Softpanorama

May the source be with you, but remember the KISS principle ;-)
Contents Bulletin Scripting in shell and Perl Network troubleshooting History Humor

Requests for non-existing web pages

News Perl HTTP Logs Processing Scripts .htaccess file  AWStats Apache Webserver  HTTP Return Codes  mod rewrite
Requests for non-existing web pages Referrer Spam PHP probes Requests for crossdomain.xml and other XML files Mystery GET requests with URI scheme encoded PNG image in them Lower case requests Trailing junk in requests
Bangers Bots that cause consistent 500 errors Broken or undebugged robots Requests for crossdomain.xml and other XML files Frivolous POSTs Non-PHP Web probes  
Probes from bc.googleusercontent.com Fighting rogue robots Bots that couse consistent 500 errors Large Sample of "Composition URL" fake hits      
HTTP Protocol Apache authentication and authorization using LDAP Cheap Web hosting with SSH access Web site monitoring Sysadmin Horror Stories Web Humor Etc

Introduction

Requests for pages that never existed pollute 404 statistics to the extent that it became completely useless for detecting bad links from your web site. Popular sites attract undebugged robots like honey and such requests can constitute considerable  percentage of the total number of requests. My estimate is that it can vary from 10% to almost 50% of robot traffic. Now a lot of those requests are coming from bc.googleusercontent.com, much less from Amazon cloud.

There are two common cases that cases such behaviour: 

What complicates the picture is that hits belonging to those two categories often come from "respectable" bots too.  So you can't blindly block all IP addresses from which such hits are coming. Where Google and Bing pickup those bogus links and why they are so persistent in checking them again and again (for years, sometimes decades,  to come) is a mystery to me. 

Excessive zeal in trying to block those jerks and restore sanity of your web logs does no good. You need to assume that poisoning of 403 stats in your Web log analysis program in permanent. The real fight is to cut pollution to acceptable level with minimal efforts. So here like in other cases, the concept of "dirty dozen" -- top IPs that demonstrate particular behavior might be useful.

Please understand that excessive zeal in trying to eliminate those pests is actually a trap that can hurt you. Despite your sincere indignation of such activities, please resists overreaction !  The first and foremost rule is such cases is "Not too much zeal."

Please understand that excessive zeal in trying to eliminate those pests is actually a trap that can hurt you. Despite your sincere indignation of such activities, please resists overreaction !  The first and foremost rule is such cases is "Not too much zeal."

As I already mentioned respectable bots such as Google or Bing are also contributors to hits in this category of useless requests ;-). Often multiple times as if they are storing those non-existent URL for a long time and periodically check, if the page re-appeared or not.  So much about talented programmers working in Google. Judging from the behaviors of Google bot on my site, the level of talent of architects of this software leave much to be desired. It's a brute force approach. 

Truth be told for Google, the following of "poisoned" links is difficult to avoid as the key idea of Google is to rely in ranking of the page on "popularity" of particular page on the web -- the number of references to the page in other sites. Here when abusers gat Google as to distinguish "honest" reference and "dishonest" reference is very difficult and that means that "URL mills" will always be danger for Google as distinguishing such references is a very difficult task as forms in which "URL mills" exists can mutate.  Rank of the site itself can help, but even here possibilities of abuse are tremendous as owner can "rent" certain pages for "URL mill".  See The Ultimate Google Algorithm Cheat Sheet for more information.

But it is unclear to me why they need to bump their head again and again at the fake URL day after day and why one access in, say, 3-5 days after first failure is not enough. And that's just one simple question to designers of those bots. I have many more. Google bot also has way too long memory and can access the link that disappeared in 1996 in 2014 (which is another Google bot feature -- inability to forget anything) ...

Other then those observations,  very little known about avalanche of bogus request for Web pages that are hitting sites like this one. This page is just a very modest attempt to understand the phenomenon. 

Composition URLs

One interesting class of request to non-existent pages are so called "composition URLs

183.60.213.109 - - [30/Apr/2014:12:03:06 +0000] "GET /Net/Internet_layer/Subnetting/Bulletin/Humor/Archive/humor092.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)"
183.60.213.109 - - [30/Apr/2014:12:04:21 +0000] "GET /Commercial_unixes/AIX/Startup_and_shutdown/Bulletin/Humor/best_russian_programmer_humor.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)"
183.60.215.54 - - [30/Apr/2014:12:04:28 +0000] "GET /Unixification/Reskit/People/Torvalds/index.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)"
183.60.213.109 - - [30/Apr/2014:12:05:04 +0000] "GET /Commercial_unixes/HPUX/OSS/Skeptics/Financial_skeptic/Casino_capitalism/Twelve_apostles_of_deregulation/Greenspan/greenspan_humor.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)"
183.60.213.109 - - [30/Apr/2014:12:05:04 +0000] "GET /Access_control/SOX/Skeptics/Financial_skeptic/Casino_capitalism/Twelve_apostles_of_deregulation/Greenspan/greenspan_humor.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)"
183.60.214.23 - - [30/Apr/2014:12:05:27 +0000] "GET /Hardware/Dell/C610/Solaris/humor.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)"
183.60.213.109 - - [30/Apr/2014:12:05:33 +0000] "GET /Admin/Tivoli/TEC/Adapters/Skeptics/Political_skeptic/humor.shtml HTTP/1.1" 404 31385 "-" "Mozilla/5.0 (compatible; EasouSpider; +http://www.easou.com/search/spider.html)"

In most cases "composition URLs are result of two factors

While in most case such composition URL consist of concatenation of two legitimate paths, there can be more complex cases due to "long memory" of most bots. For example let's analyze attempt the following GET request:

66.249.66.13 - - [07/Jan/2014:22:10:10 +0000] "GET /Malware/Spyware/Antivirus_system_pro/Copyright/index.shtml HTTP/1.1" 404 29600 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 (compatible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)"

Which is essentially an attempt to access the page

/Malware/Spyware/Antivirus_system_pro/Copyright/index.shtml

Here the folder Antivirus_system_pro was deleted three or more years ago. So now only /Malware/Spyware and /Copyright are two legitimate folders and without knowing history of the site, it is impossible to explain why Google bot attempts to access this crazy path.

This look like a bug in Google bot. But strangely enough Bing demostrate the same behaviour.  that means that both are keeping history of previously visited pages for something like a decade. Why thye are doing this unclear. May be they are they doing this as part of some kind of "research" for some government agency  ;-) ?

Still this pattern of stupid bunging into non-existent pages is amazingly consistent and repeatable.  They literally bump thier head against the wall again and again after getting clear return code that page does not exist anymore.  They do not believe the code and continue to check for years to come. 

Here are two examples from two other bots: Mail.RU and bingbot (bogus part of the path is in red):

217.69.133.11 - - [02/Feb/2014:01:17:08 +0000] "GET /Access_control/Groups/Lang/index.shtml HTTP/1.1" 404 29006 "-" "Mozilla/5.0 (compatible; Linux x86_64; Mail.RU_Bot/2.

157.55.33.124 - - [02/Feb/2014:00:56:20 +0000] "GET /Admin/Education/Solaris/humor.shtml HTTP/1.1" 404 29006 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"

See also Large Sample of "Composition URL" fake hits

Bingbot also has very long memory and  systematically bangs against such "constructed" path cases that accidentally occurred due to an error committed more then tree years (yes years) ago:

65.55.52.87 - - [09/Jan/2014:06:12:47 +0000] "GET /Hardware/Dell/Servers/SE/humor.shtml HTTP/1.1" 404 15738 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
65.55.52.87 - - [09/Jan/2014:06:12:48 +0000] "GET /Commercial_unixes/AIX/Skeptics/humor.shtml HTTP/1.1" 404 15738 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
65.55.52.87 - - [09/Jan/2014:06:12:48 +0000] "GET /Admin/HP_operations_manager/Copyright/index.shtml HTTP/1.1" 404 15738 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
65.55.52.87 - - [09/Jan/2014:06:12:48 +0000] "GET /Internals/Unix_filesystems/Admin/HP_operations_manager/index.shtml HTTP/1.1" 404 15738 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
65.55.52.87 - - [09/Jan/2014:06:13:27 +0000] "GET /Net/Solaris/Unixification/index.shtml HTTP/1.1" 404 15738 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"

A good thing that due to their consistency you can have the list of bogus pages on your site and just exclude them automatically from the logs. This is the simplest way to make 403 statistic mean something again.

A good thing that due to their consistency you can have the list of bogus pages on your site and just exclude them automatically from the logs. This is the simplest way to make 403 statistic mean something again.

Presence of "irrational" bots has other side effects

Huge number of attempts to access non-existent Web pages can't be explained by just two cases: probes against pages that can be exploited (typically PHP pages) and "constructed URL" pages which we discussed above.

My impression from analyzing HTTP logs for several months is that additional factor are Web bots which are probably written on the level of a student project or worse.

Still they consume real bandwidth and  along with accessing pages that are not existent they often engage is other types of "stupid" behaviour. For example there are several bots that "band" the same page tremendous number of times as if they want to wear it our ;-). Such bots affect 2xx stats and are even more dangerous as they distort the real picture of accesses to the pages of your site.  See Bangers

There are several bots that "band" the same page tremendous number of times as if they want to wear it our ;-). Such bots affect 2xx stats and are even more dangerous as they distort the real picture of accesses to the pages of your site.  See Bangers

Bangers do require  more attention then producer of "non-existent pages" hits and IMHO should be eliminated mercilessly.

Access of UTLs in lower case

As I mentioned about there is a whole category of "Windows style" robots which consistently try to access ULRs in lower case.  Such behaviour does not affect in any way Windows based sites. Only Linux sites are suffering from this  For example, they try to access directories like

/tools/dd
/tools
/suse/startup_and_shutdown
/public_html/social/overload
/performance

There is a whole class of bots which access URLs in lower case. Google with its maniacal desire to collect as much information as possible on everything should correct such errors automatically. It does not. In other words Google bot is a somewhat  stupid bot indeed.

Google with its maniacal desire to collect as much information as possible on everything should correct such errors automatically. It does not. In other words Google bot is a somewhat  stupid bot indeed.

One way to fight this class of bots is to make sure the all second level directories on your site start with a capital letter. In this case you can eliminale r redirect those requres automatically using Apache mod_rewrite capabilities. See Lower case requests

Truncated URLs in GET requests

Another class of  non-existent pages requests (possibly coming from poorly written bots) is truncated URL in GET requests. That happens mainly for very long URLs and that fact suggests that for such bots the buffer allocated for URL is too small.  Two similar bugs are blanks in URL and omitting extension for the file. For example

/bulletin/sp2014_v26 
/%20dns

For some reasons Google bot tends to pickup a lot of such "dirt".

Now any student can get and compile code for a bot, or construct a bot as an exercise in learning a programming language. The technology of site traversing is well described in textbooks. that's probably why so many of them demostrate "unexplanable stupidity". But bot from Google should be better then that. It is not ;-)

See also

Usage of botnets as another possible factor

It is clear that there are tremendous amount of zombies, which are part of some botnet,  that are available on Internet. For example in early June of 2014 authorities took down  botnet that served for distribution of Cryptolocker which contained over 300,000 computers.

But they can be used for scanning the sites too. In this case the GET request represent a probe against some vulnerability  (see PHP probes for the most popular class).

Using zombie is preferable in this case, as the attacker in this case is not afraid of retaliation. Also if IP is blocked another zombies can used,  as there is a strength in numbers. While it is somewhat dangerous to scan Web site from a legit address as reaction is often complete block, who cares if the target will be one of 300K zombie computers in a particular botnet.  For this class of bots, unlike bots that are student projects it is very difficult to find the IP range they are using. So blocking them based on IP range often fails. You need to understand the composition of the address space they use before you can completely cut the oxygen for them.

Not too much zeal is a rule

 Let's assume that you want to exterminate all "useless" HTTP accesses for your site. Analyzing the traffic will take probably aw weel of your time. And all this time your http logs remain polluted. Bu the next week composition of those rogue bots will not be completely the same, so your "perfect" blocking start leaking some hits. And then the next set of crazy bot hit your site. And then another one. And then Google bot or Yahoo bot or Bing bot  pickup somewhere really "generated" path+file combo, or try to access ten years old links, or engage in crazy behaviour of their own making.  So it is unclear what is the return on investment.  The whole picture looks pretty bleak and in this type of a fight between zombies and webmasters zombies often have an upper hand. 

At the same time while blocking all of them is difficult and your 404 errors log probably will remain polluted despite your best efforts, the most obnoxious IPs from which this trick is performed should be blocked just for the sake of justice.

You can write a special script that counts particular bot actions and create a list of "jerks" on a daily basis and ban them for a fixed amount of time, say 90 days (usually this suffice to stop activity from particular set of IPs; those guys are pretty adaptive). Recidivists should be banned for 180 days and so on. 

Preparing the list of IPs  for blocking

In order to prepare the list for blocking you need first to get a distribution of bogus requests to your side. Limit yourself to the first dozen and never block anybody who is 10 times less then max number of 4xx hits.

