|
|
Home | Switchboard | Unix Administration | Red Hat | TCP/IP Networks | Neoliberalism | Toxic Managers |
| (slightly skeptical) Educational society promoting "Back to basics" movement against IT overcomplexity and bastardization of classic Unix | |||||||
|
|
Requests for pages that never existed pollute 404 statistics to the extent that it became completely useless for detecting bad links from your web site. Popular sites attract undebugged robots like honey and such requests can constitute considerable percentage of the total number of requests. My estimate is that it can vary from 10% to almost 50% of robot traffic. Now a lot of those requests are coming from bc.googleusercontent.com, much less from Amazon cloud.
There are two common cases that cases such behaviour:
What complicates the picture is that hits belonging to those two categories often come from "respectable" bots too. So you can't blindly block all IP addresses from which such hits are coming. Where Google and Bing pickup those bogus links and why they are so persistent in checking them again and again (for years, sometimes decades, to come) is a mystery to me.
Excessive zeal in trying to block those jerks and restore sanity of your web logs does no good. You need to assume that poisoning of 403 stats in your Web log analysis program in permanent. The real fight is to cut pollution to acceptable level with minimal efforts. So here like in other cases, the concept of "dirty dozen" -- top IPs that demonstrate particular behavior might be useful.
Please understand that excessive zeal in trying to eliminate those pests is actually a trap that can hurt you. Despite your sincere indignation of such activities, please resists overreaction ! The first and foremost rule is such cases is "Not too much zeal."
| Please understand that excessive zeal in trying to eliminate those pests is actually a trap that can hurt you. Despite your sincere indignation of such activities, please resists overreaction ! The first and foremost rule is such cases is "Not too much zeal." |
As I already mentioned respectable bots such as Google or Bing are also contributors to hits in this category of useless requests ;-). Often multiple times as if they are storing those non-existent URL for a long time and periodically check, if the page re-appeared or not. So much about talented programmers working in Google. Judging from the behaviors of Google bot on my site, the level of talent of architects of this software leave much to be desired. It's a brute force approach.
Truth be told for Google, the following of "poisoned" links is difficult to avoid as the key idea of Google is to rely in ranking of the page on "popularity" of particular page on the web -- the number of references to the page in other sites. Here when abusers gat Google as to distinguish "honest" reference and "dishonest" reference is very difficult and that means that "URL mills" will always be danger for Google as distinguishing such references is a very difficult task as forms in which "URL mills" exists can mutate. Rank of the site itself can help, but even here possibilities of abuse are tremendous as owner can "rent" certain pages for "URL mill". See The Ultimate Google Algorithm Cheat Sheet for more information.
But it is unclear to me why they need to bump their head again and again at the fake URL day after day and why one access in, say, 3-5 days after first failure is not enough. And that's just one simple question to designers of those bots. I have many more. Google bot also has way too long memory and can access the link that disappeared in 1996 in 2014 (which is another Google bot feature -- inability to forget anything) ...
Other then those observations, very little known about avalanche of bogus request for Web pages that are hitting sites like this one. This page is just a very modest attempt to understand the phenomenon.
One interesting class of request to non-existent pages are so called "composition URLs
183.60.213.109 - - [30/Apr/2014:12:03:06 +0000] "GET /Net/Internet_layer/Subnetting/Bulletin/Humor/Archive/humor092.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)" 183.60.213.109 - - [30/Apr/2014:12:04:21 +0000] "GET /Commercial_unixes/AIX/Startup_and_shutdown/Bulletin/Humor/best_russian_programmer_humor.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)" 183.60.215.54 - - [30/Apr/2014:12:04:28 +0000] "GET /Unixification/Reskit/People/Torvalds/index.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)" 183.60.213.109 - - [30/Apr/2014:12:05:04 +0000] "GET /Commercial_unixes/HPUX/OSS/Skeptics/Financial_skeptic/Casino_capitalism/Twelve_apostles_of_deregulation/Greenspan/greenspan_humor.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)" 183.60.213.109 - - [30/Apr/2014:12:05:04 +0000] "GET /Access_control/SOX/Skeptics/Financial_skeptic/Casino_capitalism/Twelve_apostles_of_deregulation/Greenspan/greenspan_humor.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)" 183.60.214.23 - - [30/Apr/2014:12:05:27 +0000] "GET /Hardware/Dell/C610/Solaris/humor.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)" 183.60.213.109 - - [30/Apr/2014:12:05:33 +0000] "GET /Admin/Tivoli/TEC/Adapters/Skeptics/Political_skeptic/humor.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)"
In most cases "composition URLs are result of two factors
Presence of specific error on the WEB site at some point of its existence
Too long memory of most bots.
While in most case such composition URL consist of concatenation of two legitimate paths, there can be more complex cases due to "long memory" of most bots. For example let's analyze attempt the following GET request:
66.249.66.13 - - [07/Jan/2014:22:10:10 +0000] "GET /Malware/Spyware/Antivirus_system_pro/Copyright/index.shtml HTTP/1.1" 404 29600 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 (compatible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)"
Which is essentially an attempt to access the page
/Malware/Spyware/Antivirus_system_pro/Copyright/index.shtml
Here the folder Antivirus_system_pro was deleted three or more years ago. So now only /Malware/Spyware and /Copyright are two legitimate folders and without knowing history of the site, it is impossible to explain why Google bot attempts to access this crazy path.
This look like a bug in Google bot. But strangely enough Bing demostrate the same behaviour. that means that both are keeping history of previously visited pages for something like a decade. Why thye are doing this unclear. May be they are they doing this as part of some kind of "research" for some government agency ;-) ?
Still this pattern of stupid bunging into non-existent pages is amazingly consistent and repeatable. They literally bump thier head against the wall again and again after getting clear return code that page does not exist anymore. They do not believe the code and continue to check for years to come.
Here are two examples from two other bots: Mail.RU and bingbot (bogus part of the path is in red):
217.69.133.11 - - [02/Feb/2014:01:17:08 +0000] "GET /Access_control/Groups/Lang/index.shtml HTTP/1.1" 404 29006 "-" "Mozilla/5.0 (compatible; Linux x86_64; Mail.RU_Bot/2.
157.55.33.124 - - [02/Feb/2014:00:56:20 +0000] "GET /Admin/Education/Solaris/humor.shtml HTTP/1.1" 404 29006 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
See also Large Sample of "Composition URL" fake hits
Bingbot also has very long memory and systematically bangs against such "constructed" path cases that accidentally occurred due to an error committed more then tree years (yes years) ago:
65.55.52.87 - - [09/Jan/2014:06:12:47 +0000] "GET /Hardware/Dell/Servers/SE/humor.shtml HTTP/1.1" 404 15738 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 65.55.52.87 - - [09/Jan/2014:06:12:48 +0000] "GET /Commercial_unixes/AIX/Skeptics/humor.shtml HTTP/1.1" 404 15738 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 65.55.52.87 - - [09/Jan/2014:06:12:48 +0000] "GET /Admin/HP_operations_manager/Copyright/index.shtml HTTP/1.1" 404 15738 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 65.55.52.87 - - [09/Jan/2014:06:12:48 +0000] "GET /Internals/Unix_filesystems/Admin/HP_operations_manager/index.shtml HTTP/1.1" 404 15738 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 65.55.52.87 - - [09/Jan/2014:06:13:27 +0000] "GET /Net/Solaris/Unixification/index.shtml HTTP/1.1" 404 15738 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
A good thing that due to their consistency you can have the list of bogus pages on your site and just exclude them automatically from the logs. This is the simplest way to make 403 statistic mean something again.
| A good thing that due to their consistency you can have the list of bogus pages on your site and just exclude them automatically from the logs. This is the simplest way to make 403 statistic mean something again. |
|
|
Huge number of attempts to access non-existent Web pages can't be explained by just two cases: probes against pages that can be exploited (typically PHP pages) and "constructed URL" pages which we discussed above.
My impression from analyzing HTTP logs for several months is that additional factor are Web bots which are probably written on the level of a student project or worse.
Still they consume real bandwidth and along with accessing pages that are not existent they often engage is other types of "stupid" behaviour. For example there are several bots that "band" the same page tremendous number of times as if they want to wear it our ;-). Such bots affect 2xx stats and are even more dangerous as they distort the real picture of accesses to the pages of your site. See Bangers
| There are several bots that "band" the same page tremendous number of times as if they want to wear it our ;-). Such bots affect 2xx stats and are even more dangerous as they distort the real picture of accesses to the pages of your site. See Bangers |
Bangers do require more attention then producer of "non-existent pages" hits and IMHO should be eliminated mercilessly.
As I mentioned about there is a whole category of "Windows style" robots which consistently try to access ULRs in lower case. Such behaviour does not affect in any way Windows based sites. Only Linux sites are suffering from this For example, they try to access directories like
/tools/dd /tools /suse/startup_and_shutdown /public_html/social/overload /performance
|
There is a whole class of bots which access URLs in lower case. Google with its maniacal desire to collect as much information as possible on everything should correct such errors automatically. It does not. In other words Google bot is a somewhat stupid bot indeed. |
Google with its maniacal desire to collect as much information as possible on everything should correct such errors automatically. It does not. In other words Google bot is a somewhat stupid bot indeed.
One way to fight this class of bots is to make sure the all second level directories on your site start with a capital letter. In this case you can eliminale r redirect those requres automatically using Apache mod_rewrite capabilities. See Lower case requests
Another class of non-existent pages requests (possibly coming from poorly written bots) is truncated URL in GET requests. That happens mainly for very long URLs and that fact suggests that for such bots the buffer allocated for URL is too small. Two similar bugs are blanks in URL and omitting extension for the file. For example
/bulletin/sp2014_v26 /%20dns
For some reasons Google bot tends to pickup a lot of such "dirt".
Now any student can get and compile code for a bot, or construct a bot as an exercise in learning a programming language. The technology of site traversing is well described in textbooks. that's probably why so many of them demostrate "unexplanable stupidity". But bot from Google should be better then that. It is not ;-)
See also
It is clear that there are tremendous amount of zombies, which are part of some botnet, that are available on Internet. For example in early June of 2014 authorities took down botnet that served for distribution of Cryptolocker which contained over 300,000 computers.
But they can be used for scanning the sites too. In this case the GET request represent a probe against some vulnerability (see PHP probes for the most popular class).
Using zombie is preferable in this case, as the attacker in this case is not afraid of retaliation. Also if IP is blocked another zombies can used, as there is a strength in numbers. While it is somewhat dangerous to scan Web site from a legit address as reaction is often complete block, who cares if the target will be one of 300K zombie computers in a particular botnet. For this class of bots, unlike bots that are student projects it is very difficult to find the IP range they are using. So blocking them based on IP range often fails. You need to understand the composition of the address space they use before you can completely cut the oxygen for them.
Let's assume that you want to exterminate all "useless" HTTP accesses for your site. Analyzing the traffic will take probably aw weel of your time. And all this time your http logs remain polluted. Bu the next week composition of those rogue bots will not be completely the same, so your "perfect" blocking start leaking some hits. And then the next set of crazy bot hit your site. And then another one. And then Google bot or Yahoo bot or Bing bot pickup somewhere really "generated" path+file combo, or try to access ten years old links, or engage in crazy behaviour of their own making. So it is unclear what is the return on investment. The whole picture looks pretty bleak and in this type of a fight between zombies and webmasters zombies often have an upper hand.
At the same time while blocking all of them is difficult and your 404 errors log probably will remain polluted despite your best efforts, the most obnoxious IPs from which this trick is performed should be blocked just for the sake of justice.
You can write a special script that counts particular bot actions and create a list of "jerks" on a daily basis and ban them for a fixed amount of time, say 90 days (usually this suffice to stop activity from particular set of IPs; those guys are pretty adaptive). Recidivists should be banned for 180 days and so on.
In order to prepare the list for blocking you need first to get a distribution of bogus requests to your side. Limit yourself to the first dozen and never block anybody who is 10 times less then max number of 4xx hits.
For example
cut -d ' ' -f 1 get_40x_1405.txt | sort | uniq -c | sort -rn | head
25606 183.60.215.54
25386 183.60.213.109
24687 183.60.214.23
10141 208.115.113.83
9615 208.115.111.66
4135 100.43.83.158
1431 68.180.224.174
1257 66.249.70.13
861 89.145.95.42
The next step is to determine if all of them have DNS addresses. IPs without DNS are the first candidates for blocking. In the case above the first three Chinese IP addresses do not have DNS names.
perl ./resolv.pl bogus1405 25606 183.60.215.54 25386 183.60.213.109 24687 183.60.214.23 10141 208.115.113.83 9615 208.115.111.66 208-115-111-66-reverse.wowrack.com. 4135 100.43.83.158 1431 68.180.224.174 b100094.yse.yahoo.net. 1257 66.249.70.13 crawl-66-249-70-13.googlebot.com. 861 89.145.95.42 centro-42.grapeshot.co.uk. 820 38.111.147.86 cr6.iparadigms.com.
Now we instantly see that it make sense to concerate our attention on the first four.
The first thing is to determine if they do any PHP probes against your site. If they do more then a dozen, then we can assume that this IP is used by a script kiddie and probably should be banned without further investigation.
fgrep 183.60.215.54 get_40x_1405.txt | fgrep '.php?' | wc -l 3 fgrep 183.60.213.109 get_40x_1405.txt | fgrep '.php?' | wc -l 1 183.60.214.23 get_40x_1405.txt | fgrep '.php?' | wc -l 2 208.115.113.83 get_40x_1405.txt | fgrep ',php?' | wc -l 0As we can see none of those IPs belong to script kiddies.
The next step is to determine whether the number of legitimate GET requests (which resulted in 20x range of codes). If it is less then 10% it make sense to block the sucker.
fgrep 183.60.215.54 get_20x_1405.txt | wc -l 5021 fgrep 183.60.213.109 get_20x_1405.txt | wc -l 5144 fgrep 183.60.214.23 get_20x_1405.txt | wc -l 4921 fgrep 208.115.113.83 get_20x_1405.txt | wc -l 5195 fgrep 208.115.111.66 get_20x_1405.txt | wc -l 5258 fgrep 100.43.83.158 get_20x_1405.txt | wc -l12559
As we can see in all cases the number of successful GET requests is considerable more than 10%, which suggest while they are doing something suspicious, especially 183.60.215.54, it does not make sense to block them.
For IPs with DNS you probably need to be even more careful. You need several additional step trying to determine if there are multiple accesses from this IP (for example often such IP is a proxy for a large organization with some bad apples).
This can be done by extracting all requests from your logs for a given period (say, month) and looking to requests to favicon.ico. Bots generally do not produce such requests.
