Weird Raw Access Log Activity

[surfdean]

I was looking through my access logs today because my "thank you" page that comes up after someone sends me a message via a form showed a new hit in awstats, but I did not get the message. I have since tested the form, and it still works.

 

I did find this in my raw access logs that contained thankyou.html

 

152.163.101.8 - - [11/Mar/2005:11:18:06 -0500] "GET / HTTP/1.0" 200 5535 "http://www.google.com/search?hl=en&ie=ISO-8859-1&q=venus+surf+adventures" "Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

152.163.100.133 - - [11/Mar/2005:11:18:09 -0500] "GET /style.css HTTP/1.0" 200 1381 "http://surfvenus.com/"'>http://surfvenus.com/"'>http://surfvenus.com/" "Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

152.163.100.133 - - [11/Mar/2005:11:18:10 -0500] "GET /custom.js HTTP/1.1" 200 7377 "http://surfvenus.com/" "Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

152.163.100.137 - - [11/Mar/2005:11:18:13 -0500] "GET /js/awstats_misc_tracker.js HTTP/1.0" 404 1929 "http://surfvenus.com/" "Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

152.163.101.9 - - [11/Mar/2005:11:18:19 -0500] "GET /packages.htm HTTP/1.0" 200 13535 "-" "Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

152.163.100.202 - - [11/Mar/2005:11:18:21 -0500] "HEAD /thankyou.html HTTP/1.0" 200 0 "-" "-"

152.163.100.65 - - [11/Mar/2005:11:18:22 -0500] "GET /images/buynow.gif HTTP/1.0" 200 482 "http://www.surfvenus.com/packages.htm" "Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

 

Several things confuse me about this...

1 is that the addresses come from the same group of IP's, and their access times are within seconds of each other.

2 is that these are not all the normal listings for when a browser finds my site, i.e. the index.htm images and file do not appear.

3 is what does HEAD mean instead of GET?

 

any ideas as to what this was?

 

TIA,

dean

[annie]

These are normal when an AOL user accesses your site.

 

They use proxies, and the numbers can change from access to access, in the same session. They also use HEAD to avoid having to fetch the whole document if it hasn't changed recently.

[surfdean]

Hi Annie-

Thanks for the info. I feel a *little* safer.

 

What I don't understand, though, is that they can't get to my thankyou.html page without running the dodosmail php script to send a form based email to me.

 

i.e. After the message has been sent, the user is redirected to the thankyou.html page, and there is no other way to get there... Would AOL's users still grab the HEAD?

 

dean

[annie]

If someone else from AOL has subscribed before, sure.

[surfdean]

If someone else from AOL has subscribed before, sure.

<{POST_SNAPBACK}>

I believe someone did use the form via AOL, so that's that.

 

I guess I underestimate the "smartness" of AOL's caching/proxies. It must pull the HEADs off of the forms whether used or not... but that makes sense.

 

thanks annie,

dean