Here is a log of a prolonged probe of the web server from somewhere in China. The attack came from the IP address 202.104.139.222: $ whois -h whois.apnic.net 202.104.139.222 inetnum: 202.104.0.0 - 202.104.255.255 netname: CHINANET-GD descr: CHINANET Guangdong province network descr: Data Communication Division descr: China Telecom country: CN admin-c: CH93-AP tech-c: WM12-AP mnt-by: MAINT-CHINANET mnt-lower: MAINT-CHINANET-GD changed: hostmaster@ns.chinanet.cn.net 20000101 source: APNIC person: Chinanet Hostmaster address: A12,Xin-Jie-Kou-Wai Street phone: +86-10-62370437 fax-no: +86-10-62053995 e-mail: hostmaster@ns.chinanet.cn.net nic-hdl: CH93-AP mnt-by: MAINT-CHINANET changed: hostmaster@ns.chinanet.cn.net 20000101 source: APNIC person: WU MIAN address: RO.2 ZHONGSHAN,GUANGZHOU,GUANGDONG, address: 510080,CHINA phone: +086-20-87619051 fax-no: +86-20-87619799 e-mail: wumian@gdnmc.guangzhou.gd.cn nic-hdl: WM12-AP mnt-by: MAINT-CHINANET-GD changed: wumian@gdnmc.guangzhou.gd.cn 19990615 source: APNIC The attack consists of a systematic blind automated probe of the web server for known weaknesses. Note that 1) though the information is instantly available, the probe does not make use of the fact that it is talking to the Apache web server on a unix machine, and in fact spends a great deal of time looking for weaknesses that only exist on Windows NT running Microsofts web server. Note that the entire attack is repeated, and completes in a very short time -- these facts conclusively demonstrate that the attack is scripted. However, there is external evidence that the attack was targetted, rather than being art of a larger sweep of network addresses. Here are the logs. Note the timestamps indicate several hits per second... access_log:202.104.139.222 - - [29/Mar/2000:12:19:08 -0800] "GET / HTTP/1.1" 200 3459 access_log:202.104.139.222 - - [29/Mar/2000:12:19:09 -0800] "GET /songbird/index.html HTTP/1.1" 200 2379 access_log:202.104.139.222 - - [29/Mar/2000:12:19:09 -0800] "GET /songbird/rates.html HTTP/1.1" 200 3139 access_log:202.104.139.222 - - [29/Mar/2000:12:19:09 -0800] "GET /policy.html HTTP/1.1" 200 3154 access_log:202.104.139.222 - - [29/Mar/2000:12:19:09 -0800] "GET /spam.html HTTP/1.1" 200 1925 access_log:202.104.139.222 - - [29/Mar/2000:12:19:10 -0800] "GET /disclaimer.html HTTP/1.1" 200 937 access_log:202.104.139.222 - - [29/Mar/2000:12:19:10 -0800] "GET /iissamples/exair/search/qfullhit.htw HTTP/1.1" 404 242 access_log:202.104.139.222 - - [29/Mar/2000:12:19:10 -0800] "GET /iishelp/iis/misc/iirturnh.htw HTTP/1.1" 404 235 access_log:202.104.139.222 - - [29/Mar/2000:12:19:10 -0800] "GET /cgi-bin/test-cgi.tcl HTTP/1.1" 403 230 access_log:202.104.139.222 - - [29/Mar/2000:12:19:10 -0800] "GET /cgi-bin/nlog-smb.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:10 -0800] "GET /scripts/cpshost.dll HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:11 -0800] "GET /x.htw HTTP/1.1" 404 211 access_log:202.104.139.222 - - [29/Mar/2000:12:19:11 -0800] "GET /ews/ews/architext_query.pl HTTP/1.1" 404 232 access_log:202.104.139.222 - - [29/Mar/2000:12:19:11 -0800] "GET /cgi-bin/wais.pl HTTP/1.1" 403 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:11 -0800] "GET /cgi-bin/user.log HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:12 -0800] "GET /cfdocs/exampleapp/docs/sourcewindow.cfm HTTP/1.1" 404 245 access_log:202.104.139.222 - - [29/Mar/2000:12:19:12 -0800] "GET /cgi-bin/passwd HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:19:12 -0800] "GET /cgi-bin/LWGate.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:12 -0800] "GET /scripts/issadmin/bdir.htr HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:19:12 -0800] "GET /scripts/samples/details.idc HTTP/1.1" 404 233 access_log:202.104.139.222 - - [29/Mar/2000:12:19:12 -0800] "GET /cgi-bin/webbbs.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:12 -0800] "GET /scripts/tools/getdrvrs.exe HTTP/1.1" 404 232 access_log:202.104.139.222 - - [29/Mar/2000:12:19:12 -0800] "GET /~bin HTTP/1.1" 404 210 access_log:202.104.139.222 - - [29/Mar/2000:12:19:13 -0800] "GET /cgi-bin/php HTTP/1.1" 404 217 access_log:202.104.139.222 - - [29/Mar/2000:12:19:13 -0800] "GET /cgi-bin/www-sql HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:13 -0800] "GET /navigate/ews/ews/architext_query.pl HTTP/1.1" 404 241 access_log:202.104.139.222 - - [29/Mar/2000:12:19:13 -0800] "GET /cgi-bin/info2www HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:13 -0800] "GET /cgi-bin/cgiwrap HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:13 -0800] "GET /_vti_pvt/administrators.pwd HTTP/1.1" 404 233 access_log:202.104.139.222 - - [29/Mar/2000:12:19:13 -0800] "GET /cgi-bin/calendar HTTP/1.1" 403 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:13 -0800] "GET /scripts/fpcount.exe HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:14 -0800] "GET /cgi-bin/whois_raw.cgi?fqdn=%0Acat%20/etc/passwd HTTP/1.1" 404 227 access_log:202.104.139.222 - - [29/Mar/2000:12:19:14 -0800] "GET /cgi-bin/photo_cfg.pl HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:14 -0800] "GET /msadc/Samples/SELECTOR/showcode.asp HTTP/1.1" 404 241 access_log:202.104.139.222 - - [29/Mar/2000:12:19:14 -0800] "GET /iisadmpwd/aexp4b.htr HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:14 -0800] "GET /cfdocs/snippets/evaluate.cfm HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:19:14 -0800] "GET /cgi-bin/passwd.txt HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:14 -0800] "GET /cgi-bin/lwgate HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:19:14 -0800] "GET /cgi-dos/args.cmd HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:15 -0800] "GET /wwwthreads/w3tvars.pm HTTP/1.1" 404 227 access_log:202.104.139.222 - - [29/Mar/2000:12:19:15 -0800] "GET /cgi-bin/sendform.