+1 862 207 3288 CJST6604/4524 Investigation Scenario #1 Fall 2015
Note: the following scenario is fictional as are all parties named in the story
Initial Complaint: October 12, 2015– 8:41 AM.
Mary Jones, a junior at the University of New Haven has contacted local police stating that sometime between midnight on October 11th,
2015and 8 am on October 12, 2015her ex-fiancé, Pete Sampson, posted seminude pictures of Ms. Jones on his Facebook page and also called Ms.
Jones several derogatory names on Facebook. Ms. Jones is very upset as many other students at the university have already seen and commented
on her picture on Facebook. She feels that Mr. Sampson posted the picture as a way of harassing and humiliating her. As a criminal justice
major, Ms. Jones is worried that Mr. Sampson’s postings may hurt her future career so she has contacted the local authorities.
In-person interview with Mary Jones: October 12, 2015– 9:30am
Mary Jones is a 20 year-old criminal justice major at the University of New Haven in her junior year at the school. At approximately 8:00am
this morning, one of her friends texted Ms. Jones and asked her if she had checked out her ex-fiancé, Peter Sampson’s, Facebook page. When
Ms. Jones loaded Mr. Sampson’s Facebook page she found a semi-nude picture of herself as well as derogatory comments about herself. When
questioned about the origin of the picture, Ms. Jones stated that she had “sexted” the photo to Mr. Sampson sometime in the fall of 2013 when
she and Mr. Sampson had just started to date. Ms. Jones also stated that she was only 17 years old at the time of the picture.
Upon further questioning, Ms. Jones explained that she had Mr. Sampson had met in early September of their freshman year and had started
dating immediately. While they had become engaged over the previous summer, Ms. Jones had broken off the engagement several weeks ago and
had begun dating Mr. Sampson’s roommate, Michael Davis. Ms. Jones felt that Mr. Sampson had posted the picture in retaliation to her ending
their relationship and that the purpose of Mr. Sampson posting the picture was to harass her and to cause harm to her reputation and to her
potential career in law enforcement.
In-person interview with Peter Sampson: October 12, 2015– 2:45 pm.
Peter Sampson is a 21 year-old criminal justice major in his junior year at the University of New Haven. During the interview, which took
place in Mr. Sampson’s dorm room, Mr. Sampson confirmed that he and Ms. Jones had dated and that the relationship ended abruptly several
weeks ago when Mr. Sampson discovered Ms. Jones in bed with Mr. Sampson’s roommate, Michael Davis. While Mr. Sampson was still visibly angry
with Ms. Jones, he denied having anything to do with posting her picture and making comments about Ms. Jones on his Facebook page.
Mr. Sampson further stated that following his discovery of Ms. Jones with Mr. Davis, Mr. Sampson deleted all of the digital photos he had of
Ms. Jones as well as all correspondence between himself and Ms. Jones.
Mr. Sampson claims to have used one Toshiba laptop computer that was a high school graduation gift for the past 3 years and that no one else
has had access to the laptop over the past 24-hour period.
When asked if anyone else had access to his computer in the past, Mr. Sampson stated that in Spring semester of 2015he had loaned the laptop
to his roommate, Michael Davis, so Mr. Davis could complete a paper because Mr. Davis’s laptop computer had been damaged and Mr. Davis had
not yet gotten a new computer.
Mr. Sampson again adamantly denied posting Ms. Jones’s picture on his Facebook page though he admitted that he had left the picture on his
page until contacted by law enforcement. When asked who he thought might have posted the picture, Mr. Sampson stated that he believed that
his roommate, Michael Davis, had posted the picture to get back at Mr. Sampson because of continuing hostilities between the two roommates
following Mr. Sampson’s discovery of Ms. Jones with Mr. Davis. Officers did notice that Mr. Sampson had several “sticky” notes on his desk
that contained his passwords for several online accounts including that of Facebook.
As officers were preparing to leave, Mr. Sampson’s roommate, Michael Davis, returned to the room. When questioned about Mr. Sampson’s
allegations that Mr. Davis had posted Ms. Jones picture, Mr. Davis denied any knowledge of the picture or of Mr. Sampson’s Facebook password.
Mr. Davis stated that Mr. Sampson was trying to “pin” the posting of the picture of Ms. Jones on him in an attempt to get Ms. Jones back.
When officers asked Mr. Davis about using Mr. Sampson’s laptop the previous Spring, Mr. Davis claimed that he did not remember whether or not
he had ever used Mr. Sampson’s computer. Mr. Davis then stated he had to go to class and abruptly left.
