Well... FWIW I answered this myself. It's Apache's mod_proxy, mis-configured to run as an open proxy.
-- Jeremy Wadsack Wadsack-Allen Digital Group Jeremy Wadsack ([EMAIL PROTECTED]; Friday, February 21, 2003 4:16 PM): > This is probably more related to Apache and rotatelogs, but I thought > someone here might have seen it before. > I am getting lines like these in some log files: > 218.13.77.127 - - [17/Feb/2003:04:22:35 -0500] "GET > http://www.orbitz.com/include/js/browser_detect.js HTTP/1.1" 200 2728 > 218.13.77.127 - - [17/Feb/2003:04:22:37 -0500] "GET > http://www.orbitz.com/include/css/styles1.css HTTP/1.1" 200 9213 > 218.13.77.127 - - [17/Feb/2003:04:22:38 -0500] "GET > http://www.orbitz.com/include/js/deals_destinations.js HTTP/1.1" 200 664 > 218.13.77.127 - - [17/Feb/2003:04:22:39 -0500] "GET > http://www.orbitz.com/include/css/destinations1.css HTTP/1.1" 200 1924 > 218.13.77.127 - - [17/Feb/2003:04:22:39 -0500] "GET > http://www.orbitz.com/include/js/popup.js HTTP/1.1" 200 6548 > 218.13.77.127 - - [17/Feb/2003:04:22:41 -0500] "GET http://www.orbitz.com/d.gif > HTTP/1.1" 200 43 > Notice that the 'request' includes a full URL, more like a referrer > would. Also, this log is not for orbitz.com and has no connection to > it. Yet the server has returned a 200 (OK) response and a file. These > might be referrers, but other logs (in combined format) show a > different referrer request of the same pattern. > The logs are sent out through rotatelogs as a PIPE process in Apache. > Could this be messing things up? > Anybody seen this? Have any idea? > TIA +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