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:15 -0800] "GET /cgi-bin/search.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:15 -0800] "GET /publisher HTTP/1.1" 404 215 access_log:202.104.139.222 - - [29/Mar/2000:12:19:15 -0800] "GET /cgi-bin/handler HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:15 -0800] "GET /cgi-bin/view-source HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:15 -0800] "GET /scripts/convert.bas HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:15 -0800] "GET /cgi-bin/files.pl HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:15 -0800] "GET /scripts/tools/uploadn.asp HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:19:16 -0800] "GET /_vti_pvt/shtml.dll HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:16 -0800] "GET /scripts/script.bat HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:16 -0800] "GET /cfdocs/expelval/openfile.cfm HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:19:16 -0800] "GET /doc HTTP/1.1" 404 209 access_log:202.104.139.222 - - [29/Mar/2000:12:19:16 -0800] "GET /photoads/ads_data.pl HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:16 -0800] "GET /scripts/iisadmin/ism.dll HTTP/1.1" 404 230 access_log:202.104.139.222 - - [29/Mar/2000:12:19:16 -0800] "GET /cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:\\WINNT\\repair\\sam._ HTTP/1.1" 404 233 access_log:202.104.139.222 - - [29/Mar/2000:12:19:16 -0800] "GET /cfdocs/snippets/fileexists.cfm HTTP/1.1" 404 236 access_log:202.104.139.222 - - [29/Mar/2000:12:19:16 -0800] "GET /cgi-bin/password HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:17 -0800] "GET /cgi-bin/flexform HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:17 -0800] "GET /_vti_bin/fpexe HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:19:17 -0800] "GET /~root HTTP/1.1" 403 215 access_log:202.104.139.222 - - [29/Mar/2000:12:19:17 -0800] "GET /cgi-bin/formmail.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:17 -0800] "GET /ows-bin/owa/owa_util%2esignature HTTP/1.1" 404 236 access_log:202.104.139.222 - - [29/Mar/2000:12:19:17 -0800] "GET /cgi-bin/windmial.exe HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:17 -0800] "GET /cgi-bin/webgais HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:17 -0800] "GET /cgi-bin/campas HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:19:18 -0800] "GET /cgi-bin/user.dat HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:18 -0800] "GET /cgi-bin/finger HTTP/1.1" 403 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:18 -0800] "GET /scripts/tools/uploadx.asp HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:19:18 -0800] "GET /_vti_pvt/shtml.exe HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:18 -0800] "GET /cgi-bin/script.bat HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:18 -0800] "GET /cfdocs/expelval/exprcalc.cfm HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:19:18 -0800] "GET /.html/............./config.sys HTTP/1.1" 404 236 access_log:202.104.139.222 - - [29/Mar/2000:12:19:18 -0800] "GET /photoads/cgi-bin/env.cgi HTTP/1.1" 404 230 access_log:202.104.139.222 - - [29/Mar/2000:12:19:19 -0800] "GET /adsamples/config/site.csc HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:19:19 -0800] "GET /cfdocs/expeval/openfile.cfm HTTP/1.1" 404 233 access_log:202.104.139.222 - - [29/Mar/2000:12:19:19 -0800] "GET /cfdocs/snippets/gettempdirectory.cfm HTTP/1.1" 404 242 access_log:202.104.139.222 - - [29/Mar/2000:12:19:19 -0800] "GET /cgi-bin/password.txt HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:19 -0800] "GET /cgi-bin/flexform.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:19 -0800] "GET /cgi-bin/classified.cgi HTTP/1.1" 404 228 access_log:202.104.139.222 - - [29/Mar/2000:12:19:19 -0800] "GET /cgi-bin/upload.pl HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:19:19 -0800] "GET /cgi-bin/wwwadmin.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:20 -0800] "GET /cgi-bin/rwwwshell.pl HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:20 -0800] "GET /cgi-bin/htsearch HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:20 -0800] "GET /cgi-bin/websendmail HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:20 -0800] "GET /cgi-bin/aglimpse HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:20 -0800] "GET /password.log HTTP/1.1" 404 218 access_log:202.104.139.222 - - [29/Mar/2000:12:19:20 -0800] "GET /cgi-bin/bnbform.cgi HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:20 -0800] "GET /cgi-bin/guestbook.cgi HTTP/1.1" 404 227 access_log:202.104.139.222 - - [29/Mar/2000:12:19:20 -0800] "GET /cgi-dos/args.bat HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:21 -0800] "GET /scripts/snorkerz.bat HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:21 -0800] "GET /cfdocs/expelval/displayopenedfile.cfm HTTP/1.1" 404 243 access_log:202.104.139.222 - - [29/Mar/2000:12:19:21 -0800] "GET /....../ HTTP/1.1" 404 213 access_log:202.104.139.222 - - [29/Mar/2000:12:19:21 -0800] "GET /scripts/pfieffer.bat HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:21 -0800] "GET /main.asp%81 HTTP/1.1" 404 215 access_log:202.104.139.222 - - [29/Mar/2000:12:19:21 -0800] "GET /GetFile.cfm?FT=Text&FST=Plain&FilePath=C:\\WINNT\\repair\\sam._ HTTP/1.1" 404 217 access_log:202.104.139.222 - - [29/Mar/2000:12:19:21 -0800] "GET /cgi-bin/day5datanotifier.cgi HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:19:22 -0800] "GET /cfdocs/snippets/viewexample.cfm HTTP/1.1" 404 237 access_log:202.104.139.222 - - [29/Mar/2000:12:19:22 -0800] "GET /cgi-bin/LWGate HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:19:22 -0800] "GET /cgi-bin/dumpenv.pl HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:23 -0800] "GET /cgi-bin/perl HTTP/1.1" 404 218 access_log:202.104.139.222 - - [29/Mar/2000:12:19:23 -0800] "GET /cgi-bin/phf HTTP/1.1" 403 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:23 -0800] "GET /cgi-bin/survey HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:19:23 -0800] "GET /cgi-bin/webdist.cgi HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:23 -0800] "GET /cgi-bin/glimpse HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:24 -0800] "GET /cgi-bin/loadpage.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:24 -0800] "GET /password.dat HTTP/1.1" 404 218 access_log:202.104.139.222 - - [29/Mar/2000:12:19:24 -0800] "GET /cgi-bin/survey.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:24 -0800] "GET /cgi-bin/edit.pl HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:24 -0800] "GET /cgi-win/uploader.exe HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:24 -0800] "GET /cgi-bin/sh HTTP/1.1" 404 216 access_log:202.104.139.222 - - [29/Mar/2000:12:19:24 -0800] "GET /cfdocs/expelval/sendmail.cfm HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:19:24 -0800] "GET /..../ HTTP/1.1" 404 211 access_log:202.104.139.222 - - [29/Mar/2000:12:19:25 -0800] "GET /scripts/pfieffer.cmd HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:25 -0800] "GET /AdvWorks/equipment/catalog_type.asp? HTTP/1.1" 404 241 access_log:202.104.139.222 - - [29/Mar/2000:12:19:25 -0800] "GET /CFIDE/Administrator/startstop.html HTTP/1.1" 404 240 access_log:202.104.139.222 - - [29/Mar/2000:12:19:25 -0800] "GET /cgi-bin/day5datacopier.cgi HTTP/1.1" 404 232 access_log:202.104.139.222 - - [29/Mar/2000:12:19:25 -0800] "GET /cfdocs/cfmlsyntaxcheck.cfm HTTP/1.1" 404 232 access_log:202.104.139.222 - - [29/Mar/2000:12:19:25 -0800] "GET /cgi-bin/MachineInfo HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:25 -0800] "GET /.....*/autoexec.bat HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:25 -0800] "GET /cgi-bin/unlg1.2 HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:27 -0800] "GET /cgi-bin/Count.cgi HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:19:27 -0800] "GET /cgi-bin/AnyForm2 HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:28 -0800] "GET /cgi-bin/faxsurvey HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:19:28 -0800] "GET /cgi-bin/man.sh HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:19:28 -0800] "GET /cgi-bin/infosrch.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:28 -0800] "GET /cgi-bin/password.log HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:28 -0800] "GET /cgi-bin/AnyForm.cgi HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:28 -0800] "GET /cgi-bin/perlshop.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:28 -0800] "GET /cgi-bin/rguest.exe HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:28 -0800] "GET /cgi-bin/csh HTTP/1.1" 404 217 access_log:202.104.139.222 - - [29/Mar/2000:12:19:29 -0800] "GET /iissamples/exair/howitworks/codebrws.asp HTTP/1.1" 404 246 access_log:202.104.139.222 - - [29/Mar/2000:12:19:29 -0800] "GET /..../ HTTP/1.1" 404 211 access_log:202.104.139.222 - - [29/Mar/2000:12:19:29 -0800] "GET /cfappman/index.cfm HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:29 -0800] "GET /../../config.sys HTTP/1.1" 400 284 access_log:202.104.139.222 - - [29/Mar/2000:12:19:29 -0800] "GET /cgi-bin/input.bat?|dir..\\..\\windows HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:19:29 -0800] "GET /iisadmpwd/achg.htr HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:29 -0800] "GET /scripts/visadmin.exe HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:29 -0800] "GET /cgi-bin/ax.cgi HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:19:29 -0800] "GET /scripts/proxy/w3proxy.dll HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:19:30 -0800] "GET /cgi-bin/gh.cgi HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:19:30 -0800] "GET /cgi-bin/test-cgi HTTP/1.1" 200 654 access_log:202.104.139.222 - - [29/Mar/2000:12:19:30 -0800] "GET /cgi-bin/finger.pl HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:19:30 -0800] "GET /cgi-bin/htmlscript HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:30 -0800] "GET /cgi-bin/AT-admin.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:30 -0800] "GET /cgi-bin/php/mlog.phtml HTTP/1.1" 404 228 access_log:202.104.139.222 - - [29/Mar/2000:12:19:30 -0800] "GET /cgi-bin/password.dat HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:31 -0800] "GET /cgi-bin/textcounter.pl HTTP/1.1" 404 228 access_log:202.104.139.222 - - [29/Mar/2000:12:19:31 -0800] "GET /_vti_inf.html HTTP/1.1" 404 219 access_log:202.104.139.222 - - [29/Mar/2000:12:19:31 -0800] "GET /cgi-bin/wguest.exe HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:31 -0800] "GET /cgi-bin/webmap.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:31 -0800] "GET /iissamples/sdk/asp/docs/codebrws.asp HTTP/1.1" 404 242 access_log:202.104.139.222 - - [29/Mar/2000:12:19:31 -0800] "GET /scripts/no-such-file.pl HTTP/1.1" 404 229 access_log:202.104.139.222 - - [29/Mar/2000:12:19:31 -0800] "GET /cfdocs/examples/parks/detail.cfm HTTP/1.1" 404 238 access_log:202.104.139.222 - - [29/Mar/2000:12:19:31 -0800] "GET /domcfg.nsf/ HTTP/1.1" 404 217 access_log:202.104.139.222 - - [29/Mar/2000:12:19:32 -0800] "GET /index.asp::$DATA HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:32 -0800] "GET /iisadmpwd/aexp.htr HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:32 -0800] "GET /scripts/counter.exe HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:32 -0800] "GET /cgi-bin/ax-admin.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:32 -0800] "GET /msadc/msadcs.dll HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:32 -0800] "GET /IISSAMPLES/ExAir/Search/search.asp HTTP/1.1" 404 240 access_log:202.104.139.222 - - [29/Mar/2000:12:19:32 -0800] "GET /cgi-bin/finger.