translation time again

[lucy24]

How does this work? Verbatim except IP and filename. "example.com" won't cut it, since that's the whole point of the question.

ww.xx.yy.zz - - [22/Oct/2012:23:26:49 -0700] "GET /directory/subdirectory/images/filename.png HTTP/1.1" 200 2325 "http://localhost/main.jsp" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322)"

ww.xx.yy.zz is not a human; it's the IP address (fixed) of the site that uses the image. Apache server. It's an authorized hotlink -- /main.jsp is the correct page name -- but of course I didn't authorize no "localhost", so 2325 is the size of my "no hotlinks" file.*

I have no reason to think the UA is faked in any way. (There's a backstory which I had better not tell, although it's pretty entertaining.)


* Took me a while to figure this out. Ironically it's bigger than the requested file.

[phranque]

it looks like someone (probably a live human) is surfing the site locally from the server using IE8.

when you request [localhost...] you get the home directory of the default hostname for the web server running on the box from which you are browsing.
in this case the resource requested was [localhost...] which is probably the default directory index document for the home directory on that server.

the default hostname for the loopback is localhost and the equivalent IPV4 address is 127.0.0.1

[lucy24]

which is probably the default directory index document for the home directory on that server

Actually the default is /index.jsp but that's just a splash screen. Yes, some genius set up /index and /main in the same directory ;)

I see what they're doing conceptually. It's when I try to figure out how it's done physically that I start getting a headache. It isn't one of those micro-servers running out of your garage or from a spare computer. How do they connect?

[phranque]

it could be a script or command line user agent running from a terminal session and the user agent is spoofed to look like a typical browser.