stream://1/

views images, then changes idenitities

[idiotgirl]

This referrer only hit one domain, but the referral string was kinda funky:

204.134.119.80 - - [14/Aug/2002:22:52:34 -0400] "GET /images/imagename.gif HTTP/1.1" 403 2376 "stream://1/" "Mozilla/4.0 (compatible; MSIE ; Mac_PPC)"

and all it views are images and the css file that would have loaded from an index page - the next logical real page view (for that index page) is from another UA and IP all together:

216.228.40.216 - - [14/Aug/2002:23:03:14 -0400] "GET /index.html HTTP/1.1" 200 10136 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; Q312461)"

204.134.118.80 goes to Cyberport Station in Colorado, the second IP 216.228.40.216 hails from Mid-Rivers Telephone Cooperative in Montana. Looks like just an average Joe user with dialup, but that "stream" thing made me take a closer look.

So it looks like either "stream://1/" is used to view images and another one all together is to view pages. Is this some kind of proxy or firewall or ??? I haven't seen "stream" before. I've seen images viewed with Mozilla/3.01 only to turn around and become another UA and IP lots of times - but not "stream".

[volatilegx]

Why do you say the two hits are related? With different IP numbers, and the hits coming 11 minutes apart, I think they are unrelated.

[idiotgirl]

AH! I had my minutes and hours mixed up when I looked at it. (Maybe I should go to sleep earlier?) Instead of a typo I had a read-o.

Okay - so that leaves stream all by itself with no page view associated. Has anyone else seen this?

[Grumpus]

Haven't seen it, but it could be an image harvester. The reason it doesn't pull the page could be that it's getting it's URL's from something like Google Image Search or another one of those Image Surfer engines.

G.

[bird]

stream:// appears to be an experimental protocol identifier for multimedia applications:

[ftp.ics.uci.edu...]

Be proud: Your site has taken part in scientific research activities... ;)