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:32 -0800] "GET /cgi-bin/nph-test-cgi HTTP/1.1" 403 230 access_log:202.104.139.222 - - [29/Mar/2000:12:19:33 -0800] "GET /cgi-bin/pfdispaly.cgi HTTP/1.1" 404 227 access_log:202.104.139.222 - - [29/Mar/2000:12:19:33 -0800] "GET /cgi-bin/filemail.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:33 -0800] "GET /cgi-bin/w3-msql HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:33 -0800] "GET /user.log HTTP/1.1" 404 214 access_log:202.104.139.222 - - [29/Mar/2000:12:19:33 -0800] "GET /cgi-bin/classifieds.cgi HTTP/1.1" 404 229 access_log:202.104.139.222 - - [29/Mar/2000:12:19:33 -0800] "GET /_vti_pvt/service.pwd HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:33 -0800] "GET /scripts/issadmin/bdir.htr HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:19:33 -0800] "GET /cgi-bin/download.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:34 -0800] "GET /msads/Samples/SELECTOR/showcode.asp HTTP/1.1" 404 241 access_log:202.104.139.222 - - [29/Mar/2000:12:19:34 -0800] "GET /tools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=goatfart+samples+from+microsoft&dbq=..%2F..%2Fwwwroot%2goatfart.html&newdb=CREATE_DB&attr= HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:34 -0800] "GET /cfdocs/examples/cvbeans/beaninfo.cfm HTTP/1.1" 404 242 access_log:202.104.139.222 - - [29/Mar/2000:12:19:34 -0800] "GET /scripts/repost.asp HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:34 -0800] "GET /cgi-bin/visadmin.exe?user=guest HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:34 -0800] "GET /iisadmpwd/aexp2.htr HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:34 -0800] "GET /scripts/ppdscgi.exe HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:34 -0800] "GET /session/adminlogin HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:35 -0800] "GET /scripts/samples/ctguestb.idc HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:19:35 -0800] "GET /IISSAMPLES/ExAir/Search/advsearch.asp HTTP/1.1" 404 243 access_log:202.104.139.222 - - [29/Mar/2000:12:19:35 -0800] "GET /cgi-bin/bnbform HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:35 -0800] "GET /cgi-bin/nph-publish HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:35 -0800] "GET /cgi-bin/perl.exe HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:35 -0800] "GET /cgi-bin/maillist.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:35 -0800] "GET /user.dat HTTP/1.1" 404 214 access_log:202.104.139.222 - - [29/Mar/2000:12:19:35 -0800] "GET /cgi-bin/environ.cgi HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:36 -0800] "GET /scripts/CGImail.exe HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:36 -0800] "GET /cgi-bin/whois.cgi HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:19:36 -0800] "GET /search97.vts HTTP/1.1" 404 218 access_log:202.104.139.222 - - [29/Mar/2000:12:19:36 -0800] "GET /_vti_pvt/users.pwd HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:36 -0800] "GET /_vti_bin/shtml.dll HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:36 -0800] "GET /cfdocs/examples/httpclient/mainframeset.cfm HTTP/1.1" 404 249 access_log:202.104.139.222 - - [29/Mar/2000:12:19:37 -0800] "GET /conn.inc HTTP/1.1" 404 214 access_log:202.104.139.222 - - [29/Mar/2000:12:19:37 -0800] "GET /cgi-bin/visadmin.exe HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:37 -0800] "GET /iisadmpwd/aexp3.htr HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:37 -0800] "GET /scripts/wguest.exe HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:37 -0800] "GET /ss.cfg HTTP/1.1" 404 212 access_log:202.104.139.222 - - [29/Mar/2000:12:19:37 -0800] "GET /cgi-bin/get32.exe HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:19:37 -0800] "GET /IISSAMPLES/ISSAMPLES/QUERY.ASP HTTP/1.1" 404 236 access_log:202.104.139.222 - - [29/Mar/2000:12:19:37 -0800] "GET /cgi-bin/AnyBoard.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:38 -0800] "GET /cgi-bin/php.cgi HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:38 -0800] "GET /cgi-bin/wwwboard.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:19:38 -0800] "GET /cgi-bin/jj HTTP/1.1" 403 220 access_log:202.104.139.222 - - [29/Mar/2000:12:19:38 -0800] "GET /cgi-bin/tst.bat HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:19:38 -0800] "GET /cgi-bin/wrap HTTP/1.1" 404 218 access_log:202.104.139.222 - - [29/Mar/2000:12:19:38 -0800] "GET /scripts/tools/newdsn.exe HTTP/1.1" 404 230 access_log:202.104.139.222 - - [29/Mar/2000:12:19:38 -0800] "GET /carbo.dll HTTP/1.1" 404 215 access_log:202.104.139.222 - - [29/Mar/2000:12:19:38 -0800] "GET /_vti_pvt/authors.pwd HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:19:39 -0800] "GET /_vti_inf.html HTTP/1.1" 404 219 access_log:202.104.139.222 - - [29/Mar/2000:12:19:39 -0800] "GET /msadc/readme.txt HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:19:39 -0800] "GET /scripts/lsass.exe HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:19:39 -0800] "GET /cgi-bin/webwho.pl HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:19:39 -0800] "GET /cgi-bin/alibaba.pl HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:19:39 -0800] "GET /iissamples/exair/howitworks/code.asp HTTP/1.1" 404 242 access_log:202.104.139.222 - - [29/Mar/2000:12:19:39 -0800] "GET / HTTP/1.1" 200 3459 access_log:202.104.139.222 - - [29/Mar/2000:12:19:40 -0800] "GET /?PageServices HTTP/1.1" 200 3459 access_log:202.104.139.222 - - [29/Mar/2000:12:19:40 -0800] "GET / HTTP/1.1" 200 3459 access_log:202.104.139.222 - - [29/Mar/2000:12:19:41 -0800] "GET /?wp-cs-dump HTTP/1.1" 200 3459 access_log:202.104.139.222 - - [29/Mar/2000:12:19:41 -0800] "GET /default.asp HTTP/1.1" 404 217 access_log:202.104.139.222 - - [29/Mar/2000:12:19:41 -0800] "HEAD / HTTP/1.1" 200 0 access_log:202.104.139.222 - - [29/Mar/2000:12:20:06 -0800] "GET /global.asa HTTP/1.1" 404 216 access_log:202.104.139.222 - - [29/Mar/2000:12:20:07 -0800] "GET /Home.asp HTTP/1.1" 404 214 access_log:202.104.139.222 - - [29/Mar/2000:12:20:07 -0800] "GET /1.idc HTTP/1.1" 404 211 access_log:202.104.139.222 - - [29/Mar/2000:12:20:07 -0800] "GET /1.idq HTTP/1.1" 404 211 access_log:202.104.139.222 - - [29/Mar/2000:12:20:09 -0800] "GET /index1.asp HTTP/1.1" 404 216 access_log:202.104.139.222 - - [29/Mar/2000:12:20:10 -0800] "GET /index.asp HTTP/1.1" 404 215 access_log:202.104.139.222 - - [29/Mar/2000:12:20:10 -0800] "GET /main.asp HTTP/1.1" 404 214 Note 1 min 17 second gap access_log:202.104.139.222 - - [29/Mar/2000:12:21:27 -0800] "GET / HTTP/1.0" 200 3447 1 min 59 second gap, then another automated sweep of the site access_log:202.104.139.222 - - [29/Mar/2000:12:23:26 -0800] "GET / HTTP/1.1" 200 3459 access_log:202.104.139.222 - - [29/Mar/2000:12:23:27 -0800] "GET /songbird/index.html HTTP/1.1" 200 2379 access_log:202.104.139.222 - - [29/Mar/2000:12:23:27 -0800] "GET /songbird/rates.html HTTP/1.1" 200 3139 access_log:202.104.139.222 - - [29/Mar/2000:12:23:29 -0800] "GET /policy.html HTTP/1.1" 200 3154 access_log:202.104.139.222 - - [29/Mar/2000:12:23:30 -0800] "GET /spam.html HTTP/1.1" 200 1925 access_log:202.104.139.222 - - [29/Mar/2000:12:23:30 -0800] "GET /disclaimer.html HTTP/1.1" 200 937 access_log:202.104.139.222 - - [29/Mar/2000:12:23:30 -0800] "GET /iissamples/exair/search/qfullhit.htw HTTP/1.1" 404 242 access_log:202.104.139.222 - - [29/Mar/2000:12:23:30 -0800] "GET /iishelp/iis/misc/iirturnh.htw HTTP/1.1" 404 235 access_log:202.104.139.222 - - [29/Mar/2000:12:23:31 -0800] "GET /cgi-bin/nlog-smb.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:31 -0800] "GET /cgi-bin/test-cgi.tcl HTTP/1.1" 403 230 access_log:202.104.139.222 - - [29/Mar/2000:12:23:31 -0800] "GET /scripts/cpshost.dll HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:31 -0800] "GET /x.htw HTTP/1.1" 404 211 access_log:202.104.139.222 - - [29/Mar/2000:12:23:31 -0800] "GET /cgi-bin/passwd HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:23:31 -0800] "GET /ews/ews/architext_query.pl HTTP/1.1" 404 232 access_log:202.104.139.222 - - [29/Mar/2000:12:23:31 -0800] "GET /cgi-bin/user.log HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:31 -0800] "GET /cgi-bin/LWGate.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:32 -0800] "GET /cgi-bin/wais.pl HTTP/1.1" 403 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:32 -0800] "GET /cfdocs/exampleapp/docs/sourcewindow.cfm HTTP/1.1" 404 245 access_log:202.104.139.222 - - [29/Mar/2000:12:23:32 -0800] "GET /scripts/issadmin/bdir.htr HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:23:32 -0800] "GET /scripts/samples/details.idc HTTP/1.1" 404 233 access_log:202.104.139.222 - - [29/Mar/2000:12:23:32 -0800] "GET /cgi-bin/webbbs.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:32 -0800] "GET /~bin HTTP/1.1" 404 210 access_log:202.104.139.222 - - [29/Mar/2000:12:23:32 -0800] "GET /scripts/tools/getdrvrs.exe HTTP/1.1" 404 232 access_log:202.104.139.222 - - [29/Mar/2000:12:23:33 -0800] "GET /cgi-bin/passwd.txt HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:33 -0800] "GET /navigate/ews/ews/architext_query.pl HTTP/1.1" 404 241 access_log:202.104.139.222 - - [29/Mar/2000:12:23:33 -0800] "GET /cgi-bin/www-sql HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:33 -0800] "GET /cgi-bin/info2www HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:34 -0800] "GET /cgi-bin/photo_cfg.pl HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:34 -0800] "GET /cgi-bin/php HTTP/1.1" 404 217 access_log:202.104.139.222 - - [29/Mar/2000:12:23:34 -0800] "GET /cgi-bin/lwgate HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:23:34 -0800] "GET /cgi-bin/cgiwrap HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:34 -0800] "GET /_vti_pvt/administrators.pwd HTTP/1.1" 404 233 access_log:202.104.139.222 - - [29/Mar/2000:12:23:35 -0800] "GET /scripts/fpcount.exe HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:35 -0800] "GET /cfdocs/snippets/evaluate.cfm HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:23:35 -0800] "GET /cgi-bin/calendar HTTP/1.1" 403 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:35 -0800] "GET /msadc/Samples/SELECTOR/showcode.asp HTTP/1.1" 404 241 access_log:202.104.139.222 - - [29/Mar/2000:12:23:36 -0800] "GET /cgi-bin/whois_raw.cgi?fqdn=%0Acat%20/etc/passwd HTTP/1.1" 404 227 access_log:202.104.139.222 - - [29/Mar/2000:12:23:36 -0800] "GET /wwwthreads/w3tvars.pm HTTP/1.1" 404 227 access_log:202.104.139.222 - - [29/Mar/2000:12:23:36 -0800] "GET /iisadmpwd/aexp4b.htr HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:36 -0800] "GET /cgi-bin/sendform.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:37 -0800] "GET /cgi-dos/args.cmd HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:37 -0800] "GET /publisher HTTP/1.1" 404 215 access_log:202.104.139.222 - - [29/Mar/2000:12:23:37 -0800] "GET /cgi-bin/search.