Looks like Whisker to me. http://www.wiretrip.net/rfp/p/doc.asp?id=21&iface=2 > -----Original Message----- > From: Guy Poizat [mailto:poizatat_private] > Sent: Thursday, October 04, 2001 8:07 AM > To: incidentsat_private > Subject: Automated scan-for-webserver-vulns tool ? > > > Hi, > > Got these entries (2 times same day from different IPs) in an > access.log > (among tons of Nimda requests, of course). > Anybody know what kind of kiddietool does that ? > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > 64.226.243.16 - - [24/Sep/2001:08:26:06 +0200] "GET / > HTTP/1.1" 200 5525 > "-" "-" > 64.226.243.16 - - [24/Sep/2001:08:26:07 +0200] "HEAD > /qweiop43809442fsfjflr.html HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:26:07 +0200] "GET / > HTTP/1.1" 200 5525 > "-" "-" > 64.226.243.16 - - [24/Sep/2001:08:26:08 +0200] "HEAD > /../../etc/passwd > HTTP/1.1" 400 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:26:09 +0200] "HEAD > /../../../../../etc/passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:26:09 +0200] "HEAD > /../../../../etc/passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:26:10 +0200] "HEAD > /../../../etc/passwd > HTTP/1.1" 400 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:26:10 +0200] "HEAD /../../passwd > HTTP/1.1" 400 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:26:10 +0200] "HEAD /../../shadow > HTTP/1.1" 400 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:05 +0200] "GET > /NULL.printer HTTP/1.1" > 404 6241 "-" "-" > 64.226.243.16 - - [24/Sep/2001:08:27:22 +0200] "HEAD /cgi/ > HTTP/1.1" 403 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:23 +0200] "HEAD > /admin-serv/config/admpw HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:23 +0200] "HEAD > /publisher HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:23 +0200] "HEAD /whois_raw.cgi > HTTP/1.1" 403 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:24 +0200] "HEAD /whois_raw.cgi > HTTP/1.1" 403 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:31 +0200] "HEAD /web_store.cgi > HTTP/1.1" 403 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:32 +0200] "HEAD > /usr/local/apache/share/htdocs/.htaccess HTTP/1.1" 404 0 "-" > "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:32 +0200] "HEAD > /userreg.cgi?cmd=insert</=eng&tnum=3&fld1=test999%0acat</var/s > pool/mail/login>>/etc/passwd > HTTP/1.1" 403 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:32 +0200] "HEAD > /userreg.cgi?cmd=insert</=eng&tnum=3&fld1=test999%0acat</var/s > pool/mail/login>>/etc/passwd > HTTP/1.1" 403 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:33 +0200] "HEAD /quikstore.cfg > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:34 +0200] "HEAD /pw/storemgr.pw > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:34 +0200] "HEAD /pw/storemgr.pw > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:35 +0200] "HEAD > /publisher/ HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:36 +0200] "HEAD > /PSUser/PSCOErrPage.htm HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:36 +0200] "HEAD > /prxdocs/misc/prxrch.idq HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:37 +0200] "HEAD /ping > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:37 +0200] "HEAD /ping > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:39 +0200] "HEAD > /photoads/cgi-bin/env.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:27:40 +0200] "HEAD > /photoads/ads_data.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:28:55 +0200] "HEAD > /PDG_Cart/shopper.conf > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:28:56 +0200] "HEAD > /PDG_Cart/order.log > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:30:05 +0200] "HEAD > /ows-bin/perlidlc.bat > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:30:05 +0200] "HEAD > /orders/orders.txt > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:30:06 +0200] "HEAD > /orders/orders.txt > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:01 +0200] "HEAD > /Orders/order.log > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:01 +0200] "HEAD > /Orders/order.log > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:02 +0200] "HEAD > /orders/mountain.cfg > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:03 +0200] "HEAD > /orders/import.txt > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:03 +0200] "HEAD /order/order.log > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:04 +0200] "HEAD /order/order.log > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:04 +0200] "HEAD > /null.htw HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:05 +0200] "HEAD /ncl_items.html > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:06 +0200] "HEAD > /navigate/ews/ews/architext_query.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:06 +0200] "HEAD > /names.nsf HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:08 +0200] "HEAD > /manage/cgi/cgiproc > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:09 +0200] "HEAD > /manage/cgi/cgiproc > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:10 +0200] "HEAD > /mall_log_files/order.log HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:10 +0200] "HEAD /logs > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:11 +0200] "HEAD > /log.nsf/ HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:11 +0200] "HEAD /log.nsf > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:12 +0200] "HEAD /log > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:12 +0200] "HEAD > /font9.css HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:29 +0200] "HEAD > /ews/ews/architext_query.