The plugin details seems easiest but they are say "packet" and not http request and not necessarily by a browser. Presuming they have compromised the machine this staining will be affecting the network stack somehow most likely at an IP level.