There are several major types of accesses to non-existent pages that I uncovered so far. I will try to improve this classification as new information becomes available
Here is an example of such behavior:
91.237.249.120 - - [01/Sep/2012:11:32:03 -0700] "GET /Net/Application_layer/SSH/passwordless_ssh_login.shtml HTTP/1.0" 200 85785 "http://www.softpanorama.org/Net/Application_layer/SSH/passwordless_ssh_login.shtml" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2" 91.237.249.120 - - [01/Sep/2012:11:32:04 -0700] "GET /Net/Application_layer/SSH/passwordless_ssh_login.shtml HTTP/1.0" 200 85785 "http://www.softpanorama.org/Net/Application_layer/SSH/passwordless_ssh_login.shtml" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2" 91.237.249.120 - - [01/Sep/2012:11:32:10 -0700] "GET /Social/Toxic_managers/passwordless_ssh_login.shtml HTTP/1.0" 404 17716 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2" 91.237.249.120 - - [01/Sep/2012:11:32:10 -0700] "GET /Toxic_managers/passwordless_ssh_login.shtml HTTP/1.0" 404 17716 "http://www.softpanorama.org/Toxic_managers/passwordless_ssh_login.shtml" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2" 91.237.249.120 - - [01/Sep/2012:12:47:21 -0700] "GET /Net/Application_layer/SSH/passwordless_ssh_login.shtml HTTP/1.0" 200 85785 "http://www.softpanorama.org/Net/Application_layer/SSH/passwordless_ssh_login.shtml" "Mozilla/5.0 (Windows NT 6.0; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1" 91.237.249.120 - - [01/Sep/2012:12:47:24 -0700] "GET /Net/Application_layer/SSH/passwordless_ssh_login.shtml HTTP/1.0" 200 85785 "http://www.softpanorama.org/Net/Application_layer/SSH/passwordless_ssh_login.shtml" "Mozilla/5.0 (Windows NT 6.0; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1"
249 199.21.99.85 - - [22/Aug/2012:00:21:02 -0700] "GET /Security/Internet_privacy/license.shtml HTTP/1.1" 404 26301 "-" "Mozilla/5.0 ( compatible; YandexBot/3.0; +http://yandex.com/bots)" 250 199.21.99.85 - - [22/Aug/2012:00:21:49 -0700] "GET /Admin/Administration_of_remote_datacenter/license.shtml HTTP/1.1" 404 26301 "- " "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" 251 174.129.228.67 - - [22/Aug/2012:00:25:53 -0700] "GET /Net/Application_layer/Ftp/license.shtml HTTP/1.0" 404 26301 "-" "ia_archiver (+http://www.alexa.com/site/help/webmasters; [email protected])" 252 199.21.99.85 - - [22/Aug/2012:00:26:00 -0700] "GET /Malware/Malware_defense_history/Ch01_historic_overview/license.shtml HTTP/1.1" 404 26301 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" 253 66.249.68.81 - - [22/Aug/2012:00:33:29 -0700] "GET /Malware/Malware_defense_history/Malware_gallery/Macro_viruses/license.shtml HT TP/1.1" 404 26301 "-" "Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Versi on/4.0.5 Mobile/8B117 Safari/6531.22.7 (compatible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)" 254 207.46.13.143 - - [22/Aug/2012:01:22:45 -0700] "GET /Malware/Malware_defense_history/Malware_gallery/Network_worms/license.shtml H TTP/1.1" 404 26301 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 255 66.249.68.81 - - [22/Aug/2012:01:50:05 -0700] "GET /Social/Overload/license.shtml HTTP/1.1" 404 26301 "-" "Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6531.22.7 (compat ible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)" 256 157.55.16.177 - - [22/Aug/2012:01:59:16 -0700] "GET /Admin/Job_schedulers/Grid_engine/Installation/license.shtml HTTP/1.1" 404 263 01 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 257 207.46.13.148 - - [22/Aug/2012:02:16:45 -0700] "GET /WWW/Webservers/Apache/license.shtml HTTP/1.1" 404 26301 "-" "Mozilla/5.0 (com patible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 258 130.203.133.123 - - [22/Aug/2012:02:19:58 -0700] "GET /Solaris/Security/RBAC/license.shtml HTTP/1.1" 404 24270 "-" "'citeseerxbot' " 259 199.21.99.85 - - [22/Aug/2012:02:22:09 -0700] "GET /Malware/Malware_defense_history/Ch07_network_worms/license.shtml HTTP/1.1" 404 26301 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" 260 180.76.5.50 - - [22/Aug/2012:02:42:23 -0700] "GET /Net/Certifications/license.shtml HTTP/1re.1" 404
24270 "-" "Mozilla/5.0 (compatib le; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" 261 130.203.133.123 - - [22/Aug/2012:02:43:04 -0700] "GET /Algorithms/Compilers/license.shtml HTTP/1.1" 404 24270 "-" "'citeseerxbot'" 262 89.238.231.130 - - [22/Aug/2012:02:57:34 -0700] "GET /Skeptics/license.shtml HTTP/1.1" 404 26301 "http://www.softpanorama.org/" "M ozilla/3.01 (compatible; AmigaVoyager/2.95; AmigaOS/MC680x0)"
They can be dealt with using mod_rewrite.
5.39.112.251 - - [01/Sep/2012:16:16:01 -0700] "GET /Access_control/Solaris/access_control.shtml HTTP/1.0"
404 17716 "http://www.softpanorama.org/Access_control/Solaris/access_control.shtml" "Mozilla/4.0 (compatib
le; MSIE 6.0; Windows 98; Win 9x 4.90)"
Total records processed 52329
Zombie 41.193.5.52
Rogue php pages requests = 63
Rogue POST requests = 63
Rogue .shtml pages requests = 9
HTTP Codes
200 - 5
404 - 73
403 - 63
There are several similar cases which belong to different classes of errors:
|
|
Switchboard | ||||
| Latest | |||||
| Past week | |||||
| Past month | |||||
 |
 |
 |
Here is a sample of requests
104.196.3.74 - - [08/Dec/2015:01:34:38 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:01:34:38 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:01:34:39 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:00:47 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:00:47 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:00:47 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:09:33 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:09:33 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:09:33 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:12:43 +0000] "GET /About/Stats//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:12:43 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:12:43 +0000] "GET /About//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:16:09 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:16:09 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:16:09 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:27:20 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:27:20 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:27:20 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:40:10 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:40:11 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:40:11 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:40:14 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:40:14 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:40:15 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:43:19 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:43:19 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:43:19 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:47:33 +0000] "GET /WWW/HTTP_log_analysis/requests_for_nonexisting_web_pages.shtml//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:47:33 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:47:33 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:48:02 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:48:02 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:48:02 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:54:50 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:54:50 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:02:54:50 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:02:48 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:02:48 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:02:48 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:13:55 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:13:55 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:13:55 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:25:58 +0000] "GET /WWW/HTTP_log_analysis/requests_for_nonexisting_web_pages.shtml//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:25:58 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:25:58 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:27:25 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:27:25 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:27:25 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:47:18 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:47:19 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:47:19 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:51:09 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:51:09 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:51:09 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:53:12 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:53:12 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833" 104.196.3.74 - - [08/Dec/2015:03:53:12 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
|
|
|
