Ie - http://www.site(1).com/site(2)'s_page.html All internal sites in question are virtual sites sharing the same IP. The Raq was recently rebuilt (yep - the lionworm got us) from the Cobalt OS Restore CD, and all patches up to, but not including Kernel update 4.0.1; plus portsentry and logcheck. Any thoughts or ideas? Thanks, Patrick