More creepy visits to my web site...

[Atman]

Yesterday it was the CIA. I just found this entry tonight.
Check out the "Host Name" line. Do those initials
mean anything to you? Also, note the "Visit Length."
Although this entry is in a different format than the CIA
entry I posted yesterday, the full log shows visits on May 12
and May 14. While the CIA entry was from a Google search,
these are direct entries, or "No referring link"
line. IOW, no search or click from another site...they had my
addy and typed it in, or used a bookmark. I'm getting creeped
out again!

(PS: I xxx'd out the IP address line because it actually
provides some names and phone numbers, and ironically, I don't
feel comfortable posting them here and getting someone at DHS
pissed off at me!)


VISITOR ANALYSIS

Referring Link 	 	No referring link
Host Name 	 	pnxuser1.tsa.dhs.gov
IP Address 	 	xxx.xx.xxx.xx
Country 	 	United States
Region 	 	 	District Of Columbia
City 	 	 	Washington
ISP 	 	 	Ibm
Returning Visits 	0
Visit Length 	 	Multiple visits spread over more than one day

VISITOR SYSTEM SPECS

Browser 	 	MSIE 6.0
Operating System 	Windows XP
Resolution 	 	1024x768
Javascript 	 	Enabled

[section321]

1. TSA is the Transportation Security Administration

They control the airport screeners (among other things).

[Mythsaje]

2. Send 'em my way...

I don't care WHO visits.

Maybe they'll buy a book.

:evilgrin:

[FreakinDJ]

3. I was getting FBI hits out of the Philidelphia office

Its the search strings they use that bothers me the most.

But I got to admit it is better then the Gun group's urls.

[RoyGBiv]

4. Small point ...

With a URL, it takes about five seconds, including typing time, to find the IP.

Could just be an employee who likes to visit your site. I get hits from various .gov domains constantly, and I happen to know a lot of them are from people who work there and are just browsing or visiting my site because they use it.

This is one of the few instances you really shouldn't worry unless you are doing something illegal or have stored private, personal information on your web server somewhere, which you shouldn't do in the first place. Apparently your website is public, which means it's already catalogued -- or could be with one visit -- which means they don't *need* to hit your site directly to browse it for whatever purpose they might have.

[rumpel]

5. I also thought you may just have fans there

:)

[Recursion]

6. Why did you X out the IP address?

That's the only thing that allows actual tracing of the real source of the hit.

If I have reverse DNS authority for an IP block, I can set my IP address to have the PTR record "pnxuser1.tsa.dhs.gov". Only the actual IP address can tie a specific computer to an organization, because only IP allocations are actually documented and accountable.

[Atman]

8. Only because when I did a whois on it, it brought a guy's name and #

Call be a crazy liberal. I know it's "public" information, but only kinda-sorta. I just didn't see it as good form to make it easy for thousands of people to have this guy's telephone number. I'm not sure why...do unto others, I guess. I wouldn't appreciate it in the slightest if someone did that to me. I know it's odd, given the current situation. If you want it, it's easy enough to get for those who know how.

[Swamp Rat]

7. Maybe we'll be cellmates

:D :loveya: :rofl: