[LINK] RFI: HTTP 'GET favicon' requests from Google Toolbar

[Scott Howard]

On Sun, Apr 19, 2009 at 4:00 PM, Roger Clarke <Roger.Clarke at xamax.com.au>wrote:

> I'm aware what a 'favicon' is.  (Fairy-floss - but not stupid -
> cocked up by Microsoft, with subsequent attempts by real people to
> get it back on track:  http://en.wikipedia.org/wiki/Favicon )


Given that you're asking the question, I'm guessing you're not actually
aware what it is (unfortunately that Wikipedia page isn't much help).

In your favourite web browser, go to http://www.google.com/

Now next to the URL bar in the web browser, you'll see a nice colourful "G"
image - that is favicon.ico

To prove it to yourself, go to http://www.google.com/favicon.ico and you'll
see the exact same image.

Whenever you go to a new website, most browsers will attempt to download
that file in order to display a unique icon for the site.  Obviously they
can't tell if it's there without actually requesting it, so they will
request it regardless of whether it's ever existed or not.  Originally it
was only used when you bookmarked a URL (or in Microsoft speak, put it into
your "Favorites", thus the name), but most browsers today display it for all
sites.

72.148.51.47 - - [19/Apr/2009:00:48:30 +1000] "GET
> /people/Roger.Clarke/DV/favicon.ico HTTP/1.1" 301 328
> "/people/Roger.Clarke/DV/favicon.ico" - 0 "-" "Mozilla/4.0
> (compatible; GoogleToolbar 5.0.2124.4372; Windows 6.0; MSIE
> 7.0.6001.18000)"


That's not GoogleToolbar.  That's Microsoft Internet Explorer 7 (MSIE 7.0),
which happens to have Google Toolbar installed.

  Scott.