Load the main attrition page: 12.155.144.75 - - [07/May/2004:09:30:00 -0400] "GET / HTTP/1.1" 200 4568 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:01 -0400] "GET /attrition.css HTTP/1.1" 200 2047 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" Click the "Visual" link off the main page, rather than "disclaimer", "about us", "what", "why" or any other page that may explain what the web site is about. 12.155.144.75 - - [07/May/2004:09:30:26 -0400] "GET /attrition/wallpaper/ HTTP/1.1" 200 8691 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:27 -0400] "GET /attrition/wallpaper/lmj-off.gif HTTP/1.1" 200 2005 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:27 -0400] "GET /attrition.css HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:27 -0400] "GET /attrition/wallpaper/latex-thumb.jpg HTTP/1.1" 200 11065 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:27 -0400] "GET /attrition/wallpaper/leaning-attritia-thumb.jpg HTTP/1.1" 200 13472 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:27 -0400] "GET /attrition/wallpaper/thumb004.jpg HTTP/1.1" 200 8752 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:27 -0400] "GET /attrition/wallpaper/thumb001.jpg HTTP/1.1" 200 12932 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:27 -0400] "GET /attrition/wallpaper/thumb002.jpg HTTP/1.1" 200 9169 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:28 -0400] "GET /attrition/wallpaper/thumb003.jpg HTTP/1.1" 200 21261 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:28 -0400] "GET /attrition/wallpaper/a-thumb.gif HTTP/1.1" 200 4807 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:28 -0400] "GET /f-bak.gif HTTP/1.1" 200 1067 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:28 -0400] "GET /f-att.gif HTTP/1.1" 200 2255 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:28 -0400] "GET /f-mai.gif HTTP/1.1" 200 1139 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:30:28 -0400] "GET /attrition/wallpaper/lmj-on.gif HTTP/1.1" 200 2240 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" They read the "about" page which gives a concise summary of the web site focus: Attrition.org (http://www.attrition.org) is a computer security Web site dedicated to the collection, dissemination and distribution of information about the industry for anyone interested in the subject. They maintain one of the largest catalogs of security advisories, text files, and humorous image galleries. They are also known for the largest mirror of Web site defacements and their crusade to expose industry frauds and inform the public about incorrect information in computer security articles. 12.155.144.75 - - [07/May/2004:09:31:20 -0400] "GET /attrition/about.html HTTP/1.1" 200 3377 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:31:21 -0400] "GET /attrition.css HTTP/1.1" 304 - "http://www.attrition.org/attrition/about.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:31:21 -0400] "GET /f-bak.gif HTTP/1.1" 304 - "http://www.attrition.org/attrition/about.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:31:21 -0400] "GET /f-att.gif HTTP/1.1" 304 - "http://www.attrition.org/attrition/about.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:31:21 -0400] "GET /f-mai.gif HTTP/1.1" 304 - "http://www.attrition.org/attrition/about.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" They read the "What is Attrition" link which gives even more details: 12.155.144.75 - - [07/May/2004:09:31:38 -0400] "GET /news/content/99-09-10.001.html HTTP/1.1" 200 10022 "http://www.attrition.org/attrition/about.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:31:38 -0400] "GET /attrition.css HTTP/1.1" 304 - "http://www.attrition.org/news/content/99-09-10.001.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:31:38 -0400] "GET /f-bak.gif HTTP/1.1" 304 - "http://www.attrition.org/news/content/99-09-10.001.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:31:38 -0400] "GET /f-att.gif HTTP/1.1" 304 - "http://www.attrition.org/news/content/99-09-10.001.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:31:38 -0400] "GET /f-mai.gif HTTP/1.1" 304 - "http://www.attrition.org/news/content/99-09-10.001.