1

Just today I've started to see in my web-server logs lines like this:

IP_WITHHELD - - [19/Oct/2011:20:47:04 +0000] "GET /providers/bookings HTTP/1.1" 500 21975 "http://co111w.col111.mail.live.com/mail/InboxLight.aspx?n=554012541" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
IP_WITHHELD - - [19/Oct/2011:20:47:43 +0000] "GET /providers/bookings HTTP/1.1" 500 21976 "http://co111w.col111.mail.live.com/mail/InboxLight.aspx?n=1672240566" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"

I don't run Live Mail, however. Someone is hitting my servers with the Host header set to mail.live.com, as you can see. What purpose does this serve?

troutwine
  • 1,452
  • 5
  • 18
  • 33

1 Answers1

3

That's not the host header, that's the referrer.

It means that someone clicked on a link in an email (or loaded a resource embedded in an email) that sent them to your site from the mail.live.com site.

Shane Madden
  • 114,520
  • 13
  • 181
  • 251