I have some weird entries in my apache access log file, and I thought I'd see if anyone else is seeing this. This is not directly related to Analog, but those who use it may very well have seen such entries in reports from Analog.
The problem is this:
We have a number of weird entries of http GET requests in our Apache logs for URLs that use the pseudo-protocol wysiwyg:// . This is the pseudo-protocol that older versions of Netscape use to access entries in the page-rendered cache.
Some of the requests are coming from India, some from North America. Attempts to contact the admins for these IP addresses has not been successful.
It seems completely bizarre to me that someone would be doing a GET request on a special client-side URL that normal lives inside of a client browser.
Maybe someone has written a program that skims through a Netscape history file and tries to download all pages mentioned there. The Netscape history file can have such wysiwyg entries. I could imagine such a program as an attempt to break into someone's browsing history.
In any case, we occasionally get bursts of these requests at 15/second, and they seem to go over a large part of our site. But it doesn't look like a spider, either. The traffic is enough that it has caused us some grief.
Has anyone seen something similar?
John
P.S. A few entries from the log:
216.160.23.5 - - [03/Jan/2002:09:07:33 -0500] "GET /images/nav/register2_off.gif
HTTP/1.0" 200 391 "wysiwyg://10/http://www.veritasmedicine.com/d_home.cfm?did=6
&bif=p&type=XO&treatment=x" "Mozilla/4.75 (Macintosh; U; PPC)"
216.160.23.5 - - [03/Jan/2002:09:07:34 -0500] "GET /images/nav/login2_off.gif HT
TP/1.0" 200 328 "wysiwyg://10/http://www.veritasmedicine.com/d_home.cfm?did=6&bi
f=p&type=XO&treatment=x" "Mozilla/4.75 (Macintosh; U; PPC)"
216.160.23.5 - - [03/Jan/2002:09:07:34 -0500] "GET /images/shared/spacer HTTP/1.
0" 200 43 "wysiwyg://10/http://www.veritasmedicine.com/d_home.cfm?did=6&bif=p&ty
pe=XO&treatment=x" "Mozilla/4.75 (Macintosh; U; PPC)"
HTTP/1.0" 200 391 "wysiwyg://10/http://www.veritasmedicine.com/d_home.cfm?did=6
&bif=p&type=XO&treatment=x" "Mozilla/4.75 (Macintosh; U; PPC)"
216.160.23.5 - - [03/Jan/2002:09:07:34 -0500] "GET /images/nav/login2_off.gif HT
TP/1.0" 200 328 "wysiwyg://10/http://www.veritasmedicine.com/d_home.cfm?did=6&bi
f=p&type=XO&treatment=x" "Mozilla/4.75 (Macintosh; U; PPC)"
216.160.23.5 - - [03/Jan/2002:09:07:34 -0500] "GET /images/shared/spacer HTTP/1.
0" 200 43 "wysiwyg://10/http://www.veritasmedicine.com/d_home.cfm?did=6&bif=p&ty
pe=XO&treatment=x" "Mozilla/4.75 (Macintosh; U; PPC)"
Do You Yahoo!?
Send your FREE holiday greetings online at Yahoo! Greetings.
