From: "Geo." 

"waldo kitty"  wrote in message
news:Xns993D8F54CD27Eme42{at}216.144.1.254...

>>> localhost - - [02/May/2007:08:42:43 -0400] "GET /windowslinks.html
>>> HTTP/1.1" 200 12642 "-" "Mozilla/4.0
(compatible; MSIE 6.0; Windows NT
>>> 5.1; SV1; .NET CLR 1.1.4322)"

> can see by the logs, is the IP which is rDNS's to get the host name...

Do an nslookup on 216.144.26.33 and 26.34 which is my IP here. Do you
really think I have a DS3 to my house and do you really think I own that
domain?

rDNS is simple to fake. You get a static IP, call your ISP and tell them
what you want your rDNS to be. Of course if you do a forward lookup on the
rDNS response it won't resolve or won't match so you can tell it's spoofed
but for the most part nobody bothers checking unless you use something they
know isn't correct. I could easily make my rDNS read as localhost.

See if there is an option in your logging to log the IP instead of the
rDNS. That will give you a much more reliable way to see what's going on.

Geo.

--- BBBS/NT v4.01 Flag-5