Forum Moderators: open
This is how it looks in the log:
209.73.164.50 - - [08/Nov/2000:03:20:02 -0800] "GET /guiden/Marknadsforing/marknadsforing.html HTTP/1.0" 200 14309 "-" "Scooter/1.0"
212.187.226.103 - - [08/Nov/2000:03:20:34 -0800] "GET /guiden/marknadsforing/marknadsforing.html HTTP/1.0" 404 6004 "-" "Java1.2.2-1"
The IP address 209.73.164.50 resolves:
bigip1-snat.sv.av.com
The IP address 212.187.226.103 resolves: uksefe03.aveurope.co.uk
Looks like a Swedish and a UK version to me.
The reason I choose this particular submission as an example is that the directory involved is spelt with a capital M (/Marknadsforing/). I know it shouldn’t be but it is. :(
Now, good old Scooter hasn’t got a problem with that. But his buddy treats it like a lower case m (/marknadsforing/), and consequently gets a 404 response.
The site has been dropped from all local versions of AV. Perhaps due to the different reply’s given to them.
Is this some sort of cloaking detection?
Anybody else having them around in pairs?