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" They read Geekgrl's personal web page: 12.155.144.75 - - [07/May/2004:09:32:25 -0400] "GET /~geekgrl/ HTTP/1.1" 200 4452 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:25 -0400] "GET /~geekgrl/title.JPG HTTP/1.1" 200 18803 "http://www.attrition.org/~geekgrl/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:25 -0400] "GET /~geekgrl/buttons/pix.jpg HTTP/1.1" 200 23902 "http://www.attrition.org/~geekgrl/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:26 -0400] "GET /~geekgrl/buttons/text.jpg HTTP/1.1" 200 22479 "http://www.attrition.org/~geekgrl/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:26 -0400] "GET /~geekgrl/buttons/tinkle.gif HTTP/1.1" 200 40750 "http://www.attrition.org/~geekgrl/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:26 -0400] "GET /~geekgrl/buttons/telecom.gif HTTP/1.1" 200 2448 "http://www.attrition.org/~geekgrl/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:26 -0400] "GET /~geekgrl/buttons/beavuh.gif HTTP/1.1" 200 3192 "http://www.attrition.org/~geekgrl/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:34 -0400] "GET /~geekgrl/movies/movies.html HTTP/1.1" 200 8832 "http://www.attrition.org/~geekgrl/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:35 -0400] "GET /~geekgrl/movies/u571.gif HTTP/1.1" 200 8694 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:35 -0400] "GET /~geekgrl/movies/erin.jpg HTTP/1.1" 200 19564 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:35 -0400] "GET /~geekgrl/movies/sleepyhol.jpg HTTP/1.1" 200 21433 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:35 -0400] "GET /~geekgrl/movies/greenmile.jpg HTTP/1.1" 200 16910 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:36 -0400] "GET /~geekgrl/movies/messenger.jpg HTTP/1.1" 200 20270 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:36 -0400] "GET /~geekgrl/movies/fightclub1.jpg HTTP/1.1" 200 12214 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:36 -0400] "GET /~geekgrl/movies/enddays.jpg HTTP/1.1" 200 84560 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:36 -0400] "GET /~geekgrl/movies/new-kings.jpg HTTP/1.1" 200 11502 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:37 -0400] "GET /~geekgrl/movies/sixth.gif HTTP/1.1" 200 13967 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:37 -0400] "GET /~geekgrl/movies/blairwitch.jpg HTTP/1.1" 200 10759 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:37 -0400] "GET /~geekgrl/movies/stigmata_interstitial_2.jpg HTTP/1.1" 200 19771 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:38 -0400] "GET /~geekgrl/movies/killers.gif HTTP/1.1" 200 67505 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:32:38 -0400] "GET /~geekgrl/movies/matrix1.gif HTTP/1.1" 200 120658 "http://www.attrition.org/~geekgrl/movies/movies.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" They read Null's personal web page: 12.155.144.75 - - [07/May/2004:09:33:01 -0400] "GET /~null/ HTTP/1.1" 200 4414 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" They read the Sexchart, which we provide web space for: 12.155.144.75 - - [07/May/2004:09:33:35 -0400] "GET /hosted/sexchart/ HTTP/1.1" 200 18350 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:33:48 -0400] "GET /hosted/sexchart/sexchartfaq.txt HTTP/1.1" 200 4737 "http://www.attrition.org/hosted/sexchart/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" 12.155.144.75 - - [07/May/2004:09:33:51 -0400] "GET /hosted/sexchart/sexchart.9.38 HTTP/1.1" 200 116737 "http://www.attrition.org/hosted/sexchart/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" At this point, the PayPal traffic stops. Based on Squido's comments, I assume these pages were the basis for determining attrition.org "sold pornography". When Squido called back, the next employee began looking at the pages to figure out why her account was flagged: He loads the main page followed by the 'Visual' link: 12.155.144.75 - - [07/May/2004:12:38:12 -0400] "GET / HTTP/1.1" 200 4652 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:13 -0400] "GET /attrition.css HTTP/1.1" 200 2047 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:28 -0400] "GET /attrition/wallpaper/ HTTP/1.1" 200 8691 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:28 -0400] "GET /attrition/wallpaper/lmj-off.gif HTTP/1.1" 200 2005 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:28 -0400] "GET /attrition.css HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:28 -0400] "GET /attrition/wallpaper/latex-thumb.jpg HTTP/1.1" 200 11065 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:29 -0400] "GET /attrition/wallpaper/leaning-attritia-thumb.jpg HTTP/1.1" 200 13472 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:29 -0400] "GET /attrition/wallpaper/thumb004.jpg HTTP/1.1" 200 8752 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:29 -0400] "GET /attrition/wallpaper/thumb001.jpg HTTP/1.1" 200 12932 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:29 -0400] "GET /attrition/wallpaper/thumb002.jpg HTTP/1.1" 200 9169 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:29 -0400] "GET /attrition/wallpaper/a-thumb.gif HTTP/1.1" 200 4807 