Re: [analog-help] weird log file entry

[John G. Norman]

I figured out where the wysiwyg:// referers in web server logs come from.

If you use an old version of Netscape (4.7 or earlier, I think), and do print or print/preview, Netscape refreshes all of the images on the page -- including any images that may be be pre-loaded by Javascript.

On a big site, this can easily be dozens of images, resulting in many, many hits in one burst.

John

  Alejandro Fernandez <[EMAIL PROTECTED]> wrote:

Just a vague memory, but I came across this once and had some suspicions it was someone viewing source and clicking on the links... How they can come in bursts is another matter... Would they be harvesting anything valuable?

Ale

On Thu, 03 Jan 2002 10:17:54 -0500
Rich Dempsey <[EMAIL PROTECTED]>wrote:

> On the one hand, I've never seen a URL beginning with the wysiwyg protocol.
> OTOH, I've not been looking for it.
>
> Note that these are not requested URLs, these are referrer URLs, which seems
> entirely appropriate to me.
>
> Rich
>
> At 06:54 AM 01/03/2002 -0800, you wrote:
>
> >I have some weird entries in my apache access log file, and I thought I'd see if anyone else is seeing this. This is not directly related to Analog, but those who use it may very well have seen such entries in reports fr! om Analog.
> >The problem is this:
> >
> >We have a number of weird entries of http GET requests in our Apache logs for URLs that use the pseudo-protocol wysiwyg:// . This is the pseudo-protocol that older versions of Netscape use to access entries in the page-rendered cache.
> >
> >Some of the requests are coming from India, some from North America. Attempts to contact the admins for these IP addresses has not been successful.
> >
> >It seems completely bizarre to me that someone would be doing a GET request on a special client-side URL that normal lives inside of a client browser.
> >
> >Maybe someone has written a program that skims through a Netscape history file and tries to download all pages mentioned there. The Netscape history file can have such wysiwyg entries. I could imagine such a program as an attempt to break into someone's browsing history.
> >
> >In any case! , we occasionally get bursts of these requests at 15/second, and they seem to go over a large part of our site. But it doesn't look like a spider, either. The traffic is enough that it has caused us some grief.
> >
> >Has anyone seen something similar?
> >
> > John
> >
> >P.S. A few entries from the log:
> >
> >216.160.23.5 - - [03/Jan/2002:09:07:33 -0500] "GET /images/nav/register2_off.gif
> > HTTP/1.0" 200 391 "wysiwyg://10/http://www.veritasmedicine.com/d_home.cfm?did=6
> >&bif=p&type=XO&treatment=x" "Mozilla/4.75 (Macintosh; U; PPC)"
> >216.160.23.5 - - [03/Jan/2002:09:07:34 -0500] "GET /images/nav/login2_off.gif HT
> >TP/1.0" 200 328 "wysiwyg://10/http://www.veritasmedicine.com/d_home.cfm?did=6&bi
> >f=p&type=XO&treatment=x" "Mozilla/4.75 (Macintosh; U; PPC)"
> >216.160.23.5 - - [03/Jan/2002:09:07:34 -0500] "GET /images/! shared/spacer HTTP/1.
> >0" 200 43 "wysiwyg://10/http://www.veritasmedicine.com/d_home.cfm?did=6&bif=p&ty
> >pe=XO&treatment=x" "Mozilla/4.75 (Macintosh; U; PPC)"
> >
> >
> >
> >
> >Do You Yahoo!?
> >Send your FREE holiday greetings online at Yahoo! Greetings.
>
> --
>
> Richard C. Dempsey email: [EMAIL PROTECTED]
> Kodak.com pager: 585-975-3539
> 3rd Floor, Bldg 16, KO phone: 585-781-5232
> Eastman Kodak Company
> Rochester, NY 14650-0706
>
> +------------------------------------------------------------------------
> | This is the analog-help mailing list. To unsubscribe from this
> | mailing list, go to
> | http://lists.isite.net/listgate/analog-help/unsubscribe.html
> |
> | List archives are available at
> | http://www.mail-archive.! [EMAIL PROTECTED]/
> | http://lists.isite.net/listgate/analog-help/archives/
> | http://www.tallylist.com/archives/index.cfm/mlist.7
> +------------------------------------------------------------------------


--
Alejandro Fernandez
Electronic Group Interactive
--+34-65-232-8086--
+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/analog-help@lists.isite.net/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+------------------------------------------------------------------------

---

Do You Yahoo!?
Send your FREE holiday greetings online at Yahoo! Greetings.