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:37 -0800] "GET /cgi-bin/password HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:37 -0800] "GET /scripts/convert.bas HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:37 -0800] "GET /cgi-bin/view-source HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:37 -0800] "GET /cgi-bin/files.pl HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:38 -0800] "GET /cgi-bin/handler HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:38 -0800] "GET /photoads/ads_data.pl HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:38 -0800] "GET /cgi-bin/flexform HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:38 -0800] "GET /scripts/tools/uploadn.asp HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:23:38 -0800] "GET /_vti_pvt/shtml.dll HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:38 -0800] "GET /cfdocs/expelval/openfile.cfm HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:23:38 -0800] "GET /cfdocs/snippets/fileexists.cfm HTTP/1.1" 404 236 access_log:202.104.139.222 - - [29/Mar/2000:12:23:39 -0800] "GET /scripts/script.bat HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:39 -0800] "GET /scripts/iisadmin/ism.dll HTTP/1.1" 404 230 access_log:202.104.139.222 - - [29/Mar/2000:12:23:39 -0800] "GET /doc HTTP/1.1" 404 209 access_log:202.104.139.222 - - [29/Mar/2000:12:23:39 -0800] "GET /~root HTTP/1.1" 403 215 access_log:202.104.139.222 - - [29/Mar/2000:12:23:39 -0800] "GET /cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:\\WINNT\\repair\\sam._ HTTP/1.1" 404 233 access_log:202.104.139.222 - - [29/Mar/2000:12:23:39 -0800] "GET /_vti_bin/fpexe HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:23:40 -0800] "GET /cgi-bin/windmial.exe HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:40 -0800] "GET /cgi-bin/formmail.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:40 -0800] "GET /ows-bin/owa/owa_util%2esignature HTTP/1.1" 404 236 access_log:202.104.139.222 - - [29/Mar/2000:12:23:40 -0800] "GET /cgi-bin/password.txt HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:40 -0800] "GET /cgi-bin/user.dat HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:40 -0800] "GET /cgi-bin/campas HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:23:40 -0800] "GET /cgi-bin/finger HTTP/1.1" 403 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:40 -0800] "GET /cgi-bin/webgais HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:41 -0800] "GET /photoads/cgi-bin/env.cgi HTTP/1.1" 404 230 access_log:202.104.139.222 - - [29/Mar/2000:12:23:41 -0800] "GET /cgi-bin/flexform.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:41 -0800] "GET /scripts/tools/uploadx.asp HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:23:41 -0800] "GET /_vti_pvt/shtml.exe HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:41 -0800] "GET /cfdocs/expelval/exprcalc.cfm HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:23:41 -0800] "GET /cfdocs/snippets/gettempdirectory.cfm HTTP/1.1" 404 242 access_log:202.104.139.222 - - [29/Mar/2000:12:23:41 -0800] "GET /cgi-bin/script.bat HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:41 -0800] "GET /adsamples/config/site.csc HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:23:41 -0800] "GET /.html/............./config.sys HTTP/1.1" 404 236 access_log:202.104.139.222 - - [29/Mar/2000:12:23:42 -0800] "GET /cfdocs/expeval/openfile.cfm HTTP/1.1" 404 233 access_log:202.104.139.222 - - [29/Mar/2000:12:23:42 -0800] "GET /cgi-bin/classified.cgi HTTP/1.1" 404 228 access_log:202.104.139.222 - - [29/Mar/2000:12:23:42 -0800] "GET /cgi-bin/upload.pl HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:23:42 -0800] "GET /cgi-bin/htsearch HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:42 -0800] "GET /cgi-bin/wwwadmin.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:42 -0800] "GET /cgi-bin/rwwwshell.pl HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:43 -0800] "GET /cgi-bin/day5datanotifier.cgi HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:23:43 -0800] "GET /password.log HTTP/1.1" 404 218 access_log:202.104.139.222 - - [29/Mar/2000:12:23:43 -0800] "GET /cgi-bin/bnbform.cgi HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:43 -0800] "GET /cgi-bin/websendmail HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:43 -0800] "GET /scripts/pfieffer.bat HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:43 -0800] "GET /cgi-bin/aglimpse HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:44 -0800] "GET /cgi-bin/LWGate HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:23:44 -0800] "GET /cgi-bin/guestbook.cgi HTTP/1.1" 404 227 access_log:202.104.139.222 - - [29/Mar/2000:12:23:44 -0800] "GET /cgi-dos/args.bat HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:44 -0800] "GET /cfdocs/expelval/displayopenedfile.cfm HTTP/1.1" 404 243 access_log:202.104.139.222 - - [29/Mar/2000:12:23:44 -0800] "GET /cfdocs/snippets/viewexample.cfm HTTP/1.1" 404 237 access_log:202.104.139.222 - - [29/Mar/2000:12:23:44 -0800] "GET /scripts/snorkerz.bat HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:44 -0800] "GET /main.asp%81 HTTP/1.1" 404 215 access_log:202.104.139.222 - - [29/Mar/2000:12:23:44 -0800] "GET /....../ HTTP/1.1" 404 213 access_log:202.104.139.222 - - [29/Mar/2000:12:23:45 -0800] "GET /GetFile.cfm?FT=Text&FST=Plain&FilePath=C:\\WINNT\\repair\\sam._ HTTP/1.1" 404 217 access_log:202.104.139.222 - - [29/Mar/2000:12:23:45 -0800] "GET /cgi-bin/survey HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:23:45 -0800] "GET /cgi-bin/dumpenv.pl HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:45 -0800] "GET /cgi-bin/loadpage.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:45 -0800] "GET /cgi-bin/perl HTTP/1.1" 404 218 access_log:202.104.139.222 - - [29/Mar/2000:12:23:45 -0800] "GET /cgi-bin/phf HTTP/1.1" 403 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:45 -0800] "GET /cgi-bin/day5datacopier.cgi HTTP/1.1" 404 232 access_log:202.104.139.222 - - [29/Mar/2000:12:23:45 -0800] "GET /password.dat HTTP/1.1" 404 218 access_log:202.104.139.222 - - [29/Mar/2000:12:23:46 -0800] "GET /cgi-bin/survey.