Security Incidents: RE: Automated scan-for-webserver-vulns tool ?

From: Steve Halligan <agent33_at_geeksquad.com>
Date: Thu, 4 Oct 2001 11:04:19 -0500

Looks like Whisker to me.
http://www.wiretrip.net/rfp/p/doc.asp?id=21&iface=2

> -----Original Message-----
> From: Guy Poizat [mailto:poizat_at_partsonline.fr]
> Sent: Thursday, October 04, 2001 8:07 AM
> To: incidents_at_securityfocus.com
> Subject: Automated scan-for-webserver-vulns tool ?
>
>
> Hi,
>
> Got these entries (2 times same day from different IPs) in an
> access.log
> (among tons of Nimda requests, of course).
> Anybody know what kind of kiddietool does that ?
>
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
> 64.226.243.16 - - [24/Sep/2001:08:26:06 +0200] "GET /
> HTTP/1.1" 200 5525
> "-" "-"
> 64.226.243.16 - - [24/Sep/2001:08:26:07 +0200] "HEAD
> /qweiop43809442fsfjflr.html HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:26:07 +0200] "GET /
> HTTP/1.1" 200 5525
> "-" "-"
> 64.226.243.16 - - [24/Sep/2001:08:26:08 +0200] "HEAD
> /../../etc/passwd
> HTTP/1.1" 400 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:26:09 +0200] "HEAD
> /../../../../../etc/passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:26:09 +0200] "HEAD
> /../../../../etc/passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:26:10 +0200] "HEAD
> /../../../etc/passwd
> HTTP/1.1" 400 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:26:10 +0200] "HEAD /../../passwd
> HTTP/1.1" 400 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:26:10 +0200] "HEAD /../../shadow
> HTTP/1.1" 400 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:05 +0200] "GET
> /NULL.printer HTTP/1.1"
> 404 6241 "-" "-"
> 64.226.243.16 - - [24/Sep/2001:08:27:22 +0200] "HEAD /cgi/
> HTTP/1.1" 403 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:23 +0200] "HEAD
> /admin-serv/config/admpw HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:23 +0200] "HEAD
> /publisher HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:23 +0200] "HEAD /whois_raw.cgi
> HTTP/1.1" 403 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:24 +0200] "HEAD /whois_raw.cgi
> HTTP/1.1" 403 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:31 +0200] "HEAD /web_store.cgi
> HTTP/1.1" 403 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:32 +0200] "HEAD
> /usr/local/apache/share/htdocs/.htaccess HTTP/1.1" 404 0 "-"
> "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:32 +0200] "HEAD
> /userreg.cgi?cmd=insert</=eng&tnum=3&fld1=test999%0acat</var/s
> pool/mail/login>>/etc/passwd
> HTTP/1.1" 403 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:32 +0200] "HEAD
> /userreg.cgi?cmd=insert</=eng&tnum=3&fld1=test999%0acat</var/s
> pool/mail/login>>/etc/passwd
> HTTP/1.1" 403 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:33 +0200] "HEAD /quikstore.cfg
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:34 +0200] "HEAD /pw/storemgr.pw
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:34 +0200] "HEAD /pw/storemgr.pw
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:35 +0200] "HEAD
> /publisher/ HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:36 +0200] "HEAD
> /PSUser/PSCOErrPage.htm HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:36 +0200] "HEAD
> /prxdocs/misc/prxrch.idq HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:37 +0200] "HEAD /ping
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:37 +0200] "HEAD /ping
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:39 +0200] "HEAD
> /photoads/cgi-bin/env.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:27:40 +0200] "HEAD
> /photoads/ads_data.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:28:55 +0200] "HEAD
> /PDG_Cart/shopper.conf
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:28:56 +0200] "HEAD
> /PDG_Cart/order.log
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:30:05 +0200] "HEAD
> /ows-bin/perlidlc.bat
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:30:05 +0200] "HEAD
> /orders/orders.txt
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:30:06 +0200] "HEAD
> /orders/orders.txt
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:01 +0200] "HEAD
> /Orders/order.log
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:01 +0200] "HEAD
> /Orders/order.log
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:02 +0200] "HEAD
> /orders/mountain.cfg
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:03 +0200] "HEAD
> /orders/import.txt
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:03 +0200] "HEAD /order/order.log
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:04 +0200] "HEAD /order/order.log
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:04 +0200] "HEAD
> /null.htw HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:05 +0200] "HEAD /ncl_items.html
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:06 +0200] "HEAD
> /navigate/ews/ews/architext_query.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:06 +0200] "HEAD
> /names.nsf HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:08 +0200] "HEAD
> /manage/cgi/cgiproc
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:09 +0200] "HEAD
> /manage/cgi/cgiproc
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:10 +0200] "HEAD
> /mall_log_files/order.log HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:10 +0200] "HEAD /logs
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:11 +0200] "HEAD
> /log.nsf/ HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:11 +0200] "HEAD /log.nsf
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:12 +0200] "HEAD /log
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:12 +0200] "HEAD
