Strangely getting hits from my own server IP!

[Muzaffer SehaC]

Hello,

I have a web hosting customer who objected to his billing telling that according to the logs most of the traffic is made by our own server's IP.. When I analyzed the customers website I have no doubt *he is* making the traffic, he doesn't use optimization or compression on JPEGs.. 2 MBs for single webpage, but that's another story.. I can't explain these hits to the customer so I can't bill it accordingly..

Below is a sample log of access_log. It seems that our server (88.90.90.105) is sending GET command to images.

Currently we are calculating both inbound and outbound traffic.

here's a sample log and these GET commands are happening every few seconds:

88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/3545198-o.jpg HTTP/1.0" 200 24415 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/4461709-d.jpg HTTP/1.0" 200 24054 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/4461709-o.jpg HTTP/1.0" 200 24073 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/9442867-d.jpg HTTP/1.0" 200 25165 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/9442867-o.jpg HTTP/1.0" 200 25182 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/5645495-d.jpg HTTP/1.0" 200 23214 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/5645495-o.jpg HTTP/1.0" 200 23237 "-" "-"
78.184.180.76 - - [23/Apr/2010:15:03:00 +0300] "GET /ilan/satilik-firma-1419.htm HTTP/1.1" 200 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6.3; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.30618; .NET CLR 3.5.30729)"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/3545198-d.jpg HTTP/1.0" 200 24395 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/3545198-o.jpg HTTP/1.0" 200 24415 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/4461709-d.jpg HTTP/1.0" 200 24054 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/4461709-o.jpg HTTP/1.0" 200 24073 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/9442867-d.jpg HTTP/1.0" 200 25165 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/9442867-o.jpg HTTP/1.0" 200 25182 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/5645495-d.jpg HTTP/1.0" 200 23214 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/5645495-o.jpg HTTP/1.0" 200 23237 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/3545198-o.jpg HTTP/1.0" 200 24415 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/4461709-o.jpg HTTP/1.0" 200 24073 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/9442867-o.jpg HTTP/1.0" 200 25182 "-" "-"
88.90.90.105 - - [23/Apr/2010:15:03:00 +0300] "GET /imagepool/5645495-o.jpg HTTP/1.0" 200 23237 "-" "-"

Why would our server fetch these images? How can I track this? I can't look at the php code since they are encoded with zend..so any suggestions?


I'd be very happy if anyone cares to help.. Thanks