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:29 +0200] "HEAD > /domlog.nsf/ HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:30 +0200] "HEAD > /domlog.nsf HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:32 +0200] "HEAD > /domcfg.nsf/?open > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:32 +0200] "HEAD > /domcfg.nsf/ HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:33 +0200] "HEAD > /domcfg.nsf HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:36 +0200] "HEAD /database.nsf > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:37 +0200] "HEAD > /cool-logs/mylog.html > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:37 +0200] "HEAD > /cool-logs/mlog.html > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:37 +0200] "HEAD /cgi-src/phf.c > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:52 +0200] "HEAD /cgi-src > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:31:54 +0200] "HEAD /cgi-src > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:06 +0200] "HEAD > /cgi-bin/zsh HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:07 +0200] "HEAD /cgi-bin/www-sql > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:07 +0200] "HEAD > /cgi-bin/wwwboard.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:11 +0200] "HEAD > /cgi-bin/wwwboard.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:12 +0200] "HEAD > /cgi-bin/wwwadmin.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:12 +0200] "HEAD > /cgi-bin/wrap.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:13 +0200] "HEAD /cgi-bin/wrap > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:13 +0200] "HEAD /cgi-Bin/wrap > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:13 +0200] "HEAD > /cgi-bin/whois_raw.cgi?fqdn=%0Acat%20/etc/passwd HTTP/1.1" 404 0 "-" > "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:14 +0200] "HEAD > /cgi-bin/whois_raw.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:17 +0200] "HEAD > /cgi-bin/webwho.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:17 +0200] "HEAD > /cgi-bin/websendmail > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD /cgi-bin/webplus > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD > /cgi-bin/webmap.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD /cgi-bin/webgais > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:21 +0200] "HEAD > /Cgi-Bin/webdist.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:22 +0200] "HEAD > /Cgi-Bin/webdist.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:23 +0200] "HEAD > /cgi-bin/webbbs.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:23 +0200] "HEAD /cgi-bin/wais.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:23 +0200] "HEAD > /cgi-bin/w3tvars.pm > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:24 +0200] "HEAD /cgi-bin/w3-sql > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:24 +0200] "HEAD /cgi-bin/w3-sql > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:25 +0200] "HEAD /cgi-bin/w3-msql > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:26 +0200] "HEAD /cgi-bin/w3-msql > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:27 +0200] "HEAD > /cgi-bin/view-source > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:27 +0200] "HEAD > /cgi-bin/userfile.dat > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:27 +0200] "HEAD > /cgi-bin/user.log > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:28 +0200] "HEAD > /cgi-bin/user.dat > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:28 +0200] "HEAD /cgi-bin/uptime > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:28 +0200] "HEAD > /cgi-bin/upload.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:29 +0200] "HEAD /cgi-bin/unlg1.2 > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD /cgi-bin/unlg1.1 > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD > /cgi-bin/UltraBoard.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD > /cgi-bin/UltraBoard.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:30 +0200] "HEAD > /cgi-bin/UltraBoard.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:31 +0200] "HEAD > /cgi-bin/tpgnrock > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:39 +0200] "HEAD > /cgi-bin/textcounter.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:39 +0200] "HEAD > /cgi-bin/test-env > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:39 +0200] "HEAD > /cgi-bin/test-cgi?* > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:40 +0200] "HEAD > /Cgi-Bin/test-cgi/* > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:40 +0200] "HEAD > /cgi-bin/test-cgi.tcl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:41 +0200] "HEAD > /cgi-bin/test-cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:41 +0200] "HEAD /Cgi-Bin/testcgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:42 +0200] "HEAD /cgi-bin/tcsh > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:42 +0200] "HEAD /Cgi-Bin/tcsh > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:42 +0200] "HEAD > /cgi-bin/survey.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:43 +0200] "HEAD /cgi-bin/survey > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:47 +0200] "HEAD > /cgi-bin/status.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:53 +0200] "HEAD > /Cgi-Bin/sojourn.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:54 +0200] "HEAD /cgi-bin/sojourn > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:56 +0200] "HEAD > /cgi-bin/shop.cgi/page=../../../../etc/passwd HTTP/1.1" 404 0 "-" > "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD > /cgi-bin/shop.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD > /cgi-bin/sh HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD > /Cgi-Bin/sh HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD > /Cgi-Bin/sh HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:57 +0200] "HEAD > /cgi-bin/settings.cfg > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:32:58 +0200] "HEAD > /cgi-bin/sendform.