91.121.89.20 - - [28/Aug/2012:09:21:27 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [28/Aug/2012:09:21:27 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [28/Aug/2012:09:21:28 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [28/Aug/2012:09:21:29 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [28/Aug/2012:09:21:29 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [28/Aug/2012:09:21:30 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [28/Aug/2012:09:21:30 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [28/Aug/2012:09:21:31 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [28/Aug/2012:09:21:31 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 5.39.112.251 - - [28/Aug/2012:09:22:04 -0700] "GET /Admin/humor.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Admin/humor.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 93.188.8.141 - - [28/Aug/2012:09:23:54 -0700] "GET /admin/product.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:09:23:54 -0700] "GET /extras/curltest.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 188.187.141.189 - - [28/Aug/2012:09:48:02 -0700] "GET /Commercial_linuxes/Suse/index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/index.php" "Opera/9.80 (Windows NT 6.1; U; YB/3.5.1; ru) Presto/2.6.30 Version/10.63" 188.187.141.189 - - [28/Aug/2012:09:48:04 -0700] "GET /index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/index.php" "Opera/9.80 (Windows NT 6.1; U; YB/3.5.1; ru) Presto/2.6.30 Version/10.63" 5.39.112.251 - - [28/Aug/2012:09:56:19 -0700] "GET /Editors/tcl_editors.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Editors/tcl_editors.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 207.126.61.161 - - [28/Aug/2012:10:28:00 -0700] "GET /About/Stats//index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 207.126.61.161 - - [28/Aug/2012:10:28:00 -0700] "GET //index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 207.126.61.161 - - [28/Aug/2012:10:28:00 -0700] "GET /About//index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 61.56.203.11 - - [28/Aug/2012:10:33:31 -0700] "GET /Scripting/index.php?_REQUEST=&_REQUEST%5boption%5d=com_content&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absolute_path=http://recycleengineering.com/itrecycle/tmp/install_4e8971c78d252/arm7/html/com_tools/daster.jpg?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 61.56.203.11 - - [28/Aug/2012:10:33:33 -0700] "GET /index.php?_REQUEST=&_REQUEST%5boption%5d=com_content&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absolute_path=test?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 61.56.203.11 - - [28/Aug/2012:10:33:34 -0700] "GET /index.php?_REQUEST=&_REQUEST%5boption%5d=com_content&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absolute_path=http://recycleengineering.com/itrecycle/tmp/install_4e8971c78d252/arm7/html/com_tools/daster.jpg?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 200.98.145.36 - - [28/Aug/2012:10:34:02 -0700] "GET /Malware/index2.php?p=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 200.98.145.36 - - [28/Aug/2012:10:34:02 -0700] "GET /index2.php?p=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 5.39.112.251 - - [28/Aug/2012:10:42:59 -0700] "GET /Office/html_editors.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Office/html_editors.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 91.121.115.109 - - [28/Aug/2012:10:43:40 -0700] "GET /Malware/Malicious_web/zombies.shtml//index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.115.109 - - [28/Aug/2012:10:43:40 -0700] "GET //index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.115.109 - - [28/Aug/2012:10:43:41 -0700] "GET /Malware/Malicious_web//index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 93.188.8.141 - - [28/Aug/2012:10:49:40 -0700] "GET /Security/admin/sqlpatch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:40 -0700] "GET /Security/admin/sqlpatch1.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:41 -0700] "GET /Security/admin/sq1patch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:41 -0700] "GET /Security/admin/sq1p4tch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:41 -0700] "GET /Security/admin/sqlpatch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:42 -0700] "GET /Security/admin/sqlpatch.php1/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:42 -0700] "GET /Security/admin/sqlpatch1.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:43 -0700] "GET /Security/admin/sq1patch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:43 -0700] "GET /Security/admin/sq1p4tch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:44 -0700] "GET /Security/admin/sqlpatch.php1/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:47 -0700] "GET /admin/sqlpatch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:47 -0700] "GET /admin/sqlpatch1.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:48 -0700] "GET /admin/sq1patch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:48 -0700] "GET /admin/sq1p4tch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:49 -0700] "GET /admin/sqlpatch.php1/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:49 -0700] "GET /admin/sqlpatch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:49 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:49 -0700] "GET /admin/sqlpatch1.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:50 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:50 -0700] "GET /admin/sq1patch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:50 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:50 -0700] "GET /admin/sq1p4tch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:51 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:51 -0700] "GET /admin/sqlpatch.php1/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:51 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:51 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:52 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:52 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:53 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 93.188.8.141 - - [28/Aug/2012:10:49:53 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)" 5.39.112.251 - - [28/Aug/2012:11:12:55 -0700] "GET /Commercial_linuxes/linux_acl.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Commercial_linuxes/linux_acl.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.9.199.112 - - [28/Aug/2012:11:19:24 -0700] "GET /scripting/php.shtml HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" 217.25.31.21 - - [28/Aug/2012:11:30:13 -0700] "GET /Logs/log_security.shtml//xmlrpc.php/xmlprc.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0" 217.25.31.21 - - [28/Aug/2012:11:30:13 -0700] "GET //xmlrpc.php/xmlprc.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0" 217.25.31.21 - - [28/Aug/2012:11:30:14 -0700] "GET /Logs//xmlrpc.php/xmlprc.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0" 209.172.50.183 - - [28/Aug/2012:11:37:18 -0700] "GET /Tools/http://www.movinginn.co.uk//index.php?option=com_properties&controller=../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 209.172.50.183 - - [28/Aug/2012:11:37:18 -0700] "GET /http://www.movinginn.co.uk//index.php?option=com_properties&controller=../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 5.39.112.251 - - [28/Aug/2012:13:20:26 -0700] "GET /Utilities/dir_sync.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Utilities/dir_sync.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 37.220.26.62 - - [28/Aug/2012:13:32:06 -0700] "HEAD /history/hesilverhand.com/twacks/index.php?PHPSESSID=3114b73036790fa90aff2300bb08ce7e&topic=16451.15 HTTP/1.0" 403 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50" 2.93.27.123 - - [28/Aug/2012:13:47:00 -0700] "GET /Malware/Malicious_web/Bulletin/web_zombies_bulletin070623.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Malware/Malicious_web/Bulletin/web_zombies_bulletin070623.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 65.52.108.12 - - [28/Aug/2012:13:54:30 -0700] "GET /Tools/tar.shtml/index.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 5.39.112.251 - - [28/Aug/2012:14:24:21 -0700] "GET /Bookshelf/excel.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Bookshelf/excel.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [28/Aug/2012:14:56:54 -0700] "GET /Solaris/solaris_whitepapers.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Solaris/solaris_whitepapers.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [28/Aug/2012:15:06:22 -0700] "GET /Scripting/php.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/php.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [28/Aug/2012:15:27:53 -0700] "GET /Editors/ctags.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Editors/ctags.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 184.170.246.3 - - [28/Aug/2012:15:36:17 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/3.0 (OS/2; U)" 5.9.198.245 - - [28/Aug/2012:16:02:54 -0700] "GET /DNS/security.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/DNS/security.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 85.107.189.12 - - [28/Aug/2012:16:05:27 -0700] "POST /admin/administrators.php/login.php?action=insert HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)" 85.107.189.12 - - [28/Aug/2012:16:05:28 -0700] "POST /admin/login.php?action=process HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)" 178.84.149.128 - - [28/Aug/2012:16:29:31 -0700] "GET /login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)" 178.84.149.128 - - [28/Aug/2012:16:29:32 -0700] "GET /signup.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)" 5.39.112.251 - - [28/Aug/2012:16:44:11 -0700] "GET /Tools/dd.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Tools/dd.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 174.106.4.142 - - [28/Aug/2012:16:47:09 -0700] "GET /index.php?page=register HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0" 5.39.112.251 - - [28/Aug/2012:17:00:41 -0700] "GET /OSS/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/OSS/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 37.220.26.62 - - [28/Aug/2012:17:12:53 -0700] "HEAD /history/hesilverhand.com/twacks/index.php?PHPSESSID=3114b73036790fa90aff2300bb08ce7e&topic=16451.15 HTTP/1.0" 403 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50" 91.194.251.186 - - [28/Aug/2012:17:13:36 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050609 Firefox/1.0.4" 174.106.4.142 - - [28/Aug/2012:17:31:59 -0700] "GET /profile.php?mode=register HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0" 91.194.251.186 - - [28/Aug/2012:17:37:10 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-GB; rv:1.7.10) Gecko/20050717 Firefox/1.0.6" 91.194.251.186 - - [28/Aug/2012:17:40:04 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050609 Firefox/1.0.4" 91.121.106.113 - - [28/Aug/2012:17:42:35 -0700] "GET /Mail/mta.