Visitors accessing stylesheet.css page

Most casual visitors do not access this page

[grandma genie]

Hello,

I find the following types of log entries in my server logs. Most of my visitors never access the stylesheet.css page. But everyday I get a series of visitors who do, and they all seem to have a similar user agent. They all use Firefox as a browser. I do not believe my stylesheet.css page should be accessible to the casual visitor. Why would they even want to see it? It is just a text page. Please take a look at these server log entries and tell me if this is normal. Thank you. - Grandma-genie

64.233.239.nnn - - [19/Feb/2011:08:00:57 -0400] "GET /image.gif HTTP/1.1" 200 43 "h**p://www.mysite.com/foldername/stylesheet.css" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 ( .NET CLR 3.5.30729)"
71.175.99.nn - - [19/Feb/2011:11:54:46 -0400] "GET /image.gif HTTP/1.1" 200 43 "h**p://www.mysite.com/foldername/stylesheet.css" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 (.NET CLR 3.5.30729)"
209.137.240.nnn - - [17/Feb/2011:10:46:26 -0400] "GET /image.gif HTTP/1.1" 200 93 "h**p://www.mysite.com/foldername/stylesheet.css" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 ( .NET CLR 3.5.30729; .NET4.0C)"
173.68.183.nn - - [17/Feb/2011:20:17:08 -0400] "GET /image.gif HTTP/1.1" 200 43 "h**p://www.mysite.com/foldername/stylesheet.css" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 ( .NET CLR 3.5.30729; .NET4.0C)"
110.174.94.nnn - - [19/Feb/2011:07:41:54 -0400] "GET /image.gif HTTP/1.1" 200 216 "h**p://www.mysite.com/foldername/stylesheet.css" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.14) Gecko/20110218 Firefox/3.6.14"
184.60.37.nn - - [18/Feb/2011:09:02:49 -0400] "GET /image.gif HTTP/1.1" 200 43 "h**p://www.mysite.com/foldername/stylesheet.css" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13"
68.8.186.nn - - [18/Feb/2011:13:31:31 -0400] "GET /image.gif HTTP/1.1" 200 93 "h**p://www.mysite.com/foldername/stylesheet.css" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15"
98.234.24.nnn - - [19/Feb/2011:18:12:59 -0400] "GET /image.gif HTTP/1.1" 200 43 "h**p://www.mysite.com/foldername/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
72.46.192.nn - - [17/Feb/2011:10:58:44 -0400] "GET /image.gif HTTP/1.1" 200 43 "h**p://www.mysite.com/foldername/stylesheet.css" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15"
65.172.69.nnn - - [18/Feb/2011:09:32:47 -0400] "GET /image.gif HTTP/1.1" 200 43 "h**p://www.mysite.com/foldername/stylesheet.css" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15"

[phranque]

if you are linking to an external stylesheet named stylesheet.css, then that stylesheet will be requested once for each page you serve that links to it, unless you have browser cacheing headers configured.
these logged requests are actually for the image.gif image which is referred to by the external stylesheet, most likely a background image used in the style sheet.

[grandma genie]

Hi phranque,
My site uses osCommerce for its shopping cart. Only those pages that are php pages will show the request for the stylesheet.css. The template I use came with a stylesheet.css, so I don't think I am linking to an external stylesheet. Most of the requests for this file do not have the footprint that these show. Here is a sample of the odd footprint:

70.57.228.nn - - [21/Feb/2011:12:17:01 -0400] "GET /folder/myimages/box_heading_b_4.gif HTTP/1.1" 200 50 "h**p://www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:01 -0400] "GET /folder/myimages/box_body_table_4.gif HTTP/1.1" 200 286 "h**p://www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:02 -0400] "GET /folder/myimages/box_heading_t_5.gif HTTP/1.1" 200 43 "h**p://www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:02 -0400] "GET /folder/myimages/box_heading_l1_5.gif HTTP/1.1" 200 176 "h**p://www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:02 -0400] "GET /folder/myimages/box_heading_c_5.gif HTTP/1.1" 200 96 "h**p://www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:02 -0400] "GET /folder/myimages/box_heading_r1_5.gif HTTP/1.1" 200 176 "www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:02 -0400] "GET /folder/myimages/box_heading_b_5.gif HTTP/1.1" 200 50 "www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"

But usually I find the request for the stylesheet.css like this:

75.161.134.nnn - - [21/Feb/2011:16:57:17 -0400] "GET /folder/myimages/box_heading_r.gif HTTP/1.1" 200 117 "h**p://www.mysite.com/folder/index.php?cPath=239_47_342" "Mozilla/5.0 (iPad; U; CPU OS 4_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8F191 Safari/6533.18.5"
75.161.134.nnn - - [21/Feb/2011:16:57:17 -0400] "GET /folder/stylesheet.css HTTP/1.1" 200 20702 "h**p://www.mysite.com/folder/index.php?cPath=239_47_342" "Mozilla/5.0 (iPad; U; CPU OS 4_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8F191 Safari/6533.18.5"

Why do most visitors just show one request for that file and others show rows and rows of requests, all indicating a small .gif file? Since most of my visitors are accessing my osCommerce php files, why do some only show one request for the stylesheet.css and others are actually looking at the stylesheet.css file.

I apologize for not understanding all this. I had a friend install the osCommerce software and really do not understand php. But what was worrying me was the odd requests show the referer as my site and the folder where the stylesheet.css file is located. So if you paste that into Google, it actually shows the stylesheet.css file. I don't think a casual visitor is supposed to be able to see it. Or am I wrong here? Could you go to any site that uses php and look at their stylesheet.css file?

I hope I am making sense. Thank you for your help.

Grandma_genie

[phranque]

i have to admit i hadn't studied prior to this specifically how css images were requested.
perhaps it is a scraper spoofing the requests.
have you done any analysis of the requesting IPs or user agent strings to look for patterns there?

[grandma genie]

That is what I've been trying to do. I usually get about 3 or 4 visitors every day with the same footprint, but they all have different IPs and the user agent strings are similar, but not exactly the same. The only thing that is always the same is the browser is Firefox, so I was wondering if most webmasters are seeing most of their visitors using Firefox, or is this unusual? It used to be that most web users used IE. Is that still true, or have people started using Firefox and Safari. I also notice that most of the visitors to my site that are up to no good use Firefox. I also think that most of the people who are scraping and hacking are just too good at hiding behind fake IPs and fake user agents. What is a webmaster to do? Especially webmasters who have their sites on hosted servers.