Comment by Panos

All these parts happen within the index2.php of the parked domains (see the section with the title "Re-directions and generating click fraud with normal click patterns").

Take a look at this screenshot: https://lh5.googleusercontent.com/-R9lgD8LQfdw/TXEu7e2Sb5I/A...

and here are the detailed requests

https://lh5.googleusercontent.com/-qVyp1ChmmRA/TXExPKhXnOI/A...

https://lh3.googleusercontent.com/-3KulINgZhwA/TXExPdCASOI/A...

https://lh3.googleusercontent.com/-q3Cpp0uIM6g/TXExPsl3ycI/A...

https://lh4.googleusercontent.com/-zWpoE6IlyfI/TXExP36fWhI/A...

https://lh5.googleusercontent.com/-c0FdFkU0xX4/TXExQF5jHfI/A...

https://lh4.googleusercontent.com/-oLleFeARs3o/TXExQS95chI/A...

https://lh4.googleusercontent.com/-_-KqSY7ue5w/TXExQTVttwI/A...

https://lh4.googleusercontent.com/-Dxp-OfM0oXw/TXExQrQsoLI/A...