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:46 -0800] "GET /cgi-bin/webdist.cgi HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:46 -0800] "GET /cgi-bin/glimpse HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:46 -0800] "GET /cgi-bin/MachineInfo HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:46 -0800] "GET /cgi-bin/edit.pl HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:47 -0800] "GET /scripts/pfieffer.cmd HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:47 -0800] "GET /cgi-win/uploader.exe HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:47 -0800] "GET /cfdocs/expelval/sendmail.cfm HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:23:47 -0800] "GET /cfdocs/cfmlsyntaxcheck.cfm HTTP/1.1" 404 232 access_log:202.104.139.222 - - [29/Mar/2000:12:23:47 -0800] "GET /cgi-bin/sh HTTP/1.1" 404 216 access_log:202.104.139.222 - - [29/Mar/2000:12:23:47 -0800] "GET /..../ HTTP/1.1" 404 211 access_log:202.104.139.222 - - [29/Mar/2000:12:23:48 -0800] "GET /CFIDE/Administrator/startstop.html HTTP/1.1" 404 240 access_log:202.104.139.222 - - [29/Mar/2000:12:23:48 -0800] "GET /AdvWorks/equipment/catalog_type.asp? HTTP/1.1" 404 241 access_log:202.104.139.222 - - [29/Mar/2000:12:23:48 -0800] "GET /cgi-bin/AnyForm2 HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:48 -0800] "GET /.....*/autoexec.bat HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:48 -0800] "GET /cgi-bin/infosrch.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:48 -0800] "GET /cgi-bin/unlg1.2 HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:48 -0800] "GET /cgi-bin/Count.cgi HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:23:48 -0800] "GET /domcfg.nsf/ HTTP/1.1" 404 217 access_log:202.104.139.222 - - [29/Mar/2000:12:23:48 -0800] "GET /cgi-bin/password.log HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:49 -0800] "GET /cgi-bin/faxsurvey HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:23:49 -0800] "GET /cgi-bin/man.sh HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:23:49 -0800] "GET /cgi-bin/AnyForm.cgi HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:49 -0800] "GET /scripts/proxy/w3proxy.dll HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:23:49 -0800] "GET /cgi-bin/perlshop.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:49 -0800] "GET /cfappman/index.cfm HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:50 -0800] "GET /cgi-bin/rguest.exe HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:50 -0800] "GET /iissamples/exair/howitworks/codebrws.asp HTTP/1.1" 404 246 access_log:202.104.139.222 - - [29/Mar/2000:12:23:50 -0800] "GET /scripts/visadmin.exe HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:50 -0800] "GET /cgi-bin/csh HTTP/1.1" 404 217 access_log:202.104.139.222 - - [29/Mar/2000:12:23:50 -0800] "GET /..../ HTTP/1.1" 404 211 access_log:202.104.139.222 - - [29/Mar/2000:12:23:50 -0800] "GET /cgi-bin/input.bat?|dir..\\..\\windows HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:23:50 -0800] "GET /cgi-bin/finger.pl HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:23:51 -0800] "GET /cgi-bin/ax.cgi HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:23:51 -0800] "GET /cgi-bin/php/mlog.phtml HTTP/1.1" 404 228 access_log:202.104.139.222 - - [29/Mar/2000:12:23:51 -0800] "GET /../../config.sys HTTP/1.1" 400 284 access_log:202.104.139.222 - - [29/Mar/2000:12:23:51 -0800] "GET /cgi-bin/gh.cgi HTTP/1.1" 404 220 access_log:202.104.139.222 - - [29/Mar/2000:12:23:51 -0800] "GET /scripts/repost.asp HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:51 -0800] "GET /iisadmpwd/achg.htr HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:52 -0800] "GET /cgi-bin/password.dat HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:52 -0800] "GET /cgi-bin/htmlscript HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:52 -0800] "GET /cgi-bin/AT-admin.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:52 -0800] "GET /cgi-bin/textcounter.pl HTTP/1.1" 404 228 access_log:202.104.139.222 - - [29/Mar/2000:12:23:52 -0800] "GET /msadc/msadcs.dll HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:52 -0800] "GET /_vti_inf.html HTTP/1.1" 404 219 access_log:202.104.139.222 - - [29/Mar/2000:12:23:52 -0800] "GET /cfdocs/examples/parks/detail.cfm HTTP/1.1" 404 238 access_log:202.104.139.222 - - [29/Mar/2000:12:23:52 -0800] "GET /cgi-bin/wguest.exe HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:53 -0800] "GET /iissamples/sdk/asp/docs/codebrws.asp HTTP/1.1" 404 242 access_log:202.104.139.222 - - [29/Mar/2000:12:23:53 -0800] "GET /scripts/counter.exe HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:53 -0800] "GET /cgi-bin/webmap.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:53 -0800] "GET /scripts/no-such-file.pl HTTP/1.1" 404 229 access_log:202.104.139.222 - - [29/Mar/2000:12:23:53 -0800] "GET /index.asp::$DATA HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:53 -0800] "GET /cgi-bin/finger.cgi HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:53 -0800] "GET /cgi-bin/ax-admin.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:53 -0800] "GET /cgi-bin/w3-msql HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:54 -0800] "GET /cgi-bin/test-cgi HTTP/1.1" 200 654 access_log:202.104.139.222 - - [29/Mar/2000:12:23:54 -0800] "GET /IISSAMPLES/ExAir/Search/search.asp HTTP/1.1" 404 240 access_log:202.104.139.222 - - [29/Mar/2000:12:23:54 -0800] "GET /conn.inc HTTP/1.1" 404 214 access_log:202.104.139.222 - - [29/Mar/2000:12:23:54 -0800] "-" 408 - access_log:202.104.139.222 - - [29/Mar/2000:12:23:54 -0800] "GET /iisadmpwd/aexp.htr HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:54 -0800] "GET /user.log HTTP/1.1" 404 214 access_log:202.104.139.222 - - [29/Mar/2000:12:23:54 -0800] "GET /cgi-bin/pfdispaly.cgi HTTP/1.1" 404 227 access_log:202.104.139.222 - - [29/Mar/2000:12:23:54 -0800] "GET /cgi-bin/filemail.