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:04 +0200] "HEAD > /Cgi-Bin/search.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:04 +0200] "HEAD > /cgi-bin/sawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1 > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:05 +0200] "HEAD > /cgi-bin/sawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1 > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:05 +0200] "HEAD > /cgi-bin/rwwwshell.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:06 +0200] "HEAD > /cgi-bin/rsh HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:06 +0200] "HEAD > /cgi-bin/rpm_query > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:06 +0200] "HEAD /cgi-bin/rksh > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:35 +0200] "HEAD > /cgi-bin/responder > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:35 +0200] "HEAD > /cgi-bin/redirect > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:35 +0200] "HEAD /cgi-bin/query > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:36 +0200] "HEAD > /cgi-bin/process_bug.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:36 +0200] "HEAD > /cgi-bin/printenv > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:54 +0200] "HEAD > /cgi-bin/post-query > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:55 +0200] "HEAD > /cgi-bin/post-query > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:58 +0200] "HEAD > /cgi-bin/plusmail > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:59 +0200] "HEAD /cgi-bin/phpscan > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:33:59 +0200] "HEAD /cgi-bin/php.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:00 +0200] "HEAD > /cgi-bin/php HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:00 +0200] "HEAD > /cgi-bin/photo_cfg.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:04 +0200] "HEAD /cgi-bin/phf.pp > HTTP/1.1" 302 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:05 +0200] "HEAD /cgi-bin/phf.cgi > HTTP/1.1" 302 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:05 +0200] "HEAD > /cgi-bin/phf HTTP/1.1" > 302 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:05 +0200] "HEAD > /Cgi-Bin/phf HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:06 +0200] "HEAD > /cgi-bin/pfdisplay.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:06 +0200] "HEAD > /cgi-bin/pfdisplay > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:07 +0200] "HEAD > /cgi-bin/pfdispaly.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:08 +0200] "HEAD > /cgi-bin/perlshop.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:08 +0200] "HEAD > /cgi-bin/perlshop.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:09 +0200] "HEAD /cgi-bin/perl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:10 +0200] "HEAD > /cgi-bin/password.log > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:10 +0200] "HEAD > /cgi-bin/password.dat > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:10 +0200] "HEAD > /cgi-bin/password > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:12 +0200] "HEAD > /cgi-bin/passwd.txt > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:14 +0200] "HEAD /cgi-bin/passwd > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:14 +0200] "HEAD > /Cgi-Bin/nph-test-cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:15 +0200] "HEAD > /Cgi-Bin/nph-test-cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:15 +0200] "HEAD > /cgi-bin/nph-test-cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD > /cgi-bin/nph-error.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD > /cgi-bin/nlog-smb.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD /cgi-bin/netstat > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD > /cgi-bin/mylog.phtml > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD > /cgi-bin/mlog.phtml > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:17 +0200] "HEAD /cgi-bin/man.sh > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:18 +0200] "HEAD > /cgi-bin/makechanges/easysteps/easysteps.pl HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:44 +0200] "HEAD > /cgi-bin/maillist.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:45 +0200] "HEAD /cgi-bin/mail > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:48 +0200] "HEAD /cgi-bin/mail > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:50 +0200] "HEAD > /cgi-bin/lwgate.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:50 +0200] "HEAD > /cgi-bin/LWGate.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:51 +0200] "HEAD /cgi-bin/lwgate > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:51 +0200] "HEAD > /cgi-bin/loadpage.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:52 +0200] "HEAD > /Cgi-Bin/loadpage.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:52 +0200] "HEAD > /cgi-bin/ksh HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:52 +0200] "HEAD > /cgi-bin/ksh HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:53 +0200] "HEAD > /Cgi-Bin/ksh HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:53 +0200] "HEAD > /cgi-bin/jj HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:54 +0200] "HEAD > /cgi-bin/jj HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:34:55 +0200] "HEAD > /Cgi-Bin/jj HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:01 +0200] "HEAD > /cgi-bin/infosrch.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:02 +0200] "HEAD > /cgi-bin/info2www > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:04 +0200] "HEAD > /cgi-bin/htsearch > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:20 +0200] "HEAD > /cgi-bin/htmlscript?../../../../etc/passwd HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:20 +0200] "HEAD > /cgi-bin/htmlscript > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:21 +0200] "HEAD > /cgi-bin/htmlscript > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:21 +0200] "HEAD /cgi-bin/handler > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:22 +0200] "HEAD > /cgi-bin/guestbook.