"> Click Here</a></b></font></td>.. .....<td width="4"><img src ="http://img10.coolsavings.com/media/spacer.gif"; width="4" height="1"></td> .. .....</tr>.. ....<tr>.. .....<td width="4" align="left" valign=" bottom"><img src="http://img10.coolsavings.com/media/corner_member_04a.gif"; width="4" height="4"></td>.. .....<td><img src="http://img10.coolsaving s.com/media/spacer.gif" width="1" height="4"></td>.. .....<td align="rig ht" valign="bottom" width="4"><img src="http://img10.coolsavings.com/media/ corner_member_03a.gif" # T proxyserver:8080 -> clientpc:34642 [A] width="4" height="4"></td>.. .....</tr>.. ....</table>.. ...</td>.. ..<td bgcolor="#FFFFFF"> </td>.. ..</tr>.. .<tr>.. ..<td b gcolor="#FFFFFF"><img src="http://img10.coolsavings.com/media/spacer.gif"; w idth="1" height="6"></td>.. ..<td colspan="2" align="middle"><img src="h ttp://img10.coolsavings.com/media/spacer.gif" width="1" height="6"></td>.. ..<td bgcolor="#FFFFFF"><img src="http://img10.coolsavings.com/media/spa cer.gif" width="1" height="6"></td>.. ..</tr>.. .<tr>.. ..<td bgco lor="#FFFFFF"> </td>.. ..<td align="right"> <font face="Arial, Hel vetica, sans-serif" size="2">e-mail address</font> </td>.. ..<td>.. . ..<input name="UserName" type="text" maxlength="80" size="20" id="UserName" />.. ...</td>.. ..<td bgcolor="#FFFFFF"> </td>.. ..</tr>.. .<tr>.. ..<td bgcolor="#FFFFFF"> </td>.. ..<td align="right"> <font face="Arial, Helvetica, sans-serif" size="2">password</font> </td>.. ..<td>.. ...<input name="LoginPassword" type="password" maxlength="2 1" size="20" id="LoginPassword" />.. ...</td>.. ..<td bgcolor="#FFFFF F"> </td>.. ..</tr>.. .<tr>.. ..<td bgcolor="#FFFFFF"> </td>.. ..<td align="right" nowrap> <font face="Arial, Helvetica, sans-s erif" size="2">save password?</font> </td>.. ..<td><font face="Arial, He lvetica, sans-serif" size="2">.. ...<input id="SaveLoginYes" type="radio " name="SaveLogin" valu # T proxyserver:8080 -> clientpc:34642 [A] e="SaveLoginYes" checked="checked" /><label for="SaveLoginYes">yes</label>. . .....<input id="SaveLoginNo" type="radio" name="SaveLogin" val ue="SaveLoginNo" /><label for="SaveLoginNo">no</label>.. </font> </td> .. ..<td bgcolor="#FFFFFF"> </td>.. ..</tr>.. .<tr>.. ..<t d bgcolor="#FFFFFF"> </td>.. ..<td> </td>.. ..<td> .. ...<input type="image" name="Login" id="Login" src="http://img10.coo lsavings.com/media/b_logon.gif" border="0" style="height:25px;width:75px;" />.. ...</td>.. ..<td bgcolor="#FFFFFF"> </td>.. ..</tr>..... ...... .</table>......<img src="http://img10.coolsavings.com/media/s pacer.gif" width="1" height="50"> ..<table border="0" cellspacing="0" cellp adding="0" align="center">...<tr align="middle">....<td><img src="http://im g10.coolsavings.com/media/spacer_s_yellow.gif" width="100%" height="1" vspa ce="4"></td>...</tr>.........<tr align="middle">....<td>..<nobr><a href="Ja vaScript:makeNewWindow('http://coolsavings.custhelp.com','support',580,400, 'yes')" class="csi-10px-link " onClick="flag=0">........member support</a> | <a href="JavaScript:makeNewWindow('http://www110.coolsavings.com/scripts/ guarantee.asp?SessionID=1346014086','guarantee',550,300,'no')" onClick="fla g=0" class="csi-10px-link ">....... privacy policy</a> | <a href="http://i nfo.coolsavings.com/news/index.asp?CS=http%3A%2F%2Fwww110%2Ecoolsavings%2Ec om%2Fscripts%2FWelenrol # T proxyserver:8080 -> clientpc:34642 [A] l%2Easp%3FSessionID%3D1346014086" class="csi-10px-link " onClick="flag=0">. .......company news</a> | <a href="http://phx.corporate-ir.net/phoenix.zhtm l?c=120944&p=irol-irhome" class="csi-10px-link " onClick="flag=0">........i nvestor relations</a> | <a href="http://careers.coolsavings.com"; class="csi -10px-link " onClick="flag=0">........jobs</a> </nobr>....