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Mail/mta.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [28/Aug/2012:17:45:33 -0700] "GET /Mail/spam.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Mail/spam.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 91.194.251.186 - - [28/Aug/2012:17:47:02 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050609 Firefox/1.0.4" 37.59.173.131 - - [28/Aug/2012:17:48:43 -0700] "GET /Scripting/Phprama/command_line_php.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/Phprama/command_line_php.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 68.169.35.164 - - [28/Aug/2012:17:53:39 -0700] "GET /Commercial_linuxes/Suse/Security/launchpad_login.php HTTP/1.0" 403 82 "http://www.softpanorama.org/launchpad_login.php" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; MRA 5.10 (build 5310); .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)" 5.39.112.251 - - [28/Aug/2012:17:58:56 -0700] "GET /Scripting/Shellorama/vi_mode.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/Shellorama/vi_mode.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 46.246.17.192 - - [28/Aug/2012:18:11:02 -0700] "GET /Mail/mta.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Mail/mta.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 157.55.32.80 - - [28/Aug/2012:18:31:31 -0700] "GET /Security/IDS/acid.shtml/hall.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 5.39.112.251 - - [28/Aug/2012:18:35:24 -0700] "GET /OSS/linus_midas_touch.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/OSS/linus_midas_touch.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [28/Aug/2012:18:42:53 -0700] "GET /DNS/dns_servers.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/DNS/dns_servers.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 222.122.46.235 - - [28/Aug/2012:18:43:39 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.1) Gecko/20060130 SeaMonkey/1.0" 46.105.99.187 - - [28/Aug/2012:18:44:24 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; Konqueror/3.1; Linux 2.4.22-10mdk; X11; i686; fr, fr_FR)" 46.105.99.187 - - [28/Aug/2012:18:45:46 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511" 5.39.112.251 - - [28/Aug/2012:18:48:03 -0700] "GET /SE/humor.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/SE/humor.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 46.105.99.187 - - [28/Aug/2012:18:48:05 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050512 Firefox" 5.39.112.251 - - [28/Aug/2012:18:56:42 -0700] "GET /People/Stallman/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/People/Stallman/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 176.223.201.139 - - [28/Aug/2012:19:03:17 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-GB; rv:1.7.10) Gecko/20050717 Firefox/1.0.6" 5.39.112.251 - - [28/Aug/2012:19:14:30 -0700] "GET /People/Cox/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/People/Cox/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 211.210.0.11 - - [28/Aug/2012:19:30:19 -0700] "GET /zboard.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 211.210.0.11 - - [28/Aug/2012:19:30:31 -0700] "GET /zboard.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 211.210.0.11 - - [28/Aug/2012:19:31:52 -0700] "GET /Malware/Malicious_web/zboard.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 211.210.0.11 - - [28/Aug/2012:19:31:53 -0700] "GET /zboard.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 211.210.0.11 - - [28/Aug/2012:19:31:53 -0700] "GET /Malware/zboard.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 5.39.112.251 - - [28/Aug/2012:19:54:58 -0700] "GET /Net/troubleshooting.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Net/troubleshooting.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 108.60.129.21 - - [28/Aug/2012:20:07:16 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" 108.60.129.21 - - [28/Aug/2012:20:07:16 -0700] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" 108.60.129.21 - - [28/Aug/2012:20:07:17 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" 108.60.129.21 - - [28/Aug/2012:20:07:17 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" 108.60.129.21 - - [28/Aug/2012:20:07:17 -0700] "GET /admin/categories.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" 108.60.129.21 - - [28/Aug/2012:20:07:17 -0700] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" 69.175.50.169 - - [28/Aug/2012:20:13:16 -0700] "GET /WWW/Content_management/wiki.shtml/index.php?title=Special:UserLogin&action=submitlogin&type=signup&returnto=Special:UserLogin HTTP/1.1" 403 82 "http://www.softpanorama.org/WWW/Content_management/wiki.shtml/index.php?title=Special:UserLogin&type=signup&returnto=Special:UserLogin&returntoquery=type%3Dsignup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" 69.175.50.169 - - [28/Aug/2012:20:13:16 -0700] "POST /WWW/Content_management/wiki.shtml/index.php?title=Special:UserLogin&action=submitlogin&type=signup&returnto=Special:UserLogin HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" 200.98.201.180 - - [28/Aug/2012:20:13:19 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)" 200.98.201.180 - - [28/Aug/2012:20:13:20 -0700] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)" 200.98.201.180 - - [28/Aug/2012:20:13:20 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)" 200.98.201.180 - - [28/Aug/2012:20:13:20 -0700] "GET /admin/categories.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)" 200.98.201.180 - - [28/Aug/2012:20:13:21 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)" 200.98.201.180 - - [28/Aug/2012:20:13:22 -0700] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)" 108.60.129.21 - - [28/Aug/2012:20:28:16 -0700] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" 108.60.129.21 - - [28/Aug/2012:20:29:05 -0700] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" 5.39.112.251 - - [28/Aug/2012:20:36:14 -0700] "GET /Copyright/humor.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Copyright/humor.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 157.55.34.35 - - [28/Aug/2012:22:17:07 -0700] "GET /WWW/Webservers/web_server_security.shtml/nota.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 188.132.239.233 - - [28/Aug/2012:22:22:02 -0700] "GET /extras/curltest.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:22:22:22 -0700] "GET /extras/curltest.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 37.59.173.131 - - [28/Aug/2012:22:49:15 -0700] "GET /Scripting/Phprama/command_line_php.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/Phprama/command_line_php.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [28/Aug/2012:23:06:01 -0700] "GET /Admin/unix_conf_managment.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Admin/unix_conf_managment.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 27.153.250.187 - - [28/Aug/2012:23:32:57 -0700] "GET /scripting/phprama/ HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)" 5.39.112.251 - - [28/Aug/2012:23:42:09 -0700] "GET /Commercial_linuxes/lpi_certification.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Commercial_linuxes/lpi_certification.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 188.132.239.233 - - [28/Aug/2012:23:43:07 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:43:08 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:43:09 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:43:10 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:43:11 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:43:12 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:49:28 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:49:29 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:49:30 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:49:31 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:49:32 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 188.132.239.233 - - [28/Aug/2012:23:49:33 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 5.39.112.251 - - [29/Aug/2012:00:04:22 -0700] "GET /Articles/Linux_vs_Solaris/comparison_of_internal_architecture.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Articles/Linux_vs_Solaris/comparison_of_internal_architecture.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 85.107.189.12 - - [29/Aug/2012:01:12:22 -0700] "POST /admin/administrators.php/login.php?action=insert HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)" 85.107.189.12 - - [29/Aug/2012:01:12:22 -0700] "POST /admin/login.php?action=process HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)" 5.39.112.251 - - [29/Aug/2012:01:32:07 -0700] "GET /Net/Transport_layer/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Net/Transport_layer/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 91.121.89.20 - - [29/Aug/2012:02:46:25 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [29/Aug/2012:02:46:25 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [29/Aug/2012:02:46:26 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [29/Aug/2012:02:46:27 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [29/Aug/2012:02:46:27 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [29/Aug/2012:02:46:28 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [29/Aug/2012:02:46:28 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [29/Aug/2012:02:46:29 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 91.121.89.20 - - [29/Aug/2012:02:46:30 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 112.25.12.38 - - [29/Aug/2012:03:38:32 -0700] "GET /login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)" 80.58.29.174 - - [29/Aug/2012:03:38:34 -0700] "GET /signup.