But what is the alternative... someone has pwnd an NSA box and is using it as a CC server for malware that they've injected into all sites hosted by some guy who was just arrested?
For any given series of boring events, the most fantastical explanation that ties them all together must obviously be true.
http://www.teslasociety.com/tunguska.htm
ps: I don't care if it is correct, it is still an interesting read.
GET /05cea4de-951d-4037-bf8f-f69055b279bb HTTP/1.1
Don't you think if it was another party they would just have encoded the IP and/or MAC into the URL to of a GET from some scary IP instead of using a cookie to a resource that is actually there on listening on the server.