if you are linking to an external stylesheet named stylesheet.css, then that stylesheet will be requested once for each page you serve that links to it, unless you have browser cacheing headers configured.
these logged requests are actually for the image.gif image which is referred to by the external stylesheet, most likely a background image used in the style sheet.

Hi phranque,
My site uses osCommerce for its shopping cart. Only those pages that are php pages will show the request for the stylesheet.css. The template I use came with a stylesheet.css, so I don't think I am linking to an external stylesheet. Most of the requests for this file do not have the footprint that these show. Here is a sample of the odd footprint:

70.57.228.nn - - [21/Feb/2011:12:17:01 -0400] "GET /folder/myimages/box_heading_b_4.gif HTTP/1.1" 200 50 "h**p://www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:01 -0400] "GET /folder/myimages/box_body_table_4.gif HTTP/1.1" 200 286 "h**p://www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:02 -0400] "GET /folder/myimages/box_heading_t_5.gif HTTP/1.1" 200 43 "h**p://www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:02 -0400] "GET /folder/myimages/box_heading_l1_5.gif HTTP/1.1" 200 176 "h**p://www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:02 -0400] "GET /folder/myimages/box_heading_c_5.gif HTTP/1.1" 200 96 "h**p://www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:02 -0400] "GET /folder/myimages/box_heading_r1_5.gif HTTP/1.1" 200 176 "www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"
70.57.228.nn - - [21/Feb/2011:12:17:02 -0400] "GET /folder/myimages/box_heading_b_5.gif HTTP/1.1" 200 50 "www.mysite.com/folder/stylesheet.css" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.1.17) Gecko/20110121 Firefox/3.5.17"

But usually I find the request for the stylesheet.css like this:

75.161.134.nnn - - [21/Feb/2011:16:57:17 -0400] "GET /folder/myimages/box_heading_r.gif HTTP/1.1" 200 117 "h**p://www.mysite.com/folder/index.php?cPath=239_47_342" "Mozilla/5.0 (iPad; U; CPU OS 4_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8F191 Safari/6533.18.5"
75.161.134.nnn - - [21/Feb/2011:16:57:17 -0400] "GET /folder/stylesheet.css HTTP/1.1" 200 20702 "h**p://www.mysite.com/folder/index.php?cPath=239_47_342" "Mozilla/5.0 (iPad; U; CPU OS 4_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8F191 Safari/6533.18.5"

Why do most visitors just show one request for that file and others show rows and rows of requests, all indicating a small .gif file? Since most of my visitors are accessing my osCommerce php files, why do some only show one request for the stylesheet.css and others are actually looking at the stylesheet.css file.

I apologize for not understanding all this. I had a friend install the osCommerce software and really do not understand php. But what was worrying me was the odd requests show the referer as my site and the folder where the stylesheet.css file is located. So if you paste that into Google, it actually shows the stylesheet.css file. I don't think a casual visitor is supposed to be able to see it. Or am I wrong here? Could you go to any site that uses php and look at their stylesheet.css file?

I hope I am making sense. Thank you for your help.

Grandma_genie

i have to admit i hadn't studied prior to this specifically how css images were requested.
perhaps it is a scraper spoofing the requests.
have you done any analysis of the requesting IPs or user agent strings to look for patterns there?

That is what I've been trying to do. I usually get about 3 or 4 visitors every day with the same footprint, but they all have different IPs and the user agent strings are similar, but not exactly the same. The only thing that is always the same is the browser is Firefox, so I was wondering if most webmasters are seeing most of their visitors using Firefox, or is this unusual? It used to be that most web users used IE. Is that still true, or have people started using Firefox and Safari. I also notice that most of the visitors to my site that are up to no good use Firefox. I also think that most of the people who are scraping and hacking are just too good at hiding behind fake IPs and fake user agents. What is a webmaster to do? Especially webmasters who have their sites on hosted servers.