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)" 80.58.29.174 - - [29/Aug/2012:03:38:35 -0700] "GET /signup.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)" 5.39.112.251 - - [29/Aug/2012:03:43:28 -0700] "GET /WWW/www_management_scripts.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/WWW/www_management_scripts.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 37.59.131.9 - - [29/Aug/2012:03:46:16 -0700] "GET /Tools/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Tools/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 174.127.116.240 - - [29/Aug/2012:03:51:35 -0700] "GET /register.php?do=signup HTTP/1.1" 403 82 "http://www.softpanorama.org/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)" 5.39.112.251 - - [29/Aug/2012:04:13:19 -0700] "GET /History/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/History/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:04:16:01 -0700] "GET /history.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/history.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:04:32:16 -0700] "GET /Windows/startup_and_shutdown.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Windows/startup_and_shutdown.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 64.15.147.199 - - [29/Aug/2012:04:54:57 -0700] "GET /Skeptics/Political_skeptic//parse/parser.php?WN_BASEDIR=test?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0" 64.15.147.199 - - [29/Aug/2012:04:54:58 -0700] "GET /Skeptics/Political_skeptic//parse/parser.php?WN_BASEDIR=http://www.aorta.ca/byroe.jpg?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0" 64.15.147.199 - - [29/Aug/2012:04:54:59 -0700] "GET /Skeptics/Political_skeptic//parse/parser.php?WN_BASEDIR=?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0" 64.15.147.199 - - [29/Aug/2012:04:55:01 -0700] "GET //parse/parser.php?WN_BASEDIR=test?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0" 64.15.147.199 - - [29/Aug/2012:04:55:02 -0700] "GET //parse/parser.php?WN_BASEDIR=http://www.aorta.ca/byroe.jpg?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0" 64.15.147.199 - - [29/Aug/2012:04:55:03 -0700] "GET //parse/parser.php?WN_BASEDIR=?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0" 64.15.147.199 - - [29/Aug/2012:04:55:04 -0700] "GET /Skeptics//parse/parser.php?WN_BASEDIR=test?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0" 64.15.147.199 - - [29/Aug/2012:04:55:05 -0700] "GET /Skeptics//parse/parser.php?WN_BASEDIR=http://www.aorta.ca/byroe.jpg?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0" 64.15.147.199 - - [29/Aug/2012:04:55:07 -0700] "GET /Skeptics//parse/parser.php?WN_BASEDIR=?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0" 5.39.112.251 - - [29/Aug/2012:06:05:31 -0700] "GET /OSS/open_source.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/OSS/open_source.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 219.137.181.125 - - [29/Aug/2012:06:08:47 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" 219.137.181.125 - - [29/Aug/2012:06:08:49 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" 205.189.73.122 - - [29/Aug/2012:06:16:55 -0700] "GET /register.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.78 Safari/535.11" 95.173.185.22 - - [29/Aug/2012:06:36:09 -0700] "GET /WWW/web_logs_analysis.shtml//index.php?option=com_fabrik&controller=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 95.173.185.22 - - [29/Aug/2012:06:36:09 -0700] "GET //index.php?option=com_fabrik&controller=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 95.173.185.22 - - [29/Aug/2012:06:36:10 -0700] "GET /WWW//index.php?option=com_fabrik&controller=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 5.39.112.251 - - [29/Aug/2012:06:47:22 -0700] "GET /Scripting/Shellorama/dotfiles.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/Shellorama/dotfiles.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:07:44:52 -0700] "GET /People/index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/People/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:07:47:32 -0700] "GET /Education/SAT/Strategy/multiple_choice_questions_exam_strategies.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Education/SAT/Strategy/multiple_choice_questions_exam_strategies.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 131.253.46.202 - - [29/Aug/2012:07:54:19 -0700] "GET /Lang/java.shtml/templates/errors.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 5.39.112.251 - - [29/Aug/2012:08:14:11 -0700] "GET /Admin/system_monitoring.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Admin/system_monitoring.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:08:21:33 -0700] "GET /Solaris/certification.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Solaris/certification.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:08:27:00 -0700] "GET /Solaris/solaris_compilation_problems.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Solaris/solaris_compilation_problems.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 72.252.249.34 - - [29/Aug/2012:08:31:04 -0700] "GET /Utilities/vmstat.shtml/admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0" 72.252.249.34 - - [29/Aug/2012:08:31:04 -0700] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0" 72.252.249.34 - - [29/Aug/2012:08:31:17 -0700] "GET /Utilities/vmstat.shtml/admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0" 72.252.249.34 - - [29/Aug/2012:08:31:17 -0700] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0" 72.252.249.34 - - [29/Aug/2012:08:32:04 -0700] "GET /Utilities/vmstat.shtml/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0" 72.252.249.34 - - [29/Aug/2012:08:32:04 -0700] "GET /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0" 72.252.249.34 - - [29/Aug/2012:08:32:04 -0700] "GET /Utilities/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0" 5.39.112.251 - - [29/Aug/2012:08:39:24 -0700] "GET /index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 219.137.181.125 - - [29/Aug/2012:08:43:02 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" 5.39.112.251 - - [29/Aug/2012:09:22:09 -0700] "GET /Skeptics/Pseudoscience/harvard_mafia.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Skeptics/Pseudoscience/harvard_mafia.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 78.145.139.206 - - [29/Aug/2012:09:59:34 -0700] "POST /Tools/mobiquo/mobiquo.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" 87.253.162.11 - - [29/Aug/2012:10:19:04 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/4.8 [en] (Windows NT 5.0; U)" 205.189.73.122 - - [29/Aug/2012:10:39:19 -0700] "GET /register.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.78 Safari/535.11" 85.107.181.212 - - [29/Aug/2012:10:55:43 -0700] "POST /admin/administrators.php/login.php?action=insert HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)" 85.107.181.212 - - [29/Aug/2012:10:55:44 -0700] "POST /admin/login.php?action=process HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)" 5.39.112.251 - - [29/Aug/2012:11:18:10 -0700] "GET /Articles/note_on_the_relationship_of_brooks_law_and_conway_law.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Articles/note_on_the_relationship_of_brooks_law_and_conway_law.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 178.73.212.226 - - [29/Aug/2012:11:33:44 -0700] "GET /Scripting/php.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/php.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:11:42:05 -0700] "GET /History/cpu_history.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/History/cpu_history.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.9.198.245 - - [29/Aug/2012:11:43:27 -0700] "GET /Scripting/php.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/php.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:11:49:17 -0700] "GET /Security/social_sites_as_intelligence_collection_tools.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Security/social_sites_as_intelligence_collection_tools.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:11:53:58 -0700] "GET /Bulletin/sp2004h.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Bulletin/sp2004h.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 219.137.181.125 - - [29/Aug/2012:12:20:07 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" 219.137.181.125 - - [29/Aug/2012:12:20:07 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" 219.137.181.125 - - [29/Aug/2012:12:20:07 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" 219.137.181.125 - - [29/Aug/2012:12:20:08 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" 205.189.73.191 - - [29/Aug/2012:12:23:49 -0700] "GET /register.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.78 Safari/535.11" 5.39.112.251 - - [29/Aug/2012:12:36:53 -0700] "GET /Windows/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Windows/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:12:57:03 -0700] "GET /Utilities/touch.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Utilities/touch.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 219.137.181.125 - - [29/Aug/2012:13:12:57 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" 157.55.33.181 - - [29/Aug/2012:13:32:51 -0700] "GET /Malware/Malicious_web/Bulletin/index.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 5.39.112.251 - - [29/Aug/2012:13:48:26 -0700] "GET /Education/social_problems_of_education.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Education/social_problems_of_education.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 46.246.88.137 - - [29/Aug/2012:13:53:44 -0700] "GET /Copyright/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Copyright/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:13:57:09 -0700] "GET /Scripting/python.