[Dshield] OK, who's the wise guy? (odd stuff in DShield server log....)

Valdis.Kletnieks@vt.edu Valdis.Kletnieks at vt.edu
Fri Mar 3 22:19:04 GMT 2006


Seen in the apache access.log:

65.110.2.136 - - [31/Jan/2006:13:01:47 -0500] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 309 "-" "-"
221.132.66.5 - - [20/Feb/2006:02:47:43 -0500] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 309 "-" "-"
81.208.36.100 - - [27/Feb/2006:13:37:07 -0500] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 309 "-" "-"
221.139.49.91 - - [28/Feb/2006:22:15:11 -0500] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 309 "-" "-"
81.169.176.15 - - [02/Mar/2006:04:19:56 -0500] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 309 "-" "-"

>From 5 different places, scattered over a month...

And in the error.log (only showing one, all 5 got same error msg):

[Thu Mar 02 04:19:56 2006] [error] [client 81.169.176.15] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)






-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
Url : http://www.dshield.org/pipermail/list/attachments/20060303/82d17d1a/attachment.bin


More information about the list mailing list