Assignment
Your team of computer crime investigators has been assigned this case. Your goal is to attempt to determine who posted Mary Jones’s photo on
Facebook. In gathering evidence your team should consider doing the following:
1) A whois search to determine who to contact at the University of New Haven and at Facebook for log files
2) Find out what is Facebook’s policy regarding their log files and requests from law enforcement. Also, does UNH have such a policy?
3) What type of log files will you need and from where? Will you need to get a subpoena, a court order, a search warrant, etc. to get
the log files you need?
4) Will you need further evidence or interviews with any of the parties involved? If so, which individuals would you question or what
evidence would you need to obtain?
5) If you decide you can determine who posted the photo, what crime or crimes would you charge the individual with?
6) Using the log files provided, lay out the time line for the crime and state who is the most likely perpetrator
Note: Make sure to document every step you have taken in the investigation and include all of the evidence that you gathered, including how
you obtained the evidence.
Hint: UNH’s IP address is 207.198.97.26 – you may want to try searching for it 222.187.232.72 – – [12/Oct/2015:00:00:20 -0500] “POST
/Netforms.acgi$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-” “Microsoft URL Control – 6.00.8862” 58.60.26.125 – –
[12/Oct/2015:00:01:12 -0500] “POST /Netforms.acgi$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-” “Microsoft URL Control – 6.00.8862”
222.137.88.247 – – [12/Oct/2015:00:01:39 -0500] “POST /Netforms.acgi$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-” “Microsoft URL
Control – 6.00.8862” 24.144.16.155 – – [12/Oct/2015:00:01:51 -0500] “GET /MiscQuilting/QuillowDirections.html HTTP/1.1” 200 155
“http://www.straw.com/quilting/articles/quillows.html” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)” 24.144.16.155
– – [12/Oct/2015:00:01:52 -0500] “GET /favicon.ico HTTP/1.1” 200 2558 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR
1.1.4322)” 74.6.7.119 – – [12/Oct/2015:00:02:26 -0500] “GET /Clothing.html HTTP/1.0” 200 111 “-” “Mozilla/5.0 (compatible; Yahoo! Slurp;
http://help.yahoo.com/help/us/ysearch/slurp)” 217.212.224.145 – – [12/Oct/2015:00:03:51 -0500] “GET /robots.txt HTTP/1.0” 200 146 “-”
“psbot/0.1 (+http://www.picsearch.com/bot.html)” 217.212.224.182 – – [12/Oct/2015:00:03:54 -0500] “GET
/SuesClasses/UNHCS107/Lectures/Lecture3.html HTTP/1.0” 200 8549 “-” “psbot/0.1 (+http://www.picsearch.com/bot.html)” 58.63.128.62 – –
[12/Oct/2015:00:05:00 -0500] “GET / HTTP/1.1” 200 5510 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)” 58.63.128.62 – –
[12/Oct/2015:00:05:09 -0500] “GET /STATSHEAD.HTML HTTP/1.1” 200 25341 “http://www.ttsw.com” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.1; SV1)” 58.63.128.62 – – [12/Oct/2015:00:05:11 -0500] “GET /gifs/TvTi.gif HTTP/1.1” 200 625 “http://www.ttsw.com/STATSHEAD.HTML”
“Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)” 69.249.34.24 – – [12/Oct/2015:00:05:41 -0500] “GET
/MiscQuilting/QuillowDirections.html HTTP/1.1” 200 155 “http://www.straw.com/quilting/articles/quillows.html” “Mozilla/5.0 (Macintosh; U; PPC
Mac OS X; en) AppleWebKit/419 (KHTML, like Gecko) Safari/419.3” 69.249.34.24 – – [12/Oct/2015:00:05:41 -0500] “GET /favicon.ico HTTP/1.1” 200
2558 “-” “Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/419 (KHTML, like Gecko) Safari/419.3” 116.76.76.68 – –
[12/Oct/2015:00:05:59 -0500] “POST /Netforms.acgi$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-” “Microsoft URL Control – 6.00.8862”