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/python.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:13:59:33 -0700] "GET /Bulletin/sp2003h.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Bulletin/sp2003h.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 68.169.35.164 - - [29/Aug/2012:14:28:15 -0700] "GET /Commercial_linuxes/Suse/Security/launchpad_login.php HTTP/1.0" 403 82 "http://www.softpanorama.org/launchpad_login.php" "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0" 82.247.105.227 - - [29/Aug/2012:15:15:08 -0700] "POST /Commercial_linuxes/Tips/mobiquo/mobiquo.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.6 (KHTML, like Gecko) Chrome/23.0.1243.2 Safari/537.6" 5.39.112.251 - - [29/Aug/2012:15:17:12 -0700] "GET /Utilities/script.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Utilities/script.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:15:31:42 -0700] "GET /Solaris/solaris_enterprize_strategy.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Solaris/solaris_enterprize_strategy.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 5.39.112.251 - - [29/Aug/2012:15:38:04 -0700] "GET /Admin/job_schedulers.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Admin/job_schedulers.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 222.231.2.134 - - [29/Aug/2012:16:03:13 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:14 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:15 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:15 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:15 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:16 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:16 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:16 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:17 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:17 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:18 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:03:18 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:26 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:27 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:27 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:27 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:27 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:28 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:28 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:28 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:29 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:29 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:30 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 222.231.2.134 - - [29/Aug/2012:16:06:30 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)" 108.171.246.242 - - [29/Aug/2012:16:29:43 -0700] "GET /pingserver.php HTTP/1.1" 403 82 "-" "gsa-crawler (Enterprise; GID-01422; jplastiras.com)" 108.171.246.242 - - [29/Aug/2012:16:29:43 -0700] "GET /WWW/pingserver.php HTTP/1.1" 403 82 "-" "gsa-crawler (Enterprise; GID-01422; jplastiras.com)" 5.39.112.251 - - [29/Aug/2012:16:32:46 -0700] "GET /Windows/direct_disk_editing.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Windows/direct_disk_editing.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 120.128.6.235 - - [29/Aug/2012:16:40:08 -0700] "GET /index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/index.php" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) Opera 6.01 [en]" 120.128.6.235 - - [29/Aug/2012:16:40:20 -0700] "GET /index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/index.php" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) Opera 6.01 [en]" 5.39.112.251 - - [29/Aug/2012:17:01:05 -0700] "GET /Copyright/License_classification/social_dynamics_of_BSD_and_GPL.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Copyright/License_classification/social_dynamics_of_BSD_and_GPL.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)" 217.73.229.210 - - [29/Aug/2012:17:08:58 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:08:58 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:08:59 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:08:59 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:08:59 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:00 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:00 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:00 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:01 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:01 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:01 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:02 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:02 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:02 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:03 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:03 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:03 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:04 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:04 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:04 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:05 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:05 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:05 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:06 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:06 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:07 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:07 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:07 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:08 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:08 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:08 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:09 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:09 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:09 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:10 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 217.73.229.210 - - [29/Aug/2012:17:09:10 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6" 95.31.3.173 - - [29/Aug/2012:18:34:42 -0700] "GET /WWW/index.php?do=basic HTTP/1.1" 403 82 "http://www.softpanorama.org/" "Mozilla/5.0 (Linux; U; Android 2.2; fr-fr; Desire_A8181 Build/FRF91) App3leWebKit/53.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
|
|
|
120.42.77.92 - - [29/Aug/2012:12:26:35 -0700] "GET /passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" 120.42.77.92 - - [29/Aug/2012:12:29:04 -0700] "GET /History/passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)" 120.42.77.92 - - [29/Aug/2012:12:29:04 -0700] "GET /passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)" 91.217.178.178 - - [29/Aug/2012:12:48:25 -0700] "GET /WWW//passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; MRA 5.10 (build 5310); .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)" 91.217.178.178 - - [29/Aug/2012:12:48:26 -0700] "GET //passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org//passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; MRA 5.10 (build 5310); .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)" 94.181.166.31 - - [29/Aug/2012:13:42:55 -0700] "GET /Commercial_linuxes/RHEL/Installation/passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Opera/9.00 (Windows NT 5.1; U; en)" 94.181.166.31 - - [29/Aug/2012:13:42:56 -0700] "GET /RHEL/Installation/passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/RHEL/Installation/passwordless_ssh_login.shtml" "Opera/9.00 (Windows NT 5.1; U; en)" 141.105.66.145 - - [29/Aug/2012:15:05:41 -0700] "GET /Lang//passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Opera/9.80 (Windows NT 5.1; U; MRA 6.0 (build 5680); ru) Presto/2.10.289 Version/12.00" 141.105.66.145 - - [29/Aug/2012:15:05:41 -0700] "GET //passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org//passwordless_ssh_login.shtml" "Opera/9.80 (Windows NT 5.1; U; MRA 6.0 (build 5680); ru) Presto/2.10.289 Version/12.00" 94.181.166.31 - - [29/Aug/2012:15:45:36 -0700] "GET /Admin/passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 2000) Opera 6.0 [en]" 94.181.166.31 - - [29/Aug/2012:15:45:37 -0700] "GET /passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 2000) Opera 6.0 [en]"
|
|
|
Google Groups
zantoro
1/4/10
I have read the FAQs and checked for similar issues: YES
My site's URL is: http://bit.ly/7qzOfm
Description (including timeline of any changes made):
Hello,
googlebot and all other bots (including msn and sharepoint) are crawling our old website addresses and some custom addresses which never existed.
This is slowing down our website (at the moment we have disabled all crawlings through robot.txt).
an example of the unexistent address is: http://bit.ly/7Qq1rf
as you can see the page the bot is looking for is /WebSite/NewsandEvents/events.aspx/ims/MULTIMODAL/200910_WALTERPROJECT.aspx which doesn't make sense as it treats events.aspx as a folder.
We already disabled ASP.NET PathInfo otherwise IIS would try to resolve the trailing address as PathInfo (slowing down the resolution even more).
how can I fix this problem?Thanks,
Roberto.Autocrat
1/4/10
By making sure your server/script responds with a proper 404 instead of a 200?
You should also try to discover Where the incorrect URLs are originating.
If they are plain old Wrong - try Xenu Link Slueth, crawl your site and make sure it's not you.
If they are plain old Wrong - check any Sitemaps and make sure you are not providing wrong URLs there.
After that - look through server logs to see if anyone is requesting those URLs, and see if there is a referer - it may be an external link.
If you can identify where these requests should be going - you could consider using 301 Redirects.zantoro
Hi,
thanks for the super-quick answer.