</td>...</tr>...< tr align="middle">....<td>.....<nobr><a href="http://affiliates.coolsavings .com/affiliate/affiliate.asp?SessionID=1346014086&currIsland=www110" cl ass="csi-10px-link " onClick="flag=0">........become a coolsavings.com affi liate</a> | <a href="http://www110.coolsavings.com/scripts/business.asp?Ses sionID=1346014086" class="csi-10px-link " onClick="flag=0">........partner opportunities</a> | <a href="http://info.coolsavings.com/mediakit/contact_u s.asp?tab=4&view=2&ref=2&serv=jjkxxx&sID=jjkxxx&Page=/s cripts/Welenroll.asp" class="csi-10px-link " onClick="flag=0">........adver tise on coolsavings.com</a></nobr>....</td>...</tr>...<tr>....<td><img src= "http://img10.coolsavings.com/media/spacer.gif"; width="2" height="10"></td> ...</tr>...<tr>....<td align="middle">.....<table>......<tr>.......<td clas s="csi-black-10px"><img src="http://img10.coolsavings.com/media/copyright.g if" width="120" height="32" align="left" border="0" alt="..Copyright CoolSa vings, Inc. 1996-2004">covered .........by United States patent number: 5,7 61,648, also patents<br # T proxyserver:8080 -> clientpc:34642 [AP] >.........pending. yellow & purple are trademark colors of CoolSavings, Inc.</td>......</tr>.....</table>....</td>...</tr>..</table>..<script lang uage="JAVASCRIPT">..if (typeof(clientInterfaceExists) != "undefined" && cli entInterfaceExists == true)...MouseOverColorChange();....// BJ temp..if (ty peof(PopUpLeave) == "undefined")..{...eval("function PopUpLeave() {};");..} ..// End BJ temp....</script>..<p> </p>........<img src="http://img10. coolsavings.com/media/spacer.gif" width="1" height="500">.................. .....<img height="1" width="1" src="http://switch.atdmt.com/action/coocol_r eg1insecure_4"/>.......</form>...</body>..</html>............ ### T clientpc:34622 -> proxyserver:8080 [AP] GET http://www110.coolsavings.com/media/css/main.css HTTP/1.1..Host: www110 .coolsavings.com..User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1. 2.1) Gecko/20030225..Accept-Language: en-us, en;q=0.50..Accept-Encoding: gz ip, deflate, compress;q=0.9..Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q= 0.66..Keep-Alive: 300..Proxy-Connection: keep-alive..Proxy-Authorization: B asic c29uaWthbTolcm9nZXI3..Accept: text/css,*/*;q=0.1..Referer: http://www1 10.coolsavings.com/scripts/welenroll.aspx?SessionID=1346014086&&RefURL=..Co okie: RndCookie=1391217342; ASPSESSIONIDQQRCCQDR=OHMABJKAEAKBDLGFAHDIFLDL.. .. # T clientpc:34622 -> proxyserver:8080 [AP] GET http://www110.coolsavings.com/media/css/main.css HTTP/1.1..Host: www110 .coolsavings.com..User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1. 2.1) Gecko/20030225..Accept-Language: en-us, en;q=0.50..Accept-Encoding: gz ip, deflate, compress;q=0.9..Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q= 0.66..Keep-Alive: 300..Proxy-Connection: keep-alive..Proxy-Authorization: B asic c29uaWthbTolcm9nZXI3..Accept: text/css,*/*;q=0.1..Referer: http://www1 10.coolsavings.com/scripts/welenroll.aspx?SessionID=1346014086&&RefURL=..Co okie: RndCookie=1391217342; ASPSESSIONIDQQRCCQDR=OHMABJKAEAKBDLGFAHDIFLDL.. .. ## T proxyserver:8080 -> clientpc:34622 [AP] HTTP/1.0 200 OK..Content-Length: 2626..Content-Type: text/css..Last-Modifie d: Tue, 20 Apr 2004 16:38:00 GMT..Accept-Ranges: bytes..ETag: "064a5d7f526c 41:708"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Tue, 18 Ma ### T proxyserver:8080 -> clientpc:34622 [A] ../* GENERAL..