title: Please, explain this lines of Squid access.log:
body: <p>Thing is "205.185.216.42" is currently in our blacklist, so this lines of log triggers IPS. I don't know how to read them:</p>
  
  <pre><code>1239879844.243 2129 192.168.0.1 TCP_MISS/403 337 HEAD http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b5faeacb-5da7-4c5a-8ebb-5c419d82781f? - HIER_DIRECT/205.185.216.42
  1239879844.243 2729 192.168.0.2 TCP_TUNNEL/200 106460 CONNECT hwcdnssl.cedexis-test.com:443 - HIER_DIRECT/205.185.216.42 - 
  1239879844.243 1578 192.168.0.3 TCP_MISS/200 1317 GET http://apps.identrust.com/roots/dstrootcax3.p7c - HIER_DIRECT/192.35.177.64 application/x-pkcs7-mime 
  1239879844.243 1581 192.168.0.4 TCP_TUNNEL/200 87268 CONNECT script.hotjar.com:443 - HIER_DIRECT/205.185.216.42 - 
  </code></pre>
  
  <p>I don't understand how why all this connection logs include HIER_DIRECT/205.185.216.42? Is it means they are on host? Microsoft have their update server on one host along with hotjar.com? 
  Squid log manual says that HIER_DIRECT means "The object was fetched from the origin server".</p>
  
  <p>Please help</p>