Found this in a log... .121.181 - - [04/Feb/2000:11:09:24 -0500] "GET x) (Red Hat/LinhE HTTP/1.0" 400 276 "http://www.... .html" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)" Hmm, you have to ponder how a windows 98 user has the string "Red hat/Linux" in memory.... (this was preceeded with about a dozen lines of corrupt GET request's gotta love winders;)