For example

cut -d ' ' -f 1 get_40x_1405.txt | sort | uniq -c | sort -rn | head
  25606 183.60.215.54
  25386 183.60.213.109
  24687 183.60.214.23
  10141 208.115.113.83
   9615 208.115.111.66
   4135 100.43.83.158
   1431 68.180.224.174
   1257 66.249.70.13
    861 89.145.95.42

The next step is to determine if all of them have DNS addresses. IPs without DNS are the first candidates for blocking. In the case above the first three Chinese  IP addresses do not have DNS names.

perl ./resolv.pl bogus1405
25606 183.60.215.54
25386 183.60.213.109
24687 183.60.214.23
10141 208.115.113.83
9615 208.115.111.66 208-115-111-66-reverse.wowrack.com.
4135 100.43.83.158
1431 68.180.224.174 b100094.yse.yahoo.net.
1257 66.249.70.13 crawl-66-249-70-13.googlebot.com.
861 89.145.95.42 centro-42.grapeshot.co.uk.
820 38.111.147.86 cr6.iparadigms.com.

Now we instantly see that it make sense to concerate our attention on the first four.

The first thing is to determine if they do any PHP probes against your site. If they do more then a dozen, then we can assume that this IP is used by a script kiddie and probably should be banned without further investigation.

fgrep 183.60.215.54 get_40x_1405.txt | fgrep '.php?' | wc -l
3
fgrep 183.60.213.109 get_40x_1405.txt | fgrep '.php?' | wc -l
1
183.60.214.23 get_40x_1405.txt | fgrep '.php?' | wc -l
2
208.115.113.83 get_40x_1405.txt | fgrep ',php?' | wc -l
0
As we can see none of those IPs belong to script kiddies.

The next step is to determine whether the number of legitimate GET requests (which resulted in 20x range of codes).  If it is less then 10%  it make sense to block the sucker.

fgrep 183.60.215.54 get_20x_1405.txt | wc -l
5021
fgrep 183.60.213.109 get_20x_1405.txt | wc -l
5144
fgrep 183.60.214.23 get_20x_1405.txt | wc -l
4921
fgrep 208.115.113.83 get_20x_1405.txt | wc -l
5195
fgrep 208.115.111.66 get_20x_1405.txt | wc -l
5258
fgrep 100.43.83.158 get_20x_1405.txt | wc -l12559

As we can see in all cases the number of successful GET requests is considerable more than 10%, which suggest while they are doing something suspicious, especially  183.60.215.54, it does not make sense to block them.

For IPs with DNS you probably need to be even more careful. You need several additional step trying to determine if there are multiple accesses from this IP (for example often such IP is a proxy for a large organization with some bad apples).

This can be done by extracting all requests from your logs for a given period (say, month) and looking to requests to favicon.ico. Bots generally do not produce such requests.

Attempt of classification of  requests to non-existent pages

There are several major types of accesses to non-existent pages that I uncovered so far. I will try to improve this classification as new information becomes available

Total records processed 52329
Zombie 41.193.5.52  
         Rogue php pages requests = 63
         Rogue POST requests = 63
         Rogue .shtml pages requests = 9
         HTTP Codes
                 200 - 5
                 404 - 73
                 403 - 63

There are several similar cases which belong to different classes of errors:


Top Visited
Switchboard
Latest
Past week
Past month

NEWS CONTENTS

Old News ;-)

[Dec 13, 2015] Probes from bc.googleusercontent.com

Recently we observed an avalanche of probes from bc.googleusercontent.com

Here is a sample of requests

104.196.3.74 - - [08/Dec/2015:01:34:38 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:01:34:38 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:01:34:39 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:00:47 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:00:47 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:00:47 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:09:33 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:09:33 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:09:33 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:12:43 +0000] "GET /About/Stats//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:12:43 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:12:43 +0000] "GET /About//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:16:09 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:16:09 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:16:09 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:27:20 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:27:20 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:27:20 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:40:10 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:40:11 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:40:11 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:40:14 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:40:14 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:40:15 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:43:19 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:43:19 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:43:19 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:47:33 +0000] "GET /WWW/HTTP_log_analysis/requests_for_nonexisting_web_pages.shtml//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:47:33 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:47:33 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:48:02 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:48:02 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:48:02 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:54:50 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:54:50 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:02:54:50 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:02:48 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:02:48 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:02:48 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:13:55 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:13:55 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:13:55 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:25:58 +0000] "GET /WWW/HTTP_log_analysis/requests_for_nonexisting_web_pages.shtml//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:25:58 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:25:58 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:27:25 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:27:25 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:27:25 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:47:18 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:47:19 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:47:19 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:51:09 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:51:09 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:51:09 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:53:12 +0000] "GET /WWW/HTTP_log_analysis//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:53:12 +0000] "GET //admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"
104.196.3.74 - - [08/Dec/2015:03:53:12 +0000] "GET /WWW//admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 500 - "-" "libwww-perl/5.833"

[Aug 29, 2012] Some recent examples of "vulnerabilities scanning" for the site.

