From: Mike N. 

On 25 May 2007 16:25:34 -0400, waldo kitty  wrote:

>localhost - - [02/May/2007:08:42:43 -0400] "GET /windowslinks.html
>HTTP/1.1" 200 12642 "-" "Mozilla/4.0 (compatible;
MSIE 6.0; Windows NT
>5.1; SV1; .NET CLR 1.1.4322)"
>
>there is absolutely _no_ way for that to be... first of all, there's no
>browser on that box... second of all, it flat out cannot run MSIE... thrid
>of all, it definitely is _not_ running windows of any kind (it
>=can't=!)...
>
>now, how can the origin of spoofed IPs be tracked back?

   See if there's a way to disable reverse DNS lookups in Apache for the
log.  Someone may have been able to control their reverse DNS lookup and
substituted 'localhost' for their real host name.

--- BBBS/NT v4.01 Flag-5