> /font9.css HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:29 +0200] "HEAD
> /ews/ews/architext_query.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:29 +0200] "HEAD
> /domlog.nsf/ HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:30 +0200] "HEAD
> /domlog.nsf HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:32 +0200] "HEAD
> /domcfg.nsf/?open
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:32 +0200] "HEAD
> /domcfg.nsf/ HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:33 +0200] "HEAD
> /domcfg.nsf HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:36 +0200] "HEAD /database.nsf
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:37 +0200] "HEAD
> /cool-logs/mylog.html
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:37 +0200] "HEAD
> /cool-logs/mlog.html
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:37 +0200] "HEAD /cgi-src/phf.c
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:52 +0200] "HEAD /cgi-src
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:31:54 +0200] "HEAD /cgi-src
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:06 +0200] "HEAD
> /cgi-bin/zsh HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:07 +0200] "HEAD /cgi-bin/www-sql
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:07 +0200] "HEAD
> /cgi-bin/wwwboard.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:11 +0200] "HEAD
> /cgi-bin/wwwboard.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:12 +0200] "HEAD
> /cgi-bin/wwwadmin.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:12 +0200] "HEAD
> /cgi-bin/wrap.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:13 +0200] "HEAD /cgi-bin/wrap
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:13 +0200] "HEAD /cgi-Bin/wrap
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:13 +0200] "HEAD
> /cgi-bin/whois_raw.cgi?fqdn=%0Acat%20/etc/passwd HTTP/1.1" 404 0 "-"
> "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:14 +0200] "HEAD
> /cgi-bin/whois_raw.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:17 +0200] "HEAD
> /cgi-bin/webwho.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:17 +0200] "HEAD
> /cgi-bin/websendmail
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD /cgi-bin/webplus
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD
> /cgi-bin/webmap.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD /cgi-bin/webgais
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD
> /Cgi-Bin/webdist.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:22 +0200] "HEAD
> /Cgi-Bin/webdist.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:23 +0200] "HEAD
> /cgi-bin/webbbs.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:23 +0200] "HEAD /cgi-bin/wais.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:23 +0200] "HEAD
> /cgi-bin/w3tvars.pm
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:24 +0200] "HEAD /cgi-bin/w3-sql
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:24 +0200] "HEAD /cgi-bin/w3-sql
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:25 +0200] "HEAD /cgi-bin/w3-msql
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:26 +0200] "HEAD /cgi-bin/w3-msql
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:27 +0200] "HEAD
> /cgi-bin/view-source
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:27 +0200] "HEAD
> /cgi-bin/userfile.dat
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:27 +0200] "HEAD
> /cgi-bin/user.log
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:28 +0200] "HEAD
> /cgi-bin/user.dat
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:28 +0200] "HEAD /cgi-bin/uptime
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:28 +0200] "HEAD
> /cgi-bin/upload.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:29 +0200] "HEAD /cgi-bin/unlg1.2
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD /cgi-bin/unlg1.1
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD
> /cgi-bin/UltraBoard.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD
> /cgi-bin/UltraBoard.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD
> /cgi-bin/UltraBoard.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:31 +0200] "HEAD
> /cgi-bin/tpgnrock
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:39 +0200] "HEAD
> /cgi-bin/textcounter.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:39 +0200] "HEAD
> /cgi-bin/test-env
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:39 +0200] "HEAD
> /cgi-bin/test-cgi?*
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:40 +0200] "HEAD
> /Cgi-Bin/test-cgi/*
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:40 +0200] "HEAD
> /cgi-bin/test-cgi.tcl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:41 +0200] "HEAD
> /cgi-bin/test-cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:41 +0200] "HEAD /Cgi-Bin/testcgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:42 +0200] "HEAD /cgi-bin/tcsh
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:42 +0200] "HEAD /Cgi-Bin/tcsh
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:42 +0200] "HEAD
> /cgi-bin/survey.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:43 +0200] "HEAD /cgi-bin/survey
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:47 +0200] "HEAD
> /cgi-bin/status.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:53 +0200] "HEAD
> /Cgi-Bin/sojourn.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:54 +0200] "HEAD /cgi-bin/sojourn
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:56 +0200] "HEAD
> /cgi-bin/shop.cgi/page=../../../../etc/passwd HTTP/1.1" 404 0 "-"
> "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD
> /cgi-bin/shop.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD
> /cgi-bin/sh HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD
> /Cgi-Bin/sh HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD
> /Cgi-Bin/sh HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD
> /cgi-bin/settings.cfg
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:32:58 +0200] "HEAD
> /cgi-bin/sendform.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:04 +0200] "HEAD
> /Cgi-Bin/search.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:04 +0200] "HEAD
> /cgi-bin/sawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:05 +0200] "HEAD
> /cgi-bin/sawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:05 +0200] "HEAD
> /cgi-bin/rwwwshell.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:06 +0200] "HEAD
> /cgi-bin/rsh HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:06 +0200] "HEAD
> /cgi-bin/rpm_query
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:06 +0200] "HEAD /cgi-bin/rksh
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:35 +0200] "HEAD
> /cgi-bin/responder
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:35 +0200] "HEAD
> /cgi-bin/redirect
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:35 +0200] "HEAD /cgi-bin/query
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:36 +0200] "HEAD
> /cgi-bin/process_bug.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:36 +0200] "HEAD
> /cgi-bin/printenv
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:54 +0200] "HEAD
> /cgi-bin/post-query
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:55 +0200] "HEAD
> /cgi-bin/post-query
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:58 +0200] "HEAD
> /cgi-bin/plusmail
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:59 +0200] "HEAD /cgi-bin/phpscan
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:33:59 +0200] "HEAD /cgi-bin/php.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:00 +0200] "HEAD
> /cgi-bin/php HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:00 +0200] "HEAD
> /cgi-bin/photo_cfg.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:04 +0200] "HEAD /cgi-bin/phf.pp
> HTTP/1.1" 302 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:05 +0200] "HEAD /cgi-bin/phf.cgi
> HTTP/1.1" 302 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:05 +0200] "HEAD
> /cgi-bin/phf HTTP/1.1"
> 302 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:05 +0200] "HEAD
> /Cgi-Bin/phf HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:06 +0200] "HEAD
> /cgi-bin/pfdisplay.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:06 +0200] "HEAD
> /cgi-bin/pfdisplay
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:07 +0200] "HEAD
> /cgi-bin/pfdispaly.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:08 +0200] "HEAD
> /cgi-bin/perlshop.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:08 +0200] "HEAD
> /cgi-bin/perlshop.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:09 +0200] "HEAD /cgi-bin/perl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:10 +0200] "HEAD
> /cgi-bin/password.log
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:10 +0200] "HEAD
> /cgi-bin/password.dat
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:10 +0200] "HEAD
> /cgi-bin/password
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:12 +0200] "HEAD
> /cgi-bin/passwd.txt
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:14 +0200] "HEAD /cgi-bin/passwd
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:14 +0200] "HEAD
> /Cgi-Bin/nph-test-cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:15 +0200] "HEAD
> /Cgi-Bin/nph-test-cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:15 +0200] "HEAD
> /cgi-bin/nph-test-cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD
> /cgi-bin/nph-error.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD
> /cgi-bin/nlog-smb.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD /cgi-bin/netstat
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD
> /cgi-bin/mylog.phtml
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD
> /cgi-bin/mlog.phtml
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD /cgi-bin/man.sh
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:18 +0200] "HEAD
> /cgi-bin/makechanges/easysteps/easysteps.pl HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:44 +0200] "HEAD
> /cgi-bin/maillist.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:45 +0200] "HEAD /cgi-bin/mail
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:48 +0200] "HEAD /cgi-bin/mail
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:50 +0200] "HEAD
> /cgi-bin/lwgate.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:50 +0200] "HEAD
> /cgi-bin/LWGate.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:51 +0200] "HEAD /cgi-bin/lwgate
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:51 +0200] "HEAD
> /cgi-bin/loadpage.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:52 +0200] "HEAD
> /Cgi-Bin/loadpage.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:52 +0200] "HEAD
> /cgi-bin/ksh HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:52 +0200] "HEAD
> /cgi-bin/ksh HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:53 +0200] "HEAD
> /Cgi-Bin/ksh HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:53 +0200] "HEAD
> /cgi-bin/jj HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:54 +0200] "HEAD
> /cgi-bin/jj HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:34:55 +0200] "HEAD
> /Cgi-Bin/jj HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:01 +0200] "HEAD
> /cgi-bin/infosrch.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:02 +0200] "HEAD
> /cgi-bin/info2www
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:04 +0200] "HEAD
> /cgi-bin/htsearch