Those attacks are really look very crude. I wonder why they repeat the same request again and again? ...
91.121.89.20 - - [28/Aug/2012:09:21:27 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [28/Aug/2012:09:21:27 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [28/Aug/2012:09:21:28 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [28/Aug/2012:09:21:29 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [28/Aug/2012:09:21:29 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [28/Aug/2012:09:21:30 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [28/Aug/2012:09:21:30 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [28/Aug/2012:09:21:31 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [28/Aug/2012:09:21:31 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
5.39.112.251 - - [28/Aug/2012:09:22:04 -0700] "GET /Admin/humor.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Admin/humor.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
93.188.8.141 - - [28/Aug/2012:09:23:54 -0700] "GET /admin/product.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:09:23:54 -0700] "GET /extras/curltest.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
188.187.141.189 - - [28/Aug/2012:09:48:02 -0700] "GET /Commercial_linuxes/Suse/index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/index.php" "Opera/9.80 (Windows NT 6.1; U; YB/3.5.1; ru) Presto/2.6.30 Version/10.63"
188.187.141.189 - - [28/Aug/2012:09:48:04 -0700] "GET /index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/index.php" "Opera/9.80 (Windows NT 6.1; U; YB/3.5.1; ru) Presto/2.6.30 Version/10.63"
5.39.112.251 - - [28/Aug/2012:09:56:19 -0700] "GET /Editors/tcl_editors.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Editors/tcl_editors.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
207.126.61.161 - - [28/Aug/2012:10:28:00 -0700] "GET /About/Stats//index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
207.126.61.161 - - [28/Aug/2012:10:28:00 -0700] "GET //index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
207.126.61.161 - - [28/Aug/2012:10:28:00 -0700] "GET /About//index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
61.56.203.11 - - [28/Aug/2012:10:33:31 -0700] "GET /Scripting/index.php?_REQUEST=&_REQUEST%5boption%5d=com_content&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absolute_path=http://recycleengineering.com/itrecycle/tmp/install_4e8971c78d252/arm7/html/com_tools/daster.jpg?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
61.56.203.11 - - [28/Aug/2012:10:33:33 -0700] "GET /index.php?_REQUEST=&_REQUEST%5boption%5d=com_content&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absolute_path=test?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
61.56.203.11 - - [28/Aug/2012:10:33:34 -0700] "GET /index.php?_REQUEST=&_REQUEST%5boption%5d=com_content&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absolute_path=http://recycleengineering.com/itrecycle/tmp/install_4e8971c78d252/arm7/html/com_tools/daster.jpg?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
200.98.145.36 - - [28/Aug/2012:10:34:02 -0700] "GET /Malware/index2.php?p=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
200.98.145.36 - - [28/Aug/2012:10:34:02 -0700] "GET /index2.php?p=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
5.39.112.251 - - [28/Aug/2012:10:42:59 -0700] "GET /Office/html_editors.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Office/html_editors.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
91.121.115.109 - - [28/Aug/2012:10:43:40 -0700] "GET /Malware/Malicious_web/zombies.shtml//index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.115.109 - - [28/Aug/2012:10:43:40 -0700] "GET //index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.115.109 - - [28/Aug/2012:10:43:41 -0700] "GET /Malware/Malicious_web//index.php?option=com_joomlaradiov5&controller=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
93.188.8.141 - - [28/Aug/2012:10:49:40 -0700] "GET /Security/admin/sqlpatch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:40 -0700] "GET /Security/admin/sqlpatch1.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:41 -0700] "GET /Security/admin/sq1patch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:41 -0700] "GET /Security/admin/sq1p4tch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:41 -0700] "GET /Security/admin/sqlpatch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:42 -0700] "GET /Security/admin/sqlpatch.php1/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:42 -0700] "GET /Security/admin/sqlpatch1.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:43 -0700] "GET /Security/admin/sq1patch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:43 -0700] "GET /Security/admin/sq1p4tch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:44 -0700] "GET /Security/admin/sqlpatch.php1/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:47 -0700] "GET /admin/sqlpatch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:47 -0700] "GET /admin/sqlpatch1.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:48 -0700] "GET /admin/sq1patch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:48 -0700] "GET /admin/sq1p4tch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:49 -0700] "GET /admin/sqlpatch.php1/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:49 -0700] "GET /admin/sqlpatch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:49 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:49 -0700] "GET /admin/sqlpatch1.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:50 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:50 -0700] "GET /admin/sq1patch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:50 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:50 -0700] "GET /admin/sq1p4tch.php/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:51 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:51 -0700] "GET /admin/sqlpatch.php1/password_forgotten.php?action=execute HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:51 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:51 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:52 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:52 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:53 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
93.188.8.141 - - [28/Aug/2012:10:49:53 -0700] "GET //admin/record_company.php/password_forgotten.php HTTP/1.1" 403 82 "-" "Mozilla/4.61 (Macintosh; I; PPC)"
5.39.112.251 - - [28/Aug/2012:11:12:55 -0700] "GET /Commercial_linuxes/linux_acl.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Commercial_linuxes/linux_acl.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.9.199.112 - - [28/Aug/2012:11:19:24 -0700] "GET /scripting/php.shtml HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
217.25.31.21 - - [28/Aug/2012:11:30:13 -0700] "GET /Logs/log_security.shtml//xmlrpc.php/xmlprc.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
217.25.31.21 - - [28/Aug/2012:11:30:13 -0700] "GET //xmlrpc.php/xmlprc.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
217.25.31.21 - - [28/Aug/2012:11:30:14 -0700] "GET /Logs//xmlrpc.php/xmlprc.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
209.172.50.183 - - [28/Aug/2012:11:37:18 -0700] "GET /Tools/http://www.movinginn.co.uk//index.php?option=com_properties&controller=../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
209.172.50.183 - - [28/Aug/2012:11:37:18 -0700] "GET /http://www.movinginn.co.uk//index.php?option=com_properties&controller=../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
5.39.112.251 - - [28/Aug/2012:13:20:26 -0700] "GET /Utilities/dir_sync.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Utilities/dir_sync.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
37.220.26.62 - - [28/Aug/2012:13:32:06 -0700] "HEAD /history/hesilverhand.com/twacks/index.php?PHPSESSID=3114b73036790fa90aff2300bb08ce7e&topic=16451.15 HTTP/1.0" 403 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50"
2.93.27.123 - - [28/Aug/2012:13:47:00 -0700] "GET /Malware/Malicious_web/Bulletin/web_zombies_bulletin070623.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Malware/Malicious_web/Bulletin/web_zombies_bulletin070623.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
65.52.108.12 - - [28/Aug/2012:13:54:30 -0700] "GET /Tools/tar.shtml/index.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
5.39.112.251 - - [28/Aug/2012:14:24:21 -0700] "GET /Bookshelf/excel.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Bookshelf/excel.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [28/Aug/2012:14:56:54 -0700] "GET /Solaris/solaris_whitepapers.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Solaris/solaris_whitepapers.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [28/Aug/2012:15:06:22 -0700] "GET /Scripting/php.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/php.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [28/Aug/2012:15:27:53 -0700] "GET /Editors/ctags.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Editors/ctags.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
184.170.246.3 - - [28/Aug/2012:15:36:17 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/3.0 (OS/2; U)"
5.9.198.245 - - [28/Aug/2012:16:02:54 -0700] "GET /DNS/security.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/DNS/security.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