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:22 +0200] "HEAD > /cgi-bin/guestbook.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:22 +0200] "HEAD > /cgi-bin/guestbook > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:23 +0200] "HEAD /cgi-bin/glimpse > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:23 +0200] "HEAD /cgi-bin/gH.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:24 +0200] "HEAD > /cgi-bin/ftp/ftp.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:24 +0200] "HEAD > /cgi-bin/ftp/ftp.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:25 +0200] "HEAD > /cgi-bin/formmail.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:25 +0200] "HEAD > /Cgi-Bin/formmail.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:25 +0200] "HEAD > /Cgi-Bin/formmail.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:26 +0200] "HEAD > /Cgi-Bin/formmail > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:26 +0200] "HEAD > /Cgi-Bin/formmail > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:26 +0200] "HEAD > /cgi-bin/FormHandler.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD > /cgi-bin/flexform.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD > /cgi-bin/flexform > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD > /cgi-bin/flexform > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD > /cgi-bin/finger.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:27 +0200] "HEAD > /cgi-bin/finger.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:28 +0200] "HEAD /cgi-bin/finger > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:39 +0200] "HEAD > /cgi-bin/filemail.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:39 +0200] "HEAD > /cgi-bin/filemail > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:39 +0200] "HEAD > /cgi-bin/filemail > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:41 +0200] "HEAD > /Cgi-Bin/faxsurvey > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:41 +0200] "HEAD > /cgi-bin/faxsurvey > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:48 +0200] "HEAD > /Cgi-Bin/ezshopper/loadpage.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:50 +0200] "HEAD /cgi-bin/excite > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:51 +0200] "HEAD > /cgi-bin/environ.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:35:52 +0200] "HEAD > /Cgi-Bin/enivron.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD /cgi-bin/edit.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD > /Cgi-Bin/echo.bat > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD > /cgi-bin/dumpenv.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:06 +0200] "HEAD > /cgi-bin/download.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD > /cgi-bin/dnewsweb > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD /cgi-bin/dig.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD > /cgi-bin/dbmlparser.exe HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:07 +0200] "HEAD > /cgi-bin/day5notifier > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:08 +0200] "HEAD > /cgi-bin/day5datanotifier.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:26 +0200] "HEAD > /cgi-bin/day5datacopier.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:27 +0200] "HEAD /cgi-bin/date > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD > /cgi-bin/csh HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD > /Cgi-Bin/csh HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD > /cgi-bin/counterfiglet > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:28 +0200] "HEAD > /Cgi-Bin/count.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:29 +0200] "HEAD > /cgi-bin/Count.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:30 +0200] "HEAD > /Cgi-Bin/cmd32.exe?/c+dir HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:30 +0200] "HEAD > /Cgi-Bin/cmd32.exe > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:31 +0200] "HEAD > /Cgi-Bin/cmd32.exe > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:54 +0200] "HEAD /Cgi-Bin/cmd.exe > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:55 +0200] "HEAD > /cgi-bin/clickresponder.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:55 +0200] "HEAD > /cgi-bin/classifieds.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:56 +0200] "HEAD > /cgi-bin/classifieds > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:57 +0200] "HEAD > /cgi-bin/classified.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:57 +0200] "HEAD /cgi-bin/cgiwrap > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:36:58 +0200] "HEAD > /cgi-bin/Cgitest.exe > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:37:23 +0200] "HEAD > /Cgi-Bin/cgitest.exe > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:37:24 +0200] "HEAD > /cgi-bin/cgimail.exe > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:37:25 +0200] "HEAD > /cgi-bin/ceilidh.exe/ceilidh/?N4 HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:37:26 +0200] "HEAD /cgi-bin/cart.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:37:26 +0200] "HEAD /cgi-bin/cart.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:37:27 +0200] "HEAD /cgi-bin/campas > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:37:58 +0200] "HEAD /Cgi-Bin/campas > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:37:59 +0200] "HEAD > /cgi-bin/calender_admin.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:37:59 +0200] "HEAD > /cgi-bin/calender_admin.