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:20 +0200] "HEAD
> /cgi-bin/htmlscript?../../../../etc/passwd HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:20 +0200] "HEAD
> /cgi-bin/htmlscript
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:21 +0200] "HEAD
> /cgi-bin/htmlscript
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:21 +0200] "HEAD /cgi-bin/handler
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:22 +0200] "HEAD
> /cgi-bin/guestbook.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:22 +0200] "HEAD
> /cgi-bin/guestbook.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:22 +0200] "HEAD
> /cgi-bin/guestbook
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:23 +0200] "HEAD /cgi-bin/glimpse
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:23 +0200] "HEAD /cgi-bin/gH.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:24 +0200] "HEAD
> /cgi-bin/ftp/ftp.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:24 +0200] "HEAD
> /cgi-bin/ftp/ftp.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:25 +0200] "HEAD
> /cgi-bin/formmail.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:25 +0200] "HEAD
> /Cgi-Bin/formmail.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:25 +0200] "HEAD
> /Cgi-Bin/formmail.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:26 +0200] "HEAD
> /Cgi-Bin/formmail
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:26 +0200] "HEAD
> /Cgi-Bin/formmail
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:26 +0200] "HEAD
> /cgi-bin/FormHandler.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD
> /cgi-bin/flexform.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD
> /cgi-bin/flexform
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD
> /cgi-bin/flexform
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD
> /cgi-bin/finger.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD
> /cgi-bin/finger.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:28 +0200] "HEAD /cgi-bin/finger
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:39 +0200] "HEAD
> /cgi-bin/filemail.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:39 +0200] "HEAD
> /cgi-bin/filemail
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:39 +0200] "HEAD
> /cgi-bin/filemail
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:41 +0200] "HEAD
> /Cgi-Bin/faxsurvey
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:41 +0200] "HEAD
> /cgi-bin/faxsurvey
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:48 +0200] "HEAD
> /Cgi-Bin/ezshopper/loadpage.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:50 +0200] "HEAD /cgi-bin/excite
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:51 +0200] "HEAD
> /cgi-bin/environ.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:35:52 +0200] "HEAD
> /Cgi-Bin/enivron.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD /cgi-bin/edit.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD
> /Cgi-Bin/echo.bat
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD
> /cgi-bin/dumpenv.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD
> /cgi-bin/download.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD
> /cgi-bin/dnewsweb
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD /cgi-bin/dig.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD
> /cgi-bin/dbmlparser.exe HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD
> /cgi-bin/day5notifier
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:08 +0200] "HEAD
> /cgi-bin/day5datanotifier.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:26 +0200] "HEAD
> /cgi-bin/day5datacopier.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:27 +0200] "HEAD /cgi-bin/date
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD
> /cgi-bin/csh HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD
> /Cgi-Bin/csh HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD
> /cgi-bin/counterfiglet
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD
> /Cgi-Bin/count.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:29 +0200] "HEAD
> /cgi-bin/Count.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:30 +0200] "HEAD
> /Cgi-Bin/cmd32.exe?/c+dir HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:30 +0200] "HEAD
> /Cgi-Bin/cmd32.exe
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:31 +0200] "HEAD
> /Cgi-Bin/cmd32.exe
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:54 +0200] "HEAD /Cgi-Bin/cmd.exe
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:55 +0200] "HEAD
> /cgi-bin/clickresponder.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:55 +0200] "HEAD
> /cgi-bin/classifieds.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:56 +0200] "HEAD
> /cgi-bin/classifieds
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:57 +0200] "HEAD
> /cgi-bin/classified.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:57 +0200] "HEAD /cgi-bin/cgiwrap
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:36:58 +0200] "HEAD
> /cgi-bin/Cgitest.exe
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:37:23 +0200] "HEAD
> /Cgi-Bin/cgitest.exe
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:37:24 +0200] "HEAD
> /cgi-bin/cgimail.exe
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:37:25 +0200] "HEAD
> /cgi-bin/ceilidh.exe/ceilidh/?N4 HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:37:26 +0200] "HEAD /cgi-bin/cart.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:37:26 +0200] "HEAD /cgi-bin/cart.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:37:27 +0200] "HEAD /cgi-bin/campas
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:37:58 +0200] "HEAD /Cgi-Bin/campas
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:37:59 +0200] "HEAD