85.107.189.12 - - [28/Aug/2012:16:05:27 -0700] "POST /admin/administrators.php/login.php?action=insert HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)"
85.107.189.12 - - [28/Aug/2012:16:05:28 -0700] "POST /admin/login.php?action=process HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)"
178.84.149.128 - - [28/Aug/2012:16:29:31 -0700] "GET /login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)"
178.84.149.128 - - [28/Aug/2012:16:29:32 -0700] "GET /signup.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)"
5.39.112.251 - - [28/Aug/2012:16:44:11 -0700] "GET /Tools/dd.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Tools/dd.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
174.106.4.142 - - [28/Aug/2012:16:47:09 -0700] "GET /index.php?page=register HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0"
5.39.112.251 - - [28/Aug/2012:17:00:41 -0700] "GET /OSS/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/OSS/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
37.220.26.62 - - [28/Aug/2012:17:12:53 -0700] "HEAD /history/hesilverhand.com/twacks/index.php?PHPSESSID=3114b73036790fa90aff2300bb08ce7e&topic=16451.15 HTTP/1.0" 403 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50"
91.194.251.186 - - [28/Aug/2012:17:13:36 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050609 Firefox/1.0.4"
174.106.4.142 - - [28/Aug/2012:17:31:59 -0700] "GET /profile.php?mode=register HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0"
91.194.251.186 - - [28/Aug/2012:17:37:10 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-GB; rv:1.7.10) Gecko/20050717 Firefox/1.0.6"
91.194.251.186 - - [28/Aug/2012:17:40:04 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050609 Firefox/1.0.4"
91.121.106.113 - - [28/Aug/2012:17:42:35 -0700] "GET /Mail/mta.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Mail/mta.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [28/Aug/2012:17:45:33 -0700] "GET /Mail/spam.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Mail/spam.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
91.194.251.186 - - [28/Aug/2012:17:47:02 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050609 Firefox/1.0.4"
37.59.173.131 - - [28/Aug/2012:17:48:43 -0700] "GET /Scripting/Phprama/command_line_php.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/Phprama/command_line_php.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
68.169.35.164 - - [28/Aug/2012:17:53:39 -0700] "GET /Commercial_linuxes/Suse/Security/launchpad_login.php HTTP/1.0" 403 82 "http://www.softpanorama.org/launchpad_login.php" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; MRA 5.10 (build 5310); .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)"
5.39.112.251 - - [28/Aug/2012:17:58:56 -0700] "GET /Scripting/Shellorama/vi_mode.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/Shellorama/vi_mode.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
46.246.17.192 - - [28/Aug/2012:18:11:02 -0700] "GET /Mail/mta.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Mail/mta.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
157.55.32.80 - - [28/Aug/2012:18:31:31 -0700] "GET /Security/IDS/acid.shtml/hall.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
5.39.112.251 - - [28/Aug/2012:18:35:24 -0700] "GET /OSS/linus_midas_touch.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/OSS/linus_midas_touch.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [28/Aug/2012:18:42:53 -0700] "GET /DNS/dns_servers.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/DNS/dns_servers.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
222.122.46.235 - - [28/Aug/2012:18:43:39 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.1) Gecko/20060130 SeaMonkey/1.0"
46.105.99.187 - - [28/Aug/2012:18:44:24 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; Konqueror/3.1; Linux 2.4.22-10mdk; X11; i686; fr, fr_FR)"
46.105.99.187 - - [28/Aug/2012:18:45:46 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511"
5.39.112.251 - - [28/Aug/2012:18:48:03 -0700] "GET /SE/humor.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/SE/humor.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
46.105.99.187 - - [28/Aug/2012:18:48:05 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050512 Firefox"
5.39.112.251 - - [28/Aug/2012:18:56:42 -0700] "GET /People/Stallman/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/People/Stallman/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
176.223.201.139 - - [28/Aug/2012:19:03:17 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-GB; rv:1.7.10) Gecko/20050717 Firefox/1.0.6"
5.39.112.251 - - [28/Aug/2012:19:14:30 -0700] "GET /People/Cox/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/People/Cox/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
211.210.0.11 - - [28/Aug/2012:19:30:19 -0700] "GET /zboard.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
211.210.0.11 - - [28/Aug/2012:19:30:31 -0700] "GET /zboard.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
211.210.0.11 - - [28/Aug/2012:19:31:52 -0700] "GET /Malware/Malicious_web/zboard.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
211.210.0.11 - - [28/Aug/2012:19:31:53 -0700] "GET /zboard.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
211.210.0.11 - - [28/Aug/2012:19:31:53 -0700] "GET /Malware/zboard.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
5.39.112.251 - - [28/Aug/2012:19:54:58 -0700] "GET /Net/troubleshooting.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Net/troubleshooting.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
108.60.129.21 - - [28/Aug/2012:20:07:16 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7"
108.60.129.21 - - [28/Aug/2012:20:07:16 -0700] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7"
108.60.129.21 - - [28/Aug/2012:20:07:17 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7"
108.60.129.21 - - [28/Aug/2012:20:07:17 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7"
108.60.129.21 - - [28/Aug/2012:20:07:17 -0700] "GET /admin/categories.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7"
108.60.129.21 - - [28/Aug/2012:20:07:17 -0700] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7"
69.175.50.169 - - [28/Aug/2012:20:13:16 -0700] "GET /WWW/Content_management/wiki.shtml/index.php?title=Special:UserLogin&action=submitlogin&type=signup&returnto=Special:UserLogin HTTP/1.1" 403 82 "http://www.softpanorama.org/WWW/Content_management/wiki.shtml/index.php?title=Special:UserLogin&type=signup&returnto=Special:UserLogin&returntoquery=type%3Dsignup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
69.175.50.169 - - [28/Aug/2012:20:13:16 -0700] "POST /WWW/Content_management/wiki.shtml/index.php?title=Special:UserLogin&action=submitlogin&type=signup&returnto=Special:UserLogin HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
200.98.201.180 - - [28/Aug/2012:20:13:19 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)"
200.98.201.180 - - [28/Aug/2012:20:13:20 -0700] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)"
200.98.201.180 - - [28/Aug/2012:20:13:20 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)"
200.98.201.180 - - [28/Aug/2012:20:13:20 -0700] "GET /admin/categories.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)"
200.98.201.180 - - [28/Aug/2012:20:13:21 -0700] "GET /Lang/cpp.shtml%22%20class=%22resultLink/admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)"
200.98.201.180 - - [28/Aug/2012:20:13:22 -0700] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)"
108.60.129.21 - - [28/Aug/2012:20:28:16 -0700] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7"
108.60.129.21 - - [28/Aug/2012:20:29:05 -0700] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7"
5.39.112.251 - - [28/Aug/2012:20:36:14 -0700] "GET /Copyright/humor.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Copyright/humor.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
157.55.34.35 - - [28/Aug/2012:22:17:07 -0700] "GET /WWW/Webservers/web_server_security.shtml/nota.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
188.132.239.233 - - [28/Aug/2012:22:22:02 -0700] "GET /extras/curltest.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:22:22:22 -0700] "GET /extras/curltest.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
37.59.173.131 - - [28/Aug/2012:22:49:15 -0700] "GET /Scripting/Phprama/command_line_php.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/Phprama/command_line_php.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [28/Aug/2012:23:06:01 -0700] "GET /Admin/unix_conf_managment.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Admin/unix_conf_managment.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
27.153.250.187 - - [28/Aug/2012:23:32:57 -0700] "GET /scripting/phprama/ HTTP/1.1" 403 82 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)"
5.39.112.251 - - [28/Aug/2012:23:42:09 -0700] "GET /Commercial_linuxes/lpi_certification.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Commercial_linuxes/lpi_certification.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