It returns a 302 as we provide a customized error page.
this is the whole line in the log:
2009-12-22 00:34:58 W3SVC1021457076 MAINFRAME 172.26.1.7 GET /WebSite/homepage.aspx/membership/Technologies/Technologies/NewsandEvents/document/aboutETSI/Annual_report/Annual_Report_2008_english.pdf - 80 - 66.249.65.35 HTTP/1.1 Googlebot/2.1+(+http://www.google.com/bot.html) - - www.etsi.org 302 0 0 775 337 109
does this mean www.etsi.org is the referer? (that's the site itself)
I checked with your tool and I see no broken links referring to "aspx/" addresses
I checked with Google Webmaster tools and there are no incoming links to these addresses.
those URLs are only requested by bots (all of them)
There is only one sitemap: http://www.etsi.org/Application/CMS/siteMap/sitemap.xml and no "aspx/" links are listed.
Thanks for any other tip you can give me,
Roberto.Autocrat
1/4/10
Here's what G see's as possibly matches for the end of that URL
http://www.google.co.uk/#q=%22document/aboutETSI/Annual_report/Annual_Report_2008_english.pdf%22&hl=en&filter=0&fp=6ebf334cc7734206Do any of those link to your site?
Whether you provide a customised 404 page or not - you should still send a 404 response - NOT a 302.
You should set your server to send a 404 response, and specifiy a page it an load up as a 404.
You make sure that page/script/code sends a 404 response header.
Do not redirect to some page and think it is a 404 - it isn't.Heres what G see's for "/WebSite/homepage.aspx/membership"
http://www.google.co.uk/#hl=en&q=%22/WebSite/homepage.aspx/membership%22&start=10&sa=N&filter=0&fp=6ebf334cc7734206Do you use the Base Href element anywhere on your site?
It's possible that using the wrong base href, and relational URLs (instead of absolute ones) could result in errors?By making sure your server/script responds with a proper 404 instead of a 200?
You should also try to discover Where the incorrect URLs are originating.
If they are plain old Wrong - try Xenu Link Slueth, crawl your site and make sure it's not you.
If they are plain old Wrong - check any Sitemaps and make sure you are not providing wrong URLs there.
After that - look through server logs to see if anyone is requesting those URLs, and see if there is a referer - it may be an external link.
If you can identify where these requests should be going - you could consider using 301 Redirects.
|
|
|
Sebastian Luemmer
Hi,
when I had a look at my monthly webserver logfile, I found several
strange requests for files, which are definitely not on my webserver.
These files were/_vti_inf.html
/_vti_bin/shtml.exe/_vti_rpc
/IMagEs/loGO/LOgo_ICo.IcOThey do not match or even look like anything on the server! Where do
these requests come from? I don't think that anybody types
http://www.foo.bar/IMagEs/loGO/LOgo_ICo.IcO when opening his browser.
Are these requests coming from bots or worms or viruses or something
like that? Who knows that?Thank you for your ideas, this is not really a great problem for me, I'm
just interested in knowing what's going on on the server.Thanks
SebastianBrian
Sebastian Luemmer wrote:
[color=blue]
> I found several strange requests for files, which are
> definitely not on my webserver.[/color]This is ot for a www authoring group. You might have better luck in
ciwa-site design, or alt.www.webmaster.
[color=blue]
> /_vti_inf.html
> /_vti_bin/shtml.exe/_vti_rpc
> /IMagEs/loGO/LOgo_ICo.IcO
>
> They do not match or even look like anything on the server! Where do
> these requests come from? I don't think that anybody types
> http://www.foo.bar/IMagEs/loGO/LOgo_ICo.IcO when opening his browser.
> Are these requests coming from bots or worms or viruses or something
> like that? Who knows that?[/color]The first two look like Code Red/Nimda worms looking for files that
indicate that the server software is MS IIS. No idea what the third
request is about.--
Brian
follow the directions in my address to email meIvo
"Brian" <[email protected]> wrote in message
news:ocXeb.482123$cF.167948@rwcrnsc53...[color=blue]
> Sebastian Luemmer wrote:
>
>[color=green]
> > I found several strange requests for files, which are
> > definitely not on my webserver.[/color]
>
> This is ot for a www authoring group. You might have better luck in
> ciwa-site design, or alt.www.webmaster.
>[color=green]
> > /_vti_inf.html
> > /_vti_bin/shtml.exe/_vti_rpc
> > /IMagEs/loGO/LOgo_ICo.IcO
> >
> > They do not match or even look like anything on the server! Where do
> > these requests come from? I don't think that anybody types
> > http://www.foo.bar/IMagEs/loGO/LOgo_ICo.IcO when opening his browser.
> > Are these requests coming from bots or worms or viruses or something
> > like that? Who knows that?[/color]
>
> The first two look like Code Red/Nimda worms looking for files that
> indicate that the server software is MS IIS. No idea what the third
> request is about.
>
> --
> Brian
> follow the directions in my address to email me
>[/color]I also see numerous requests each month for /formmail.cgi with various
capitalizations although no such file has ever existed on my site. Even
stranger, non-existing files also show up as refferer!?
Would it be possible to detect if it is indeed a worm, and then output a
rather large number of megabytes or something to choke it?
Ivo"Ivo" <[email protected]> wrote in news:[email protected]:
[color=blue]
> I also see numerous requests each month for /formmail.cgi with various
> capitalizations although no such file has ever existed on my site. Even
> stranger, non-existing files also show up as refferer!?
> Would it be possible to detect if it is indeed a worm, and then output a
> rather large number of megabytes or something to choke it?[/color]Matt Wright's original formmail script is a godsend to spammers, since it's
willing to send to any email address that's included in the form that
invokes it. If you've ever gotten a spam that talks about the results of
your request, you've seen what can happen when a spammer gets a hold of an
unintentional spam gateway. I assume someone is scanning you to see if you
have that particular vulnerability.
Brian
Ivo wrote:[color=blue][color=green][color=darkred]
>>>I found several strange requests for files[/color]
>>[color=darkred]
>>> /_vti_inf.html[/color]
>>
>>Code Red/Nimda worms looking for files that
>>indicate that the server software is MS IIS.[/color]
>
> I also see numerous requests each month for /formmail.cgi with various
> capitalizations although no such file has ever existed on my site.[/color]Spammers, looking for a cgi mail interface. They hope to use your
copy of formmail.pl as a mule to send their spam, which will appear to
be coming from you domain. Well, it would be coming from your domain,
but you would not have been the spam's author.
[color=blue]
> Would it be possible to detect if it is indeed a worm, and then output a
> rather large number of megabytes or something to choke it?[/color]It might be. As I said earlier, this is OT for this group, so you may
not get that question answered here. The simplest thing you can do is
redirect requests for files such as these to invalid domains.redirect /cgi-bin/ http://stop.spam.invalid
redirect /_vti_bin http://stop.the.virus.invalidPlease include the .invalid. There is no reason to punish some domain
by making them the target of the redirects.--
Brian
follow the directions in my address to email me
Google matched content |
Hypertext Transfer Protocol - Wikipedia, the free encyclopedia
PHP Page Hits Script - Strangly tracking non-existing contents on server - Web Hosting Talk
non existing page requests (Hacking attempts
Society
Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers : Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism : The Iron Law of Oligarchy : Libertarian Philosophy
Quotes
War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda : SE quotes : Language Design and Programming Quotes : Random IT-related quotes : Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce : Bernard Shaw : Mark Twain Quotes
Bulletin:
Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 : Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law
History:
Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds : Larry Wall : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS : Programming Languages History : PL/1 : Simula 67 : C : History of GCC development : Scripting Languages : Perl history : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history
Classic books:
The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month : How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite
Most popular humor pages:
Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor
The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D
Copyright © 1996-2021 by Softpanorama Society. www.softpanorama.org was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.
FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.
This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...
|
|
You can use PayPal to to buy a cup of coffee for authors of this site |
Disclaimer:
The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.
Last modified: January, 09, 2020