> /cgi-bin/calender_admin.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:37:59 +0200] "HEAD
> /cgi-bin/calender_admin.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:00 +0200] "HEAD
> /cgi-bin/calendar
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:01 +0200] "HEAD
> /cgi-bin/calendar
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:02 +0200] "HEAD
> /cgi-bin/cachemgr.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:07 +0200] "HEAD /cgi-bin/bnbform
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:09 +0200] "HEAD
> /cgi-bin/bizdb1-search.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:10 +0200] "HEAD
> /cgi-bin/bizdb1-search.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:10 +0200] "HEAD
> /cgi-bin/bigconf.cgi
> all HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:10 +0200] "HEAD
> /cgi-bin/bigconf.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:11 +0200] "HEAD
> /cgi-bin/bb-hist.sh
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:13 +0200] "HEAD /cgi-bin/axs.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:14 +0200] "HEAD
> /cgi-bin/ax-admin.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:14 +0200] "HEAD /cgi-bin/ax.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:14 +0200] "HEAD /cgi-bin/ax.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:15 +0200] "HEAD
> /cgi-bin/authorize/dbmfiles/users HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:16 +0200] "HEAD
> /cgi-bin/AT-generate.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:16 +0200] "HEAD
> /cgi-bin/AT-admin.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:17 +0200] "HEAD
> /cgi-bin/ash HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:20 +0200] "HEAD /cgi-bin/archie
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:20 +0200] "HEAD
> /cgi-bin/AnyForm2
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:21 +0200] "HEAD
> /cgi-bin/AnyForm.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:22 +0200] "HEAD
> /cgi-bin/AnyForm.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:22 +0200] "HEAD /cgi-bin/AnyForm
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:22 +0200] "HEAD
> /cgi-bin/anyboard.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD
> /cgi-bin/allmanageup.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD
> /cgi-bin/allmanage/userfile.dat HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD
> /cgi-bin/allmanage/userfile.dat HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD
> /cgi-bin/allmanage/settings.cfg HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD
> /cgi-bin/allmanage/k
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:24 +0200] "HEAD
> /cgi-bin/allmanage/adp
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:24 +0200] "HEAD
> /cgi-bin/allmanage.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:40 +0200] "HEAD
> /cgi-bin/alibaba.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:41 +0200] "HEAD
> /Cgi-Bin/alibaba.pl
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:41 +0200] "HEAD
> /cgi-bin/aglimpse.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:41 +0200] "HEAD
> /cgi-bin/aglimpse.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD
> /cgi-bin/aglimpse
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD
> /cgi-bin/ads.setup
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD
> /cgi-bin/adpassword.txt HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD
> /cgi-bin/adp HTTP/1.1"
> 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD
> /cgi-bin/Admin_files/order.log HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD
> /cgi-bin/add_ftp.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD
> /cgi-bin/add_ftp.cgi
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD
> /ccbill/secure/ccbill.log HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD
> /bin/jscripts/GneteFuncs.js HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /bin
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /~tmp
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /~test
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /~root
> HTTP/1.1" 403 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~named
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~lp
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~logs
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~log
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~guest
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~ftp
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD /~bin
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD /.passwd
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD /.passwd
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD
> /.htaccess HTTP/1.1"
> 403 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD /.bash_history
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD /.access
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD /.access
> HTTP/1.1" 404
> 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD
> /../../../../etc/hosts
> HTTP/1.1" 400 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD
> /....../etc/hosts
> HTTP/1.1" 404 0 "-" "Mozilla/5.0"
> 64.226.243.16 - - [24/Sep/2001:08:38:47 +0200] "HEAD /.pl
> HTTP/1.1" 404 0
> "-" "Mozilla/5.0"
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>
>
> --
> Guy Poizat
> poizat_at_partsonline.fr
>
>
> --------------------------------------------------------------
> --------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management
> and tracking system please see: http://aris.securityfocus.com
>

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
Received on Oct 04 2001