188.132.239.233 - - [28/Aug/2012:23:43:07 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:43:08 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:43:09 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:43:10 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:43:11 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:43:12 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:49:28 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:49:29 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:49:30 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:49:31 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:49:32 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
188.132.239.233 - - [28/Aug/2012:23:49:33 -0700] "POST /admin/file_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
5.39.112.251 - - [29/Aug/2012:00:04:22 -0700] "GET /Articles/Linux_vs_Solaris/comparison_of_internal_architecture.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Articles/Linux_vs_Solaris/comparison_of_internal_architecture.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
85.107.189.12 - - [29/Aug/2012:01:12:22 -0700] "POST /admin/administrators.php/login.php?action=insert HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)"
85.107.189.12 - - [29/Aug/2012:01:12:22 -0700] "POST /admin/login.php?action=process HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)"
5.39.112.251 - - [29/Aug/2012:01:32:07 -0700] "GET /Net/Transport_layer/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Net/Transport_layer/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
91.121.89.20 - - [29/Aug/2012:02:46:25 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [29/Aug/2012:02:46:25 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [29/Aug/2012:02:46:26 -0700] "POST /Lang/cpp.shtml%22%20class=%22resultLink/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [29/Aug/2012:02:46:27 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [29/Aug/2012:02:46:27 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [29/Aug/2012:02:46:28 -0700] "POST /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [29/Aug/2012:02:46:28 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [29/Aug/2012:02:46:29 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
91.121.89.20 - - [29/Aug/2012:02:46:30 -0700] "POST /Lang/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
112.25.12.38 - - [29/Aug/2012:03:38:32 -0700] "GET /login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)"
80.58.29.174 - - [29/Aug/2012:03:38:34 -0700] "GET /signup.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)"
80.58.29.174 - - [29/Aug/2012:03:38:35 -0700] "GET /signup.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)"
5.39.112.251 - - [29/Aug/2012:03:43:28 -0700] "GET /WWW/www_management_scripts.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/WWW/www_management_scripts.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
37.59.131.9 - - [29/Aug/2012:03:46:16 -0700] "GET /Tools/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Tools/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
174.127.116.240 - - [29/Aug/2012:03:51:35 -0700] "GET /register.php?do=signup HTTP/1.1" 403 82 "http://www.softpanorama.org/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)"
5.39.112.251 - - [29/Aug/2012:04:13:19 -0700] "GET /History/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/History/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:04:16:01 -0700] "GET /history.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/history.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:04:32:16 -0700] "GET /Windows/startup_and_shutdown.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Windows/startup_and_shutdown.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
64.15.147.199 - - [29/Aug/2012:04:54:57 -0700] "GET /Skeptics/Political_skeptic//parse/parser.php?WN_BASEDIR=test?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0"
64.15.147.199 - - [29/Aug/2012:04:54:58 -0700] "GET /Skeptics/Political_skeptic//parse/parser.php?WN_BASEDIR=http://www.aorta.ca/byroe.jpg?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0"
64.15.147.199 - - [29/Aug/2012:04:54:59 -0700] "GET /Skeptics/Political_skeptic//parse/parser.php?WN_BASEDIR=?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0"
64.15.147.199 - - [29/Aug/2012:04:55:01 -0700] "GET //parse/parser.php?WN_BASEDIR=test?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0"
64.15.147.199 - - [29/Aug/2012:04:55:02 -0700] "GET //parse/parser.php?WN_BASEDIR=http://www.aorta.ca/byroe.jpg?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0"
64.15.147.199 - - [29/Aug/2012:04:55:03 -0700] "GET //parse/parser.php?WN_BASEDIR=?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0"
64.15.147.199 - - [29/Aug/2012:04:55:04 -0700] "GET /Skeptics//parse/parser.php?WN_BASEDIR=test?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0"
64.15.147.199 - - [29/Aug/2012:04:55:05 -0700] "GET /Skeptics//parse/parser.php?WN_BASEDIR=http://www.aorta.ca/byroe.jpg?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0"
64.15.147.199 - - [29/Aug/2012:04:55:07 -0700] "GET /Skeptics//parse/parser.php?WN_BASEDIR=?? HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19) Gecko/2010061201 Firefox/3.0.19 Flock/2.6.0"
5.39.112.251 - - [29/Aug/2012:06:05:31 -0700] "GET /OSS/open_source.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/OSS/open_source.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
219.137.181.125 - - [29/Aug/2012:06:08:47 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"
219.137.181.125 - - [29/Aug/2012:06:08:49 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"
205.189.73.122 - - [29/Aug/2012:06:16:55 -0700] "GET /register.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.78 Safari/535.11"
95.173.185.22 - - [29/Aug/2012:06:36:09 -0700] "GET /WWW/web_logs_analysis.shtml//index.php?option=com_fabrik&controller=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
95.173.185.22 - - [29/Aug/2012:06:36:09 -0700] "GET //index.php?option=com_fabrik&controller=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
95.173.185.22 - - [29/Aug/2012:06:36:10 -0700] "GET /WWW//index.php?option=com_fabrik&controller=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6"
5.39.112.251 - - [29/Aug/2012:06:47:22 -0700] "GET /Scripting/Shellorama/dotfiles.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/Shellorama/dotfiles.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:07:44:52 -0700] "GET /People/index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/People/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:07:47:32 -0700] "GET /Education/SAT/Strategy/multiple_choice_questions_exam_strategies.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Education/SAT/Strategy/multiple_choice_questions_exam_strategies.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
131.253.46.202 - - [29/Aug/2012:07:54:19 -0700] "GET /Lang/java.shtml/templates/errors.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
5.39.112.251 - - [29/Aug/2012:08:14:11 -0700] "GET /Admin/system_monitoring.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Admin/system_monitoring.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:08:21:33 -0700] "GET /Solaris/certification.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Solaris/certification.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:08:27:00 -0700] "GET /Solaris/solaris_compilation_problems.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Solaris/solaris_compilation_problems.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
72.252.249.34 - - [29/Aug/2012:08:31:04 -0700] "GET /Utilities/vmstat.shtml/admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
72.252.249.34 - - [29/Aug/2012:08:31:04 -0700] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
72.252.249.34 - - [29/Aug/2012:08:31:17 -0700] "GET /Utilities/vmstat.shtml/admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
72.252.249.34 - - [29/Aug/2012:08:31:17 -0700] "GET /admin/banner_manager.php/login.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
72.252.249.34 - - [29/Aug/2012:08:32:04 -0700] "GET /Utilities/vmstat.shtml/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
72.252.249.34 - - [29/Aug/2012:08:32:04 -0700] "GET /admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
72.252.249.34 - - [29/Aug/2012:08:32:04 -0700] "GET /Utilities/admin/categories.php/login.php?cPath=&action=new_product_preview HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"
5.39.112.251 - - [29/Aug/2012:08:39:24 -0700] "GET /index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
219.137.181.125 - - [29/Aug/2012:08:43:02 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"
5.39.112.251 - - [29/Aug/2012:09:22:09 -0700] "GET /Skeptics/Pseudoscience/harvard_mafia.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Skeptics/Pseudoscience/harvard_mafia.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
78.145.139.206 - - [29/Aug/2012:09:59:34 -0700] "POST /Tools/mobiquo/mobiquo.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1"
87.253.162.11 - - [29/Aug/2012:10:19:04 -0700] "POST /contact.php HTTP/1.1" 403 82 "-" "Mozilla/4.8 [en] (Windows NT 5.0; U)"
205.189.73.122 - - [29/Aug/2012:10:39:19 -0700] "GET /register.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.78 Safari/535.11"
85.107.181.212 - - [29/Aug/2012:10:55:43 -0700] "POST /admin/administrators.php/login.php?action=insert HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)"
85.107.181.212 - - [29/Aug/2012:10:55:44 -0700] "POST /admin/login.php?action=process HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E)"