219.148.87.53 – – [12/Oct/2015:00:08:04 -0500] “GET / HTTP/1.1” 200 5510 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)”
219.147.36.144 – – [12/Oct/2015:00:08:46 -0500] “GET / HTTP/1.1” 200 5510 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)”
72.36.114.246 – – [12/Oct/2015:00:09:06 -0500] “GET /SuesClasses/GCCCSC101/GoWordFiles/chapter_03/w03D_Announcement.doc HTTP/1.0” 200 25088
“-” “CazoodleBot/CazoodleBot-0.1 (CazoodleBot Crawler; http://www.cazoodle.com/cazoodlebot; cazoodlebot@cazoodle.com)” 72.36.114.246 – –
[12/Oct/2015:00:09:45 -0500] “GET /robots.txt HTTP/1.0” 200 146 “-” “CazoodleBot/CazoodleBot-0.1 (CazoodleBot Crawler;
http://www.cazoodle.com/cazoodlebot; cazoodlebot@cazoodle.com)” 72.36.114.246 – – [12/Oct/2015:00:09:45 -0500] “GET
/SuesClasses/GCCCSC101/HelpDesk/Unit2HelpDeskCall01.doc HTTP/1.0” 200 45056 “-” “CazoodleBot/CazoodleBot-0.1 (CazoodleBot Crawler;
http://www.cazoodle.com/cazoodlebot; cazoodlebot@cazoodle.com)” 58.49.128.87 – – [12/Oct/2015:00:10:47 -0500] “GET / HTTP/1.1” 200 5510 “-”
“Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)” 72.30.179.215 – – [12/Oct/2015:00:11:09 -0500] “GET
/QuestionOfTheWeek/2000/0417.html HTTP/1.0” 304 – “-” “Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)”
74.6.27.106 – – [12/Oct/2015:00:12:23 -0500] “GET /Blocks/Templates/ HTTP/1.0” 200 507 “-” “Mozilla/5.0 (compatible; Yahoo! Slurp;
http://help.yahoo.com/help/us/ysearch/slurp)” 222.187.99.178 – – [12/Oct/2015:00:12:25 -0500] “GET / HTTP/1.1” 200 5510 “-” “Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1)” 222.187.247.48 – – [12/Oct/2015:00:13:13 -0500] “POST /Netforms.acgi
$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-” “Microsoft URL Control – 6.00.8862” 74.6.24.157 – – [12/Oct/2015:00:14:10 -0500] “GET
/SuesClasses/GCCCSC101/WordTest.html HTTP/1.0” 304 – “-” “Mozilla/5.0 (compatible; Yahoo! Slurp;
http://help.yahoo.com/help/us/ysearch/slurp)” 74.6.25.72 – – [12/Oct/2015:00:15:28 -0500] “GET /Foundations/ThemeBlocks/Hearts/LogHeart.html
HTTP/1.0” 304 – “-” “Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)” 24.18.162.91 – –
[12/Oct/2015:00:18:19 -0500] “GET /MiscQuilting/QuillowDirections.html HTTP/1.1” 200 155
“http://www.straw.com/quilting/articles/quillows.html” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)”
24.18.162.91 – – [12/Oct/2015:00:18:19 -0500] “GET /favicon.ico HTTP/1.1” 200 2558 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
SV1; .NET CLR 1.1.4322)” 74.6.29.30 – – [12/Oct/2015:00:19:24 -0500] “GET /SuesClasses/UNHCS107/Presentations/?S=D HTTP/1.0” 200 2169 “-”
“Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)” 70.20.212.116 – – [12/Oct/2015:00:19:52 -0500] “GET
/HenrysSheep/PlayBillSheep.gif HTTP/1.1” 200 8064 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)” 60.180.19.61 –
– [12/Oct/2015:00:21:41 -0500] “GET / HTTP/1.1” 200 5510 “http://www.baidu.com/s?tn=site888_pg&ct=&lm=-1&kw=&word=www.ttsw.com” “Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1)” 125.113.113.11 – – [12/Oct/2015:00:23:38 -0500] “GET / HTTP/1.1” 200 5510 “-” “Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1)” 202.142.149.109 – – [12/Oct/2015:00:25:48 -0500] “GET
/SuesClasses/GCCCSC101/LectureOverview.html HTTP/1.0” 200 3291 “http://www.google.com.pk/search?hl=en&q=+introduction+of+computers+
+lectures&meta=” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)” 202.142.149.109 – – [12/Oct/2015:00:25:49 -0500] “GET
/SuesClasses/FullMoon.JPG HTTP/1.0” 200 6106 “http://www.ttsw.com/SuesClasses/GCCCSC101/LectureOverview.html” “Mozilla/4.0 (compatible; MSIE
7.0; Windows NT 5.1)” 202.142.149.109 – – [12/Oct/2015:00:25:49 -0500] “GET /SuesClasses/GCCCSC101/logo-blue.jpg HTTP/1.0” 200 16974