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:55 -0800] "GET /cgi-bin/classifieds.cgi HTTP/1.1" 404 229 access_log:202.104.139.222 - - [29/Mar/2000:12:23:55 -0800] "GET /scripts/samples/ctguestb.idc HTTP/1.1" 404 234 access_log:202.104.139.222 - - [29/Mar/2000:12:23:55 -0800] "GET /_vti_pvt/service.pwd HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:55 -0800] "GET /cfdocs/examples/cvbeans/beaninfo.cfm HTTP/1.1" 404 242 access_log:202.104.139.222 - - [29/Mar/2000:12:23:55 -0800] "GET /scripts/issadmin/bdir.htr HTTP/1.1" 404 231 access_log:202.104.139.222 - - [29/Mar/2000:12:23:55 -0800] "GET /msads/Samples/SELECTOR/showcode.asp HTTP/1.1" 404 241 access_log:202.104.139.222 - - [29/Mar/2000:12:23:55 -0800] "GET /scripts/ppdscgi.exe HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:55 -0800] "GET /cgi-bin/download.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:56 -0800] "GET /cgi-bin/visadmin.exe?user=guest HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:56 -0800] "GET /scripts/wguest.exe HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:56 -0800] "GET /cgi-bin/bnbform HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:56 -0800] "GET /session/adminlogin HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:56 -0800] "GET /IISSAMPLES/ExAir/Search/advsearch.asp HTTP/1.1" 404 243 access_log:202.104.139.222 - - [29/Mar/2000:12:23:56 -0800] "GET /cgi-bin/nph-test-cgi HTTP/1.1" 403 230 access_log:202.104.139.222 - - [29/Mar/2000:12:23:56 -0800] "GET /scripts/lsass.exe HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:23:57 -0800] "GET /iisadmpwd/aexp2.htr HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:57 -0800] "GET /user.dat HTTP/1.1" 404 214 access_log:202.104.139.222 - - [29/Mar/2000:12:23:57 -0800] "GET /cgi-bin/perl.exe HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:57 -0800] "GET /cgi-bin/maillist.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:57 -0800] "GET /cgi-bin/environ.cgi HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:57 -0800] "GET /ss.cfg HTTP/1.1" 404 212 access_log:202.104.139.222 - - [29/Mar/2000:12:23:57 -0800] "GET /_vti_pvt/users.pwd HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:57 -0800] "GET /cfdocs/examples/httpclient/mainframeset.cfm HTTP/1.1" 404 249 access_log:202.104.139.222 - - [29/Mar/2000:12:23:58 -0800] "GET /scripts/CGImail.exe HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:58 -0800] "GET /search97.vts HTTP/1.1" 404 218 access_log:202.104.139.222 - - [29/Mar/2000:12:23:58 -0800] "GET /tools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=goatfart+samples+from+microsoft&dbq=..%2F..%2Fwwwroot%2goatfart.html&newdb=CREATE_DB&attr= HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:23:58 -0800] "GET /cgi-bin/visadmin.exe HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:58 -0800] "GET /cgi-bin/whois.cgi HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:23:58 -0800] "GET /iissamples/exair/howitworks/code.asp HTTP/1.1" 404 242 access_log:202.104.139.222 - - [29/Mar/2000:12:23:58 -0800] "GET /cgi-bin/AnyBoard.cgi HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:23:58 -0800] "GET /cgi-bin/get32.exe HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:23:59 -0800] "GET /IISSAMPLES/ISSAMPLES/QUERY.ASP HTTP/1.1" 404 236 access_log:202.104.139.222 - - [29/Mar/2000:12:23:59 -0800] "GET /cgi-bin/nph-publish HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:59 -0800] "GET /cgi-bin/alibaba.pl HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:23:59 -0800] "GET /iisadmpwd/aexp3.htr HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:59 -0800] "GET /cgi-bin/tst.bat HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:23:59 -0800] "GET /cgi-bin/wwwboard.pl HTTP/1.1" 404 225 access_log:202.104.139.222 - - [29/Mar/2000:12:23:59 -0800] "GET /cgi-bin/jj HTTP/1.1" 403 220 access_log:202.104.139.222 - - [29/Mar/2000:12:23:59 -0800] "GET /cgi-bin/wrap HTTP/1.1" 404 218 access_log:202.104.139.222 - - [29/Mar/2000:12:24:00 -0800] "GET /_vti_pvt/authors.pwd HTTP/1.1" 404 226 access_log:202.104.139.222 - - [29/Mar/2000:12:24:00 -0800] "GET /msadc/readme.txt HTTP/1.1" 404 222 access_log:202.104.139.222 - - [29/Mar/2000:12:24:00 -0800] "GET /scripts/tools/newdsn.exe HTTP/1.1" 404 230 access_log:202.104.139.222 - - [29/Mar/2000:12:24:00 -0800] "GET /carbo.dll HTTP/1.1" 404 215 access_log:202.104.139.222 - - [29/Mar/2000:12:24:00 -0800] "GET /_vti_bin/shtml.dll HTTP/1.1" 404 224 access_log:202.104.139.222 - - [29/Mar/2000:12:24:00 -0800] "GET /cgi-bin/webwho.pl HTTP/1.1" 404 223 access_log:202.104.139.222 - - [29/Mar/2000:12:24:00 -0800] "GET /_vti_inf.html HTTP/1.1" 404 219 access_log:202.104.139.222 - - [29/Mar/2000:12:24:00 -0800] "GET /cgi-bin/php.cgi HTTP/1.1" 404 221 access_log:202.104.139.222 - - [29/Mar/2000:12:24:01 -0800] "GET / HTTP/1.1" 200 3459 access_log:202.104.139.222 - - [29/Mar/2000:12:24:01 -0800] "GET /?PageServices HTTP/1.1" 200 3459 access_log:202.104.139.222 - - [29/Mar/2000:12:24:01 -0800] "GET / HTTP/1.1" 200 3459 access_log:202.104.139.222 - - [29/Mar/2000:12:24:01 -0800] "GET /?wp-cs-dump HTTP/1.1" 200 3459 access_log:202.104.139.222 - - [29/Mar/2000:12:24:02 -0800] "GET /default.asp HTTP/1.1" 404 217 access_log:202.104.139.222 - - [29/Mar/2000:12:24:02 -0800] "HEAD / HTTP/1.1" 200 0 access_log:202.104.139.222 - - [29/Mar/2000:12:24:14 -0800] "GET /global.asa HTTP/1.1" 404 216 access_log:202.104.139.222 - - [29/Mar/2000:12:24:15 -0800] "GET /Home.asp HTTP/1.1" 404 214 access_log:202.104.139.222 - - [29/Mar/2000:12:24:15 -0800] "GET /1.idc HTTP/1.1" 404 211 access_log:202.104.139.222 - - [29/Mar/2000:12:24:15 -0800] "GET /1.idq HTTP/1.1" 404 211 access_log:202.104.139.222 - - [29/Mar/2000:12:24:16 -0800] "GET /index1.asp HTTP/1.1" 404 216 access_log:202.104.139.222 - - [29/Mar/2000:12:24:16 -0800] "GET /index.asp HTTP/1.1" 404 215 access_log:202.104.139.222 - - [29/Mar/2000:12:24:16 -0800] "GET /main.asp HTTP/1.1" 404 214 1 minute 18 second pause... access_log:202.104.139.222 - - [29/Mar/2000:12:25:34 -0800] "GET / HTTP/1.0" 200 3447 That's the end.