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:29 -0400] "GET /attrition/wallpaper/thumb003.jpg HTTP/1.1" 200 21261 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:30 -0400] "GET /f-bak.gif HTTP/1.1" 200 1067 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:30 -0400] "GET /f-att.gif HTTP/1.1" 200 2255 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:30 -0400] "GET /f-mai.gif HTTP/1.1" 200 1139 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:38:30 -0400] "GET /attrition/wallpaper/lmj-on.gif HTTP/1.1" 200 2240 "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" He checks the Security Commentary page: 12.155.144.75 - - [07/May/2004:12:39:38 -0400] "GET /security/commentary/ HTTP/1.1" 200 6009 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:38 -0400] "GET /attrition.css HTTP/1.1" 304 - "http://www.attrition.org/security/commentary/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:38 -0400] "GET /f-bak.gif HTTP/1.1" 304 - "http://www.attrition.org/security/commentary/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:39 -0400] "GET /f-att.gif HTTP/1.1" 304 - "http://www.attrition.org/security/commentary/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:39 -0400] "GET /f-mai.gif HTTP/1.1" 304 - "http://www.attrition.org/security/commentary/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" Goes back to the wallpapers: 12.155.144.75 - - [07/May/2004:12:39:46 -0400] "GET /attrition/wallpaper/ HTTP/1.1" 200 8691 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:46 -0400] "GET /attrition/wallpaper/lmj-off.gif HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:46 -0400] "GET /attrition/wallpaper/latex-thumb.jpg HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:46 -0400] "GET /attrition/wallpaper/leaning-attritia-thumb.jpg HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:47 -0400] "GET /attrition.css HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:47 -0400] "GET /attrition/wallpaper/thumb004.jpg HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:47 -0400] "GET /attrition/wallpaper/thumb001.jpg HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:47 -0400] "GET /attrition/wallpaper/thumb002.jpg HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:47 -0400] "GET /attrition/wallpaper/thumb003.jpg HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:47 -0400] "GET /attrition/wallpaper/a-thumb.gif HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:47 -0400] "GET /f-bak.gif HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:47 -0400] "GET /f-att.gif HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:47 -0400] "GET /f-mai.gif HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:39:47 -0400] "GET /attrition/wallpaper/lmj-on.gif HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:40:11 -0400] "GET /attrition/wallpaper/lmj-off.gif HTTP/1.1" 304 - "http://www.attrition.org/attrition/wallpaper/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" Checks the main Security page: 12.155.144.75 - - [07/May/2004:12:43:03 -0400] "GET /security/ HTTP/1.1" 200 1731 "http://www.attrition.org/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:43:04 -0400] "GET /attrition.css HTTP/1.1" 304 - "http://www.attrition.org/security/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:43:04 -0400] "GET /f-bak.gif HTTP/1.1" 304 - "http://www.attrition.org/security/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:43:04 -0400] "GET /f-att.gif HTTP/1.1" 304 - "http://www.attrition.org/security/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:43:04 -0400] "GET /f-mai.gif HTTP/1.1" 304 - "http://www.attrition.org/security/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" Finally checks Squido's personal web page: 12.155.144.75 - - [07/May/2004:12:47:33 -0400] "GET /~squido HTTP/1.1" 301 391 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:47:34 -0400] "GET /~squido/ HTTP/1.1" 200 1022 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:47:34 -0400] "GET /~squido/froak.gif HTTP/1.1" 200 8582 "http://www.attrition.org/~squido/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:47:34 -0400] "GET /attrition.css HTTP/1.1" 304 - "http://www.attrition.org/~squido/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:47:39 -0400] "GET /~squido/index2.html HTTP/1.1" 200 1759 "http://www.attrition.org/~squido/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" 12.155.144.75 - - [07/May/2004:12:47:39 -0400] "GET /attrition.css HTTP/1.1" 304 - "http://www.attrition.org/~squido/index2.html" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 1.0.3705)" At this point he acknowledges that Attrition.org is not her page, and that they don't appear to sell pornography.