“http://www.ttsw.com/SuesClasses/GCCCSC101/LectureOverview.html” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)” 202.142.149.109 – –
[12/Oct/2015:00:25:51 -0500] “GET /favicon.ico HTTP/1.0” 200 2558 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)” 60.190.35.2 – –
[12/Oct/2015:00:26:23 -0500] “GET / HTTP/1.1” 200 5510 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; cafe8)” 61.190.155.4 – –
[12/Oct/2015:00:26:52 -0500] “GET / HTTP/1.1” 200 5510 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0(Compatible
Mozilla/4.0(Compatible-EmbeddedWB 14.59 http://bsalsa.com/ EmbeddedWB- 14.59 from: http://bsalsa.com/ ; Mozilla/4.0(Compatible
Mozilla/4.0EmbeddedWB- 14.59 from: http://bsalsa.com/ )” 12.163.40.38 – – [12/Oct/2015:00:28:04 -0500] “GET /favicon.ico HTTP/1.1” 200 2558
“-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; Windows-Media-
Player/10.00.00.3990)” 12.163.40.38 – – [12/Oct/2015:00:28:04 -0500] “GET /FWFanatics/FWFanatics.html HTTP/1.1” 301 436
“http://www.geocities.com/Heartland/Flats/9713/links1.htm?200731” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET
CLR 2.0.50727; .NET CLR 3.0.04506.30; Windows-Media-Player/10.00.00.3990)” 121.229.85.196 – – [12/Oct/2015:00:28:33 -0500] “POST
/Netforms.acgi$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-” “Microsoft URL Control – 6.00.8862” 207.118.217.118 – –
[12/Oct/2015:00:28:41 -0500] “GET /cpgdc HTTP/1.1” 200 95 “http://www.warmingfamilies.org/crocheted_squares.aspx” “Mozilla/4.0 (compatible;
MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)” 207.118.217.118 – – [12/Oct/2015:00:28:41 -0500] “GET /favicon.ico HTTP/1.1” 200 2558 “-”
“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)” 218.28.179.100 – – [12/Oct/2015:00:29:13 -0500] “GET / HTTP/1.1” 200
5510 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)” 74.6.8.71 – – [12/Oct/2015:00:30:11 -0500] “GET /robots.txt HTTP/1.0” 200
146 “-” “Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)” 74.6.8.71 – – [12/Oct/2015:00:30:12 -0500] “GET
/SuesClasses/UNHCS107/index.html HTTP/1.0” 200 15497 “-” “Mozilla/5.0 (compatible; Yahoo! Slurp;
http://help.yahoo.com/help/us/ysearch/slurp)” 222.221.90.5 – – [12/Oct/2015:00:30:25 -0500] “GET / HTTP/1.1” 200 5510 “-” “Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)” 202.142.149.109 – – [12/Oct/2015:00:30:27 -0500] “GET
/SuesClasses/GCCCSC101/Lectures/WeekOne.html HTTP/1.0” 200 3724 “http://www.ttsw.com/SuesClasses/GCCCSC101/LectureOverview.html” “Mozilla/4.0
(compatible; MSIE 7.0; Windows NT 5.1)” 222.221.90.5 – – [12/Oct/2015:00:30:29 -0500] “GET / HTTP/1.1” 206 5510 “-” “Mozilla/4.0 (compatible;
MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)” 65.55.235.219 – – [12/Oct/2015:00:30:39 -0500] “GET /quilt.html HTTP/1.0” 301 419 “-”
“msnbot-media/1.0 (+http://search.msn.com/msnbot.htm)” 60.6.153.177 – – [12/Oct/2015:00:30:41 -0500] “POST /Netforms.acgi
$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-” “Microsoft URL Control – 6.00.8862” 60.6.153.177 – – [12/Oct/2015:00:31:34 -0500] “POST
/Netforms.acgi$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-” “Microsoft URL Control – 6.00.8862” 202.142.149.109 – –
[12/Oct/2015:00:36:14 -0500] “GET /SuesClasses/GCCCSC101/default.html HTTP/1.0” 200 19778
“http://www.ttsw.com/SuesClasses/GCCCSC101/Lectures/WeekOne.html” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)” 202.142.149.109 – –
[12/Oct/2015:00:36:15 -0500] “GET /SuesClasses/Quizzical.JPG HTTP/1.0” 200 20772 “http://www.ttsw.com/SuesClasses/GCCCSC101/default.html”
“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)” 202.142.149.109 – – [12/Oct/2015:00:36:16 -0500] “GET /SuesClasses/ItsMyChair.JPG
HTTP/1.0” 200 17491 “http://www.ttsw.com/SuesClasses/GCCCSC101/default.html” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)”
