Image as a Referrer Path

Remote Image accessing Website Image

[hsb83]

Hi

Going thru the web access logs, I noticed a remote site image as a referrer path.

219.91.142.234 - - [26/Mar/2005:13:54:13 -0600] "GET /portfolio/images/corpid6.jpg HTTP/1.1" 200 11176 "http://www.angelfire.com/biz/cyp/images/viscard.gif" "Mozilla/4.0 (compatible; MSIE 6.00; Windows\t98)"

Can an image be a referrer? If so, how can a remote image access another image from my web site? Could anyone shed light on this?

Thanks

[carguy84]

visa.gif doesn't mean it's an image, it could be a folder or something else, it all depends on how the server is set up.

[bobdole]

Any file type can be a referrer, since it is simply the string reported by the browser as the url that directed the user to your site. In this particular case I couldn't tell you since "http://www.angelfire.com/biz/cyp/images/viscard.gif" currently throws a anglefire's custom 404 error and I didn't notice any links or images to your site on the current 404 page.

I've seen this happen before with similar 40x/50x errors as well as when a strange website design is used where image file extentions are actual pages.

Do you have any other examples in your log files of this happening or is this entry unique?

-b

[hsb83]

Hi

Thanks bobdole and carguy84. There are other examples too.

219.91.142.234 - - [27/Mar/2005:12:40:43 -0600] "GET /portfolio/images/corpid3.jpg HTTP/1.1" 200 8966 "-" "Mozilla/4.0 (compatible; MSIE 6.00; Windows\t98)"

219.91.142.234 - - [27/Mar/2005:13:24:46 -0600] "GET /portfolio/images/corpid2.jpg HTTP/1.1" 200 10534 "http://www.panzermodellbau.com/pics/logos/visite2.jpg" "Mozilla/4.0 (compatible; MSIE 6.00; Windows\t98)"

219.91.142.234 - - [27/Mar/2005:13:24:46 -0600] "GET /portfolio/images/corpid1.jpg HTTP/1.1" 200 10175 "http://h-om-e.tripod.com/images/graphic_design/om_card.jpg" "Mozilla/4.0 (compatible; MSIE 6.00; Windows\t98)"

219.91.142.234 - - [27/Mar/2005:13:24:46 -0600] "GET /portfolio/images/corpid4.jpg HTTP/1.1" 200 10767 "http://h-om-e.tripod.com/images/graphic_design/naveen_card.jpg" "Mozilla/4.0 (compatible; MSIE 6.00; Windows\t98)"

219.91.142.234 - - [27/Mar/2005:13:54:13 -0600] "GET /portfolio/images/corpid1.jpg HTTP/1.1" 200 10175 "http://myhome.hanafos.com/~luxo/products/snb/livinggoods/cigarette.gif" "Mozilla/4.0 (compatible; MSIE 6.00; Windows\t98)"

219.91.142.234 - - [27/Mar/2005:13:54:31 -0600] "GET /portfolio/images/corpid3.jpg HTTP/1.1" 200 8966 "http://www.volk.ru/img/card/text.gif" "Mozilla/4.0 (compatible; 6.00; Windows\t98)"

A few are images (h-om-e.tripod.com) but others are either 404s or point to other pages. But they are all originating from same IP. But how come these are accessing images from my website? Shouldn't the images be displayed if so?

Thanks

[bobdole]

I'm not sure but I think the referring images might be bogus referring urls. The fact that several of this hits are all within the same second would lead me to believe that it is a normal page load with bogus referring urls, since the referring url should be one of your pages linking the requested images.

The agent string is a bit odd and may indicate something such as an odd crawler or brower plugin. I couldn't find anything that uses it, all the referrences I could find where either links to other people's web reports or links to spanish sites dealing with what looks to be tax software.

Maybe someone else might know more?

-b