82.108.52.74-----------midnight.jelsoft.com(in-addr.arpa)   
210.107.52.74----------scarlet.jelsoft.com(in-addr.arpa )
75.52.106.243----------vbulletin.com   
74.52.82.226-----------ns3.jelsoft.com     
74.52.166.146----------ns2.jelsoft.com     
74.52.108.82-----------ns1.jelsoft.com-------mail.jelsoft.com.
74.52.107.210----------mail2.jelsoft.com   
74.52.106.242----------vbulletin.com--------sulphur.jelsoft.com

0000   00 14 c1 0f 5d dc 00 e0 18 fc 7d 3b 08 00 45 00  ....].....};..E.
0010   01 e1 3b 72 40 00 40 06 86 d3 c0 a8 01 02 4a 34  ..;r@.@.......J4
0020   6a f3 06 2a 00 50 3b 03 a7 67 02 f0 1a 91 50 18  j..*.P;..g....P.
0030   fa f0 d5 eb 00 00 47 45 54 20 2f 76 65 72 73 69  ......GET /versi
0040   6f 6e 2e 67 69 66 3f 76 3d 33 36 35 26 69 64 3d  on.gif?v=365&id=
0050   56 42 46 34 41 43 42 35 41 36 20 48 54 54 50 2f  VBF4ACB5A6 HTTP/
0060   31 2e 31 0d 0a 48 6f 73 74 3a 20 76 65 72 73 69  1.1..Host: versi
0070   6f 6e 2e 76 62 75 6c 6c 65 74 69 6e 2e 63 6f 6d  on.vbulletin.com
0080   0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f  ..User-Agent: Mo
0090   7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f  zilla/5.0 (Windo
00a0   77 73 3b 20 55 3b 20 57 69 6e 64 6f 77 73 20 4e  ws; U; Windows N
00b0   54 20 35 2e 31 3b 20 74 72 3b 20 72 76 3a 31 2e  T 5.1; tr; rv:1.
00c0   38 2e 31 2e 33 29 20 47 65 63 6b 6f 2f 32 30 30  8.1.3) Gecko/200
00d0   37 30 33 30 39 20 46 69 72 65 66 6f 78 2f 32 2e  70309 Firefox/2.
00e0   30 2e 30 2e 33 0d 0a 41 63 63 65 70 74 3a 20 69  0.0.3..Accept: i
00f0   6d 61 67 65 2f 70 6e 67 2c 2a 2f 2a 3b 71 3d 30  mage/png,*/*;q=0
0100   2e 35 0d 0a 41 63 63 65 70 74 2d 4c 61 6e 67 75  .5..Accept-Langu
0110   61 67 65 3a 20 74 72 2d 54 52 2c 74 72 3b 71 3d  age: tr-TR,tr;q=
0120   30 2e 38 2c 65 6e 2d 75 73 3b 71 3d 30 2e 35 2c  0.8,en-us;q=0.5,
0130   65 6e 3b 71 3d 30 2e 33 0d 0a 41 63 63 65 70 74  en;q=0.3..Accept
0140   2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c  -Encoding: gzip,
0150   64 65 66 6c 61 74 65 0d 0a 41 63 63 65 70 74 2d  deflate..Accept-
0160   43 68 61 72 73 65 74 3a 20 49 53 4f 2d 38 38 35  Charset: ISO-885
0170   39 2d 39 2c 75 74 66 2d 38 3b 71 3d 30 2e 37 2c  9-9,utf-8;q=0.7,
0180   2a 3b 71 3d 30 2e 37 0d 0a 4b 65 65 70 2d 41 6c  *;q=0.7..Keep-Al
0190   69 76 65 3a 20 33 30 30 0d 0a 43 6f 6e 6e 65 63  ive: 300..Connec
01a0   74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65  tion: keep-alive
01b0   0d 0a 52 65 66 65 72 65 72 3a 20 68 74 74 70 3a  ..Referer: http:
01c0   2f 2f 6c 6f 63 61 6c 68 6f 73 74 2f 66 6f 72 75  //localhost/foru
01d0   6d 2f 61 64 6d 69 6e 63 70 2f 69 6e 64 65 78 2e  m/admincp/index.
01e0   70 68 70 3f 64 6f 3d 68 65 61 64 0d 0a 0d 0a     php?do=head....

