Re: suspicious log entry

From: Ed (ebabin_at_yahoo.com)
Date: 03/19/04


Date: 19 Mar 2004 10:10:20 -0800

Tim Haynes <usenet-20040319@stirfried.vegetable.org.uk> wrote in message news:<86r7vpfaol.fsf@potato.vegetable.org.uk>...
> "Dave {Reply Address in.sig}" <noone$$@llondel.org> writes:
>
> > In message <2e0a15f6.0403181859.3d296746@posting.google.com>, Ed wrote:
> >
> >> I have a few entries in my usage log that indicate pages served are
> >> from different sites, i.e., Yahoo:
> >>
> >>
> >> access_log.2:64.222.46.178 - - [04/Mar/2004:00:53:18 +0000] "GET
> >> http://www.s3.com/ HTTP/1.1" 200 9251 "-" "Mozilla/4.0 (compatible;
> >> MSIE 4.01; Windows 95)"
> >>
> >> access_log.1:64.222.46.169 - - [07/Mar/2004:05:43:50 +0000] "GET
> >> http://www.yahoo.com/ HTTP/1.1" 403 2898 "-" "Mozilla/4.0 (compatible;
> >> MSIE 4.01; Windows 95)"
> >>
> >> I have no links to these sites nor any pages that should be indicative
> >> of these entries. What would this mean?
> >
> > Someone is checking your site to see if you've got a proxy server enabled.
>
> And if I were me I'd be crapping myself why a 200 OK status code with
> varying amount of data was being returns for that request.
>
> ~Tim

So help me out, I'm pretty green about this. What could be the hole
and how can I fix it.

thanks