Home / server / Questions / 323056
Accepted
troutwine
Asked: 2011-10-20 13:14:32 +0800 CST

Why would someone be doing a GETfor mail.live.com against my domain?

  • 772

Just today I've started to see in my web-server logs lines like this:

IP_WITHHELD - - [19/Oct/2011:20:47:04 +0000] "GET /providers/bookings HTTP/1.1" 500 21975 "http://co111w.col111.mail.live.com/mail/InboxLight.aspx?n=554012541" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"
IP_WITHHELD - - [19/Oct/2011:20:47:43 +0000] "GET /providers/bookings HTTP/1.1" 500 21976 "http://co111w.col111.mail.live.com/mail/InboxLight.aspx?n=1672240566" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1"

I don't run Live Mail, however. Someone is hitting my servers with the Host header set to mail.live.com, as you can see. What purpose does this serve?

security web-server

1 Answers

  1. Best Answer

    That's not the host header, that's the referrer.

    It means that someone clicked on a link in an email (or loaded a resource embedded in an email) that sent them to your site from the mail.live.com site.

    • 3