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:00 +0200] "HEAD > /cgi-bin/calendar > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:01 +0200] "HEAD > /cgi-bin/calendar > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:02 +0200] "HEAD > /cgi-bin/cachemgr.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:07 +0200] "HEAD /cgi-bin/bnbform > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:09 +0200] "HEAD > /cgi-bin/bizdb1-search.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:10 +0200] "HEAD > /cgi-bin/bizdb1-search.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:10 +0200] "HEAD > /cgi-bin/bigconf.cgi > all HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:10 +0200] "HEAD > /cgi-bin/bigconf.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:11 +0200] "HEAD > /cgi-bin/bb-hist.sh > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:13 +0200] "HEAD /cgi-bin/axs.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:14 +0200] "HEAD > /cgi-bin/ax-admin.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:14 +0200] "HEAD /cgi-bin/ax.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:14 +0200] "HEAD /cgi-bin/ax.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:15 +0200] "HEAD > /cgi-bin/authorize/dbmfiles/users HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:16 +0200] "HEAD > /cgi-bin/AT-generate.cgi HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:16 +0200] "HEAD > /cgi-bin/AT-admin.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:17 +0200] "HEAD > /cgi-bin/ash HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:20 +0200] "HEAD /cgi-bin/archie > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:20 +0200] "HEAD > /cgi-bin/AnyForm2 > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:21 +0200] "HEAD > /cgi-bin/AnyForm.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:22 +0200] "HEAD > /cgi-bin/AnyForm.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:22 +0200] "HEAD /cgi-bin/AnyForm > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:22 +0200] "HEAD > /cgi-bin/anyboard.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD > /cgi-bin/allmanageup.pl HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD > /cgi-bin/allmanage/userfile.dat HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD > /cgi-bin/allmanage/userfile.dat HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD > /cgi-bin/allmanage/settings.cfg HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:23 +0200] "HEAD > /cgi-bin/allmanage/k > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:24 +0200] "HEAD > /cgi-bin/allmanage/adp > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:24 +0200] "HEAD > /cgi-bin/allmanage.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:40 +0200] "HEAD > /cgi-bin/alibaba.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:41 +0200] "HEAD > /Cgi-Bin/alibaba.pl > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:41 +0200] "HEAD > /cgi-bin/aglimpse.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:41 +0200] "HEAD > /cgi-bin/aglimpse.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD > /cgi-bin/aglimpse > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD > /cgi-bin/ads.setup > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD > /cgi-bin/adpassword.txt HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD > /cgi-bin/adp HTTP/1.1" > 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD > /cgi-bin/Admin_files/order.log HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD > /cgi-bin/add_ftp.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD > /cgi-bin/add_ftp.cgi > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD > /ccbill/secure/ccbill.log HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:42 +0200] "HEAD > /bin/jscripts/GneteFuncs.js HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /bin > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /~tmp > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /~test > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:43 +0200] "HEAD /~root > HTTP/1.1" 403 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~named > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~lp > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~logs > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~log > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~guest > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:44 +0200] "HEAD /~ftp > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD /~bin > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD /.passwd > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD /.passwd > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:45 +0200] "HEAD > /.htaccess HTTP/1.1" > 403 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD /.bash_history > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD /.access > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD /.access > HTTP/1.1" 404 > 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD > /../../../../etc/hosts > HTTP/1.1" 400 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:46 +0200] "HEAD > /....../etc/hosts > HTTP/1.1" 404 0 "-" "Mozilla/5.0" > 64.226.243.16 - - [24/Sep/2001:08:38:47 +0200] "HEAD /.pl > HTTP/1.1" 404 0 > "-" "Mozilla/5.0" > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > > -- > Guy Poizat > poizatat_private > > > -------------------------------------------------------------- > -------------- > This list is provided by the SecurityFocus ARIS analyzer service. > For more information on this free incident handling, management > and tracking system please see: http://aris.securityfocus.com > ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu Oct 04 2001 - 09:35:44 PDT