5.39.112.251 - - [29/Aug/2012:11:18:10 -0700] "GET /Articles/note_on_the_relationship_of_brooks_law_and_conway_law.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Articles/note_on_the_relationship_of_brooks_law_and_conway_law.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
178.73.212.226 - - [29/Aug/2012:11:33:44 -0700] "GET /Scripting/php.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/php.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:11:42:05 -0700] "GET /History/cpu_history.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/History/cpu_history.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.9.198.245 - - [29/Aug/2012:11:43:27 -0700] "GET /Scripting/php.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/php.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:11:49:17 -0700] "GET /Security/social_sites_as_intelligence_collection_tools.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Security/social_sites_as_intelligence_collection_tools.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:11:53:58 -0700] "GET /Bulletin/sp2004h.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Bulletin/sp2004h.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
219.137.181.125 - - [29/Aug/2012:12:20:07 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"
219.137.181.125 - - [29/Aug/2012:12:20:07 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"
219.137.181.125 - - [29/Aug/2012:12:20:07 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"
219.137.181.125 - - [29/Aug/2012:12:20:08 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"
205.189.73.191 - - [29/Aug/2012:12:23:49 -0700] "GET /register.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.78 Safari/535.11"
5.39.112.251 - - [29/Aug/2012:12:36:53 -0700] "GET /Windows/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Windows/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:12:57:03 -0700] "GET /Utilities/touch.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Utilities/touch.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
219.137.181.125 - - [29/Aug/2012:13:12:57 -0700] "GET /submit.php HTTP/1.1" 403 82 "http://www.softpanorama.org" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"
157.55.33.181 - - [29/Aug/2012:13:32:51 -0700] "GET /Malware/Malicious_web/Bulletin/index.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
5.39.112.251 - - [29/Aug/2012:13:48:26 -0700] "GET /Education/social_problems_of_education.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Education/social_problems_of_education.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
46.246.88.137 - - [29/Aug/2012:13:53:44 -0700] "GET /Copyright/index.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Copyright/index.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:13:57:09 -0700] "GET /Scripting/python.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Scripting/python.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:13:59:33 -0700] "GET /Bulletin/sp2003h.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Bulletin/sp2003h.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
68.169.35.164 - - [29/Aug/2012:14:28:15 -0700] "GET /Commercial_linuxes/Suse/Security/launchpad_login.php HTTP/1.0" 403 82 "http://www.softpanorama.org/launchpad_login.php" "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0"
82.247.105.227 - - [29/Aug/2012:15:15:08 -0700] "POST /Commercial_linuxes/Tips/mobiquo/mobiquo.php HTTP/1.1" 403 82 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.6 (KHTML, like Gecko) Chrome/23.0.1243.2 Safari/537.6"
5.39.112.251 - - [29/Aug/2012:15:17:12 -0700] "GET /Utilities/script.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Utilities/script.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:15:31:42 -0700] "GET /Solaris/solaris_enterprize_strategy.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Solaris/solaris_enterprize_strategy.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
5.39.112.251 - - [29/Aug/2012:15:38:04 -0700] "GET /Admin/job_schedulers.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Admin/job_schedulers.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
222.231.2.134 - - [29/Aug/2012:16:03:13 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:14 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:15 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:15 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:15 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:16 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:16 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:16 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:17 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:17 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:18 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:03:18 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:26 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:27 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:27 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:27 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:27 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:28 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:28 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:28 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:29 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:29 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:30 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
222.231.2.134 - - [29/Aug/2012:16:06:30 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Gigabot/3.0 (http://www.gigablast.com/spider.html)"
108.171.246.242 - - [29/Aug/2012:16:29:43 -0700] "GET /pingserver.php HTTP/1.1" 403 82 "-" "gsa-crawler (Enterprise; GID-01422; jplastiras.com)"
108.171.246.242 - - [29/Aug/2012:16:29:43 -0700] "GET /WWW/pingserver.php HTTP/1.1" 403 82 "-" "gsa-crawler (Enterprise; GID-01422; jplastiras.com)"
5.39.112.251 - - [29/Aug/2012:16:32:46 -0700] "GET /Windows/direct_disk_editing.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Windows/direct_disk_editing.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
120.128.6.235 - - [29/Aug/2012:16:40:08 -0700] "GET /index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/index.php" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) Opera 6.01  [en]"
120.128.6.235 - - [29/Aug/2012:16:40:20 -0700] "GET /index.php HTTP/1.0" 403 82 "http://www.softpanorama.org/index.php" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) Opera 6.01  [en]"
5.39.112.251 - - [29/Aug/2012:17:01:05 -0700] "GET /Copyright/License_classification/social_dynamics_of_BSD_and_GPL.shtmlindex.php HTTP/1.0" 403 82 "http://www.softpanorama.org/Copyright/License_classification/social_dynamics_of_BSD_and_GPL.shtmlindex.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"
217.73.229.210 - - [29/Aug/2012:17:08:58 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:08:58 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:08:59 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:08:59 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:08:59 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:00 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:00 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:00 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:01 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:01 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:01 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:02 -0700] "POST /About/Stats//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:02 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:02 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:03 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:03 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:03 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:04 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:04 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:04 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:05 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:05 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:05 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:06 -0700] "POST //adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:06 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:07 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:07 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:07 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:08 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:08 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:08 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:09 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:09 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:09 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:10 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
217.73.229.210 - - [29/Aug/2012:17:09:10 -0700] "POST /About//adxmlrpc.php HTTP/1.1" 403 82 "-" "Microsoft Pocket Internet Explorer/0.6"
95.31.3.173 - - [29/Aug/2012:18:34:42 -0700] "GET /WWW/index.php?do=basic HTTP/1.1" 403 82 "http://www.softpanorama.org/" "Mozilla/5.0 (Linux; U; Android 2.2; fr-fr; Desire_A8181 Build/FRF91) App3leWebKit/53.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"