222.183.89.136 – – [12/Oct/2015:00:38:02 -0500] “GET / HTTP/1.1” 200 5510 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)”
222.183.89.136 – – [12/Oct/2015:00:38:10 -0500] “GET /MainQuiltingPage.html HTTP/1.1” 301 423 “http://www.ttsw.com/” “Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1)” 207.200.116.200 – – [12/Oct/2015:00:38:52 -0500] “GET /MiscQuilting/QuillowDirections.html
HTTP/1.1” 200 155 “http://www.straw.com/quilting/articles/quillows.html” “Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1;
.NET CLR 1.1.4322)” 218.20.134.239 – – [12/Oct/2015:00:39:57 -0500] “POST /Netforms.acgi$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-”
“Microsoft URL Control – 6.00.8862” 116.24.81.12 – – [12/Oct/2015:00:43:45 -0500] “POST /Netforms.acgi$/Classifieds/MakePostSale.fdml
HTTP/1.1” 301 423 “-” “Microsoft URL Control – 6.00.8862” 70.247.146.179 – – [12/Oct/2015:00:44:06 -0500] “GET /cpgdc HTTP/1.1” 200 95
“http://www.warmingfamilies.org/wf-granny.html” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; Media Center PC 4.0; .NET CLR 3.0.04506.30; InfoPath.1)” 70.247.146.179 – – [12/Oct/2015:00:44:06 -0500] “GET
/favicon.ico HTTP/1.1” 200 2558 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR
2.0.50727; Media Center PC 4.0; .NET CLR 3.0.04506.30; InfoPath.1)” 70.247.146.179 – – [12/Oct/2015:00:44:10 -0500] “GET
/Crochet/GrannysDaughter/AssembleMotifs.html HTTP/1.1” 200 171 “http://www.warmingfamilies.org/wf-granny.html” “Mozilla/4.0 (compatible; MSIE
7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; Media Center PC 4.0; .NET CLR 3.0.04506.30; InfoPath.1)”
216.104.33.150 – – [12/Oct/2015:00:47:42 -0500] “GET /HenrysSheep/PlayBillSheep.gif HTTP/1.0” 200 8064 “-” “-” 65.55.235.219 – –
[12/Oct/2015:00:48:02 -0500] “GET /History/AmericanQuiltStudyGroup.html HTTP/1.0” 200 157 “-” “msnbot-media/1.0
(+http://search.msn.com/msnbot.htm)” 74.6.8.104 – – [12/Oct/2015:00:50:45 -0500] “GET /nhtravel HTTP/1.0” 200 103 “-” “Mozilla/5.0
(compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)” 193.252.149.16 – – [12/Oct/2015:00:50:55 -0500] “GET /robots.txt
HTTP/1.1” 200 146 “-” “Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1) VoilaBot BETA 1.2 (http://www.voila.com/)” 193.252.149.16 – –
[12/Oct/2015:00:51:08 -0500] “GET /Mystery108/?N=D HTTP/1.1” 200 480 “-” “Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1) VoilaBot
BETA 1.2 (http://www.voila.com/)” 72.29.71.252 – – [12/Oct/2015:00:51:14 -0500] “GET /MainQuiltingPage.html HTTP/1.0” 301 419 “-” “-”
222.187.232.72 – – [12/Oct/2015:00:51:20 -0500] “POST /Netforms.acgi$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-” “Microsoft URL
Control – 6.00.8862” 125.78.8.81 – – [12/Oct/2015:00:52:29 -0500] “GET / HTTP/1.1” 200 5510 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows
NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727; .NET CLR 1.1.4322)” 125.78.8.81 – – [12/Oct/2015:00:52:32 -0500] “GET / HTTP/1.1” 200 5510
“-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; .NET CLR 2.0.50727; .NET CLR 1.1.4322)” 125.78.8.81 – –
[12/Oct/2015:00:52:35 -0500] “GET /favicon.ico HTTP/1.1” 200 2558 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
TencentTraveler ; .NET CLR 2.0.50727; .NET CLR 1.1.4322)” 60.6.153.177 – – [12/Oct/2015:00:53:29 -0500] “POST /Netforms.acgi
$/Classifieds/MakePostSale.fdml HTTP/1.1” 301 423 “-” “Microsoft URL Control – 6.00.8862” 68.142.212.168 – – [12/Oct/2015:00:54:53 -0500]
“GET /robots.txt HTTP/1.0” 200 146 “-” “Yahoo-MMCrawler/3.x (mms dash mmcrawler dash support at yahoo dash inc dot com)” 68.142.212.168 – –
[12/Oct/2015:00:55:10 -0500] “GET /SuesClasses/GCCCSC110/ToolsBookCover.jpg HTTP/1.0” 200 10029 “-“