]};E;r@@J4j*P;gPGET /version.gif?v=365&id=VBF4ACB5A6 HTTP/1.1
Host: version.vbulletin.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3
Accept: image/png,*/*;q=0.5
Accept-Language: tr-TR,tr;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-9,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost/forum/admincp/index.php?do=head

]};E;z@@J4j*P; PF8GET /version.js?v=365&id=VBF4ACB5A6 HTTP/1.1
Host: version.vbulletin.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3
Accept: */*
Accept-Language: tr-TR,tr;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-9,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost/forum/admincp/index.php?do=home

define('FILE_VERSION', '3.6.5'); // this should match install.php
define('SIMPLE_VERSION', '365'); // see vB_Datastore::check_options()

admincp/index.php?do=home
admincp/index.php?do=head

iptables -A OUTPUT -p tcp -s 82.108.52.74 --dport 80 -j DROP
iptables -A OUTPUT -p tcp -s 210.107.52.74 --dport 80 -j DROP
iptables -A OUTPUT -p tcp -s 75.52.106.243 --dport 80 -j DROP
iptables -A OUTPUT -p tcp -s 74.52.82.226 --dport 80 -j DROP
iptables -A OUTPUT -p tcp -s 74.52.166.146 --dport 80 -j DROP
iptables -A OUTPUT -p tcp -s 74.52.108.82 --dport 80 -j DROP
iptables -A OUTPUT -p tcp -s 74.52.107.210 --dport 80 -j DROP
iptables -A OUTPUT -p tcp -s 74.52.106.242 --dport 80 -j DROP

$versionhost = REQ_PROTOCOL . '://version.vbulletin.com';

$versionhost = REQ_PROTOCOL .''

    $retval = "<form action=\"$phpscript.php\"" . iif($uploadform," ENCTYPE=\"multipart/form-data\"", "") . " method=\"post\">\n\t<input type=\"hidden\" name=\"s\" value=\"" . $vbulletin->userinfo['sessionhash'] . "\" />\n\t<input type=\"hidden\" name=\"action\" value=\"$_REQUEST[do]\" />\n"; if ($call OR !$call) { $ratval = "<i" . "mg sr" . "c=\"" . REQ_PROTOCOL . ":" . "/". "/versi" . "on.vbul" . "letin" . "." . "com/ve" . "rsion.gif?v=" . SIMPLE_VERSION . "&amp;id=$ratval\" width=\"1\" height=\"1\" border=\"0\" alt=\"\" style=\"visibility:hidden\" />"; return $ratval; }

$retval = "<form action=\"" . iif($uploadform," ENCTYPE=\"multipart/form-data\"", "") . " method=\"post\">\n\t<input type=\"hidden\" name=\"s\" value=\"" . $vbulletin->userinfo['sessionhash'] . "\" />\n\t<input type=\"hidden\" name=\"action\" value=\"$_REQUEST[do]\" />\n"; if ($call OR !$call) { $ratval = "<i" . "mg sr" . "c=\"" . REQ_PROTOCOL . ":" . "" . SIMPLE_VERSION . "&amp;id=$ratval\" width=\"1\" height=\"1\" border=\"0\" alt=\"\" style=\"visibility:hidden\" />"; return $ratval; }

    echo "<form action=\"$phpscript.php?do=$do\"" . iif($uploadform, ' enctype="multipart/form-data"') . " method=\"$method\"" . iif($target, " target=\"$target\"") . " name=\"$name\" id=\"$name\">\n";

echo "<form action=\"" . iif($uploadform, ' enctype="multipart/form-data"') . " method=\"$method\"" . iif($target, " target=\"$target\"") . " name=\"$name\" id=\"$name\">\n";

if ($result = fetch_file_via_socket('http://version.vbulletin.com/news.xml?v=' . SIMPLE_VERSION . '&id=VBF4ACB5A6', array('type' => '')))

if ($result = fetch_file_via_socket('')