----------------------------------------------- */....body, td, form, li, ul, ol {...font-family: Verdana, Arial, Helvetica, sans-serif ;...font-size: 12px;..}....../* FONTS ..----------------------------------- ------------ */.......csi-10px..{...font-size: 10px;..}.....csi-16px..{...f ont-size: 16px;...font-weight:bold;..}.....csi-darkGray_10px..{...color: #3 33333;...font-size: 10px;..}.....csi-black..{...color: #000000;..}.....csi- black-10px..{...color: #000000;...font-size: 10px;...font-family: Arial, V erdana, Helvetica, sans-serif;..}.....csi-divLine_02 {...background-image : url(media/divLine04.gif);...background-repeat : repeat-x;...background-pos ition : center;..}.....csi-divLine-Purp-V {...background-image : url(/media /spacer_purple.gif);...background-repeat : repeat-y;...background-position : center;..}.....csi-10px-red..{...color: #FF0000;...font-size: 10px;...pad ding-top: 10px;..}.....csi-10px-bold..{...color: #000000;...font-size: 10px ;...font-weight:bold;..}.....csi-brg_bold..{...font-weight:bold;...color: # 990000;..}.....csi-brg..{...color: #990000;..}.....csi-brg-10px..{...color: #990000;...font-size: 10px;..}.....csi-white..{...color: #ffffff;..}.....c atDrop {...font-size: 10px;...background-color: #FFFFEE;..}..../* LINKS ..- ---------------------------------------------- */..a.csi-10px-link:link { c olor: #660099; font-size: 10px; text-decoration: underline; font-size: 10px ;}..a.csi-10px-link:vis ## T proxyserver:8080 -> clientpc:34622 [AP] ited { color: #660099; font-size: 10px; text-decoration: underline; font-si ze: 10px;} ..a.csi-10px-link:hover { color: #339900; font-size: 10px; text- decoration: none; font-size: 10px;}....a.link { color: #660099; text-decor ation: underline;}..a.visited { color: #660099; text-decoration: underline ;} ..a.hover { color: #339900; text-decoration: none;}..../* HEADER..----- ------------------------------------------ */.....csi-header-subTab {backgr ound-color: #660099; font-size: 10px;}...csi-header-subTab a:link {color: # FFFFFF; text-decoration: none;}...csi-header-subTab a:visited {text-decorat ion: none; color: #FFFFFF;}...csi-header-subTab a:hover {color: #FFFFFF; t ext-decoration: underline;}.....csi-header-subTab-groc {color: #33FF66; tex t-decoration: none; font-size: 10px;}...csi-header-subTab-groc a:link {colo r: #33FF66; text-decoration: none;}...csi-header-subTab-groc a:visited {tex t-decoration: none;color: #33FF66;}...csi-header-subTab-groc a:hover {colo r: #33FF66; text-decoration: underline;}.....csi-header-subTab-divider {... color: #FFFFFF;...padding-left: 10px;...padding-right: 10px;...margin-left: 10px;...margin-right: 10px;...text-align: center;..} # T clientpc:34628 -> proxyserver:8080 [AP] GET http://img10.coolsavings.com/media/couponSample07a.gif HTTP/1.1..Host: img10.coolsavings.com..User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20030225..Accept-Language: en-us, en;q=0.50..Accept-Encodin g: gzip, deflate, compress;q=0.9..Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q=0.66..Keep-Alive: 300..Proxy-Connection: keep-alive..Proxy-Authorizati on: Basic c29uaWthbTolcm9nZXI3..Accept: video/x-mng,image/png,image/jpeg,im age/gif;q=0.2,*/*;q=0.1..Referer: http://www110.coolsavings.com/scripts/wel enroll.aspx?SessionID=1346014086&&RefURL=.... # T clientpc:34641 -> proxyserver:8080 [AP] GET http://img10.coolsavings.com/media/couponSample06b.gif HTTP/1.1..Host: img10.coolsavings.com..User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20030225..Accept-Language: en-us, en;q=0.50..Accept-Encodin g: gzip, deflate, compress;q=0.9..Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q=0.66..Keep-Alive: 300..Proxy-Connection: keep-alive..Proxy-Authorizati on: Basic c29uaWthbTolcm9nZXI3..Accept: video/x-mng,image/png,image/jpeg,im age/gif;q=0.2,*/*;q=0.1..Referer: http://www110.coolsavings.com/scripts/wel enroll.aspx?SessionID=1346014086&&RefURL=.... ### T clientpc:34642 -> proxyserver:8080 [AP] GET http://switch.atdmt.com/action/coocol_reg1insecure_4 HTTP/1.1..Host: sw itch.atdmt.com..User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2. 1) Gecko/20030225..Accept-Language: en-us, en;q=0.50..Accept-Encoding: gzip , deflate, compress;q=0.9..Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q=0. 66..Keep-Alive: 300..Proxy-Connection: keep-alive..Proxy-Authorization: Bas ic c29uaWthbTolcm9nZXI3..Accept: video/x-mng,image/png,image/jpeg,image/gif ;q=0.2,*/*;q=0.1..Referer: http://www110.coolsavings.com/scripts/welenroll. aspx?SessionID=1346014086&&RefURL=..Cookie: AA002=1084426034-956320745/1086 080935..If-Modified-Since: Fri, 23 Mar 2001 19:01:15 GMT..If-None-Match: "9 0aee1a2cbb3c01:878".... ##
![http://img10.coolsavings.com/media/csavLogo001a.gif"](http://img10.coolsavings.com/media/csavLogo001a.gif"){kind=link}
![http://img10.coolsavings.com/media/tagline.gif"](http://img10.coolsavings.com/media/tagline.gif"){kind=link}
![http://img10.coolsavings.com/media/pic_006.gif"](http://img10.coolsavings.com/media/pic_006.gif"){kind=link}
![http://img10.coolsavings.com/media/spacer.gif"](http://img10.coolsavings.com/media/spacer.gif"){kind=link}
![http://img10.coolsavings.com/media/intro_grocery_100.jpg"](http://img10.coolsavings.com/media/intro_grocery_100.jpg"){kind=link}
![http://img10.coolsavings.com/media/intro_baby_text.gif"](http://img10.coolsavings.com/media/intro_baby_text.gif"){kind=link}
![http://img10.coolsavings.com/media/spacer_s_yellow.gif"](http://img10.coolsavings.com/media/spacer_s_yellow.gif"){kind=link}
![http://img10.coolsavings.com/media/b_submit.gif"](http://img10.coolsavings.com/media/b_submit.gif"){kind=link}
![http://img10.coolsavings.com/media/intro_sam1_text.gif"](http://img10.coolsavings.com/media/intro_sam1_text.gif"){kind=link}
![http://img10.coolsavings.com/media/pic_013.gif"](http://img10.coolsavings.com/media/pic_013.gif"){kind=link}
![http://img10.coolsavings.com/media/corner_member_01a.gif"](http://img10.coolsavings.com/media/corner_member_01a.gif"){kind=link}
![http://img10.coolsavings.com/media/corner_member_04a.gif"](http://img10.coolsavings.com/media/corner_member_04a.gif"){kind=link}
--------------------------------------------------------------------------- Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off any course! All of our class sizes are guaranteed to be 10 students or less to facilitate one-on-one interaction with one of our expert instructors. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. Visit us at: http://www.infosecinstitute.com/courses/ethical_hacking_training.html ----------------------------------------------------------------------------
Current thread:
- http requests getting redirected to coolsavings.com Sonika Malhotra (May 20)
- Re: http requests getting redirected to coolsavings.com Raghu Chinthoju (May 21)
- <Possible follow-ups>
- RE: http requests getting redirected to coolsavings.com WINTERS, KELLY (SBIS) (May 21)
- Re: http requests getting redirected to coolsavings.com Akash Mahajan (May 25)
- Re: http requests getting redirected to coolsavings.com kaps lock (May 28)
- Re: http requests getting redirected to coolsavings.com Akash Mahajan (May 25)