Attrition Web Logs: A Study of Oddballs

Thu July 6 22:42:17 EST 2006

nepen & lyger

According to our meta tags, "Attrition.org is an eclectic collection of internet and computer security resources." Pages about security, movie reviews, poetry, statistics, and firearms are all available from the main page, but many others written long ago (and sometimes forgotten about, even by us) are still on the site. Despite our collective problems remembering every single piece of content on the site, we are constantly reminded of past transgressions, addictions, and general weirdness through the file known as "access_log." For various reasons, people far and wide use their favorite search engines to find something, anything, that will help them solve their "problem of the day." Every click on a link to attrition.org becomes a new member of our happy family, and that's where we come in, because we actually read those logs. We "just ain't right," but apparently many people who visit attrition.org have issues of their own to deal with.

To break some of these down, we have specific examples of search queries that not only led the searcher to attrition, but may also show a little bit of insight into the weirdness of those who find us:

Penis problems:

c-67-175-196-144.hsd1.il.comcast.net - - [03/Jun/2006:22:29:30 -0400] "GET /misc/ee/foreskin 
HTTP/1.1" 200 12090 "http://www.google.com/search?hl=en&q=my+dick+is+bleeding" "Mozilla/4.0 
(compatible; MSIE 6.0; America Online Browser 1.1; Windows NT 5.1; {708667E9-45D7-535A-16D8
-661E3B91A025}; .NET CLR 1.1.4322)"

Why is this guy not going to a HOSPITAL instead of finding us on Google?

eng-bertv.eng.uwo.ca - - [31/May/2006:11:08:25 -0400] "GET /quotes/dc.html HTTP/1.1" 200 
12185 "http://www.google.ca/search?hl=en&client=firefox-a&rls=org.mozilla:en-US:official_s
&sa=X&oi=spell&resnum=0&ct=result&cd=1&q=my+girlfriend+wont+suck+my+dick&spell=1" "Mozilla/5.0 
(Windows; U; Win98; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2"

Because you spend to much time on teh intarweb and Google? Try sticking your dick in her mouth FIRST.


fuckfuckfuckfuckfuck:

cpe-68-173-47-112.nyc.res.rr.com - - [28/Feb/2006:20:17:26 -0500] GET/fuck/HTTP/1.1 200 688
"http://www.google.com/search?q=fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck+
fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck+fuck Mozilla/5.0 
(Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1

One more 'fuck' and you would have gotten the secret page with porn!

dsl-72-1-217.248.tel-ott.com - - [15/Jun/2006:15:39:37 -0400] "GET /fuck/ HTTP/1.1" 200 688 
"http://www.google.com/search?q=Fuck+fuck+fuck+Fuck+fuck+fuck+Fuck+fuck+fuck+Fuck+fuck+fuck
+Fuck+fuck+fuck+Fuck+fuck+fuck+Fuck+fuck+fuck+Fuck+fuck+fuck+Fuck+fuck+fuck+Fuck+fuck+fuck+&
sourceid=mozilla-search&start=0&start=0&ie=utf-8&oe=utf-8" "Mozilla/5.0 (Windows; U; Windows 
NT 5.1; en-US; rv:1.7.13) Gecko/20060414"

They're like Lay's potato chips... one isn't enough. Apparently, neither are ten...


H4x0rz:

cache-los-ae01.proxy.aol.com - - [20/Jun/2006:15:56:14 -0400] "GET /pipermail/isn/2006-
April/002877.html HTTP/1.1" 200 4758 "http://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q
=how+do+you+hack+into++the+american+defense+system" "Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; 
Windows NT 5.1; SV1)"

Why an AOL'er is even bothering with this is beyond us. OMFG PH34R M4H 1337 M4D AIM 5k1LLz!!

c-68-53-18-70.hsd1.tn.comcast.net - - [15/Jun/2006:22:59:40 -0400] "GET /errata/www/art.0069.html 
HTTP/1.1" 200 8521 "http://www.google.com/search?q=how+to+ping+of+death+someone&hl=en&lr=&start=
10&sa=N" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

If you can't kill a system, go for a person.. MONSTER KILL! (tm Unreal Tournament)


What I do on company time:

mail.creative-realities.com - - [08/Jun/2006:16:31:24 -0400] "GET /mirror/attrition/2000/
09/07/www.rydercup.com HTTP/1.1" 301 404 "http://images.search.yahoo.
com/search/images/view?back=http%3A%2F%2Fimages.search.yahoo.com%2Fsearch%2Fimages%3Fp%3D
male%2520pubic%2520hair%26ei%3DUTF-8%26fr%3DFP-tab-web-t400%26x%3Dwrt%26fr2%3Dtab-web&w=384&h
=576&imgurl=www.attrition.org%2Fmirror%2Fattrition%2F2000%2F09%2F07%2Fwww.rydercup.com%2F
male464.jpg&rurl=http%3A%2F%2Fwww.attrition.org%2Fmirror%2Fattrition%2F2000%2F09%2F07%2F
www.rydercup.com&size=26.8kB&name=male464.jpg&p=male+pubic+hair&type=jpeg&no=5&tt=120&ei
=UTF-8" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

"Male pubic hair" and "creative realities"... we suggest a mohawk.

69.7.46.2 - - [02/Jun/2006:00:13:04 -0400] "GET /postal/z/029/0670.html HTTP/1.1" 200 15714 
"http://www.google.com/search?hl=en&lr=&q=down+syndrome+fucking&btnG=Search" 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

It just doesn't get any better than internet access from the office, does it?


/dev/random:

host.144.nat.nycboe.org - - [14/Jun/2006:10:33:13 -0400] "GET /attrition/staff/ 
HTTP/1.0" 200 18876 "http://www.google.com/search?hl=en&lr=&q=is+the+frog%27s+ass+really+watertight" 
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1; .NET CLR 1.1.4322; 
.NET CLR 2.0.50727)"

Ladies and gents, the New York City Department of Education wants to know... AND WE KIN HELP DEM!

69-162-195-15.bflony.adelphia.net - - [02/Jun/2006:22:00:31 -0400] "GET /fuck/www/fuck0433.htm 
HTTP/1.1" 200 25493 "http://www.ask.com/web?q=how+to+fuck+a+pregnant+women
&qsrc=0&o=312" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

Sometimes, even the weird gets weirder. We're just passive observers... with a coathanger.


It doesn't end here. If we feel really motivated, we may dive into the sixteen gigs of compressed web logs dating back to 1998.


main page ATTRITION feedback