Can one override HttpContext.Current.Request.Url.AbsoluteUri?

We have a system that logs events that occur on our website in a table.

It currently records all the events with 开发者_开发百科a description of what is going on, and a reference of the page's property found in

HttpContext.Current.Request.Url.AbsoluteUri

I have just spotted an HttpContext.Current.Request.Url.AbsoluteUri from a server we do not own "http://ya.ru/Default.aspx"

Also recorded in this table is the Thread ID (Threading.Thread.CurrentThread.ManagedThreadId) (which is recorded as thread 1) and a sessionID (HttpContext.Current.Session.SessionID).

How can this unsolicited server be running stuff on our site, does it mean they have access to our code, or can you legitimately override HttpContext.Current.Request.Url.AbsoluteUri? If not is it possible to drop HttpContext.Current?

Apart from running a few database queries, they also seem to be running some usercontrols!?

It seems to be a russian search engine, but i'm not sure how they are somehow overwriting our Page Parameter.

Here is the code that set's the PAGE parameter for the logging routine:

            Dim threadID As Integer
            If Not HttpContext.Current Is Nothing Then
                Page = HttpContext.Current.Request.Url.AbsoluteUri ' & "/" & HttpContext.Current.Request.RawUrl '& HttpContext.Current.Request.Path
                Integer.TryParse(Threading.Thread.CurrentThread.ManagedThreadId, threadID)
                If Not HttpContext.Current.Session Is Nothing Then
                    Try
                        Session = HttpContext.Current.Session.SessionID
                    Catch
                        Session = "empty"
                    End Try
                End If
            Else
                Page = MyPageName
            End If

Any ideas?

---

Is your server setup to handle any host header passed to it? Drop to a command line and run this, changing 123.123.123.123 to your server's IP and /Page.aspx to whatever page you're trying to hit but leave the domain as is.

telnet 123.123.123.123 80
GET /Page.aspx HTTP/1.1
HOST: www.example.com

Check your logs and if you see www.example.com then IIS is setup with a 'default site' that handles any requests directed to it.