[Aug 29, 2012] Interesting cases of some bots doing crazy things

The real URL for the page is: http://www.softpanorama.org/Net/Application_layer/SSH/passwordless_ssh_login.shtml
Note fake referrer (or may be it came from anonimizer)
120.42.77.92 - - [29/Aug/2012:12:26:35 -0700] "GET /passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)"
120.42.77.92 - - [29/Aug/2012:12:29:04 -0700] "GET /History/passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)"
120.42.77.92 - - [29/Aug/2012:12:29:04 -0700] "GET /passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)"
91.217.178.178 - - [29/Aug/2012:12:48:25 -0700] "GET /WWW//passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; MRA 5.10 (build 5310); .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)"
91.217.178.178 - - [29/Aug/2012:12:48:26 -0700] "GET //passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org//passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; MRA 5.10 (build 5310); .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)"
94.181.166.31 - - [29/Aug/2012:13:42:55 -0700] "GET /Commercial_linuxes/RHEL/Installation/passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Opera/9.00 (Windows NT 5.1; U; en)"
94.181.166.31 - - [29/Aug/2012:13:42:56 -0700] "GET /RHEL/Installation/passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/RHEL/Installation/passwordless_ssh_login.shtml" "Opera/9.00 (Windows NT 5.1; U; en)"
141.105.66.145 - - [29/Aug/2012:15:05:41 -0700] "GET /Lang//passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Opera/9.80 (Windows NT 5.1; U; MRA 6.0 (build 5680); ru) Presto/2.10.289 Version/12.00"
141.105.66.145 - - [29/Aug/2012:15:05:41 -0700] "GET //passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org//passwordless_ssh_login.shtml" "Opera/9.80 (Windows NT 5.1; U; MRA 6.0 (build 5680); ru) Presto/2.10.289 Version/12.00"
94.181.166.31 - - [29/Aug/2012:15:45:36 -0700] "GET /Admin/passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 2000) Opera 6.0 [en]"
94.181.166.31 - - [29/Aug/2012:15:45:37 -0700] "GET /passwordless_ssh_login.shtml HTTP/1.0" 404 16076 "http://www.softpanorama.org/passwordless_ssh_login.shtml" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 2000) Opera 6.0 [en]"

[Aug 22, 2012] googlebot is crawling old website addresses and weird non-existing links -

Google Groups

zantoro

1/4/10

I have read the FAQs and checked for similar issues: YES
My site's URL is: http://bit.ly/7qzOfm
Description (including timeline of any changes made):
Hello,
googlebot and all other bots (including msn and sharepoint) are crawling our old website addresses and some custom addresses which never existed.
This is slowing down our website (at the moment we have disabled all crawlings through robot.txt).
an example of the unexistent address is: http://bit.ly/7Qq1rf
as you can see the page the bot is looking for is /WebSite/NewsandEvents/events.aspx/ims/MULTIMODAL/200910_WALTERPROJECT.aspx which doesn't make sense as it treats events.aspx as a folder.
We already disabled ASP.NET PathInfo otherwise IIS would try to resolve the trailing address as PathInfo (slowing down the resolution even more).
how can I fix this problem?

Thanks,
Roberto.

Autocrat

1/4/10

By making sure your server/script responds with a proper 404 instead of a 200?

You should also try to discover Where the incorrect URLs are originating.
If they are plain old Wrong - try Xenu Link Slueth, crawl your site and make sure it's not you.
If they are plain old Wrong - check any Sitemaps and make sure you are not providing wrong URLs there.
After that - look through server logs to see if anyone is requesting those URLs, and see if there is a referer - it may be an external link.


If you can identify where these requests should be going - you could consider using 301 Redirects.

zantoro

Hi,
thanks for the super-quick answer.
It returns a 302 as we provide a customized error page.
this is the whole line in the log:
2009-12-22 00:34:58 W3SVC1021457076 MAINFRAME 172.26.1.7 GET /WebSite/homepage.aspx/membership/Technologies/Technologies/NewsandEvents/document/aboutETSI/Annual_report/Annual_Report_2008_english.pdf - 80 - 66.249.65.35 HTTP/1.1 Googlebot/2.1+(+http://www.google.com/bot.html) - - www.etsi.org 302 0 0 775 337 109
does this mean www.etsi.org is the referer? (that's the site itself)
I checked with your tool and I see no broken links referring to "aspx/" addresses
I checked with Google Webmaster tools and there are no incoming links to these addresses.
those URLs are only requested by bots (all of them)
There is only one sitemap: http://www.etsi.org/Application/CMS/siteMap/sitemap.xml and no "aspx/" links are listed.
Thanks for any other tip you can give me,
Roberto.

Autocrat

1/4/10

Here's what G see's as possibly matches for the end of that URL
http://www.google.co.uk/#q=%22document/aboutETSI/Annual_report/Annual_Report_2008_english.pdf%22&hl=en&filter=0&fp=6ebf334cc7734206

Do any of those link to your site?

Whether you provide a customised 404 page or not - you should still send a 404 response - NOT a 302.
You should set your server to send a 404 response, and specifiy a page it an load up as a 404.
You make sure that page/script/code sends a 404 response header.
Do not redirect to some page and think it is a 404 - it isn't.

Heres what G see's for "/WebSite/homepage.aspx/membership"
http://www.google.co.uk/#hl=en&q=%22/WebSite/homepage.aspx/membership%22&start=10&sa=N&filter=0&fp=6ebf334cc7734206

Do you use the Base Href element anywhere on your site?
It's possible that using the wrong base href, and relational URLs (instead of absolute ones) could result in errors?

By making sure your server/script responds with a proper 404 instead of a 200?

You should also try to discover Where the incorrect URLs are originating.
If they are plain old Wrong - try Xenu Link Slueth, crawl your site and make sure it's not you.
If they are plain old Wrong - check any Sitemaps and make sure you are not providing wrong URLs there.
After that - look through server logs to see if anyone is requesting those URLs, and see if there is a referer - it may be an external link.


If you can identify where these requests should be going - you could consider using 301 Redirects.

invalid requests in my webserver logfile - HTML - CSS

Sebastian Luemmer

Hi,

when I had a look at my monthly webserver logfile, I found several
strange requests for files, which are definitely not on my webserver.
These files were

/_vti_inf.html
/_vti_bin/shtml.exe/_vti_rpc
/IMagEs/loGO/LOgo_ICo.IcO

They do not match or even look like anything on the server! Where do
these requests come from? I don't think that anybody types
http://www.foo.bar/IMagEs/loGO/LOgo_ICo.IcO when opening his browser.
Are these requests coming from bots or worms or viruses or something
like that? Who knows that?

Thank you for your ideas, this is not really a great problem for me, I'm
just interested in knowing what's going on on the server.

Thanks
Sebastian

Brian

Sebastian Luemmer wrote:

[color=blue]
> I found several strange requests for files, which are
> definitely not on my webserver.[/color]

This is ot for a www authoring group. You might have better luck in
ciwa-site design, or alt.www.webmaster.
[color=blue]
> /_vti_inf.html
> /_vti_bin/shtml.exe/_vti_rpc
> /IMagEs/loGO/LOgo_ICo.IcO
>
> They do not match or even look like anything on the server! Where do
> these requests come from? I don't think that anybody types
> http://www.foo.bar/IMagEs/loGO/LOgo_ICo.IcO when opening his browser.
> Are these requests coming from bots or worms or viruses or something
> like that? Who knows that?[/color]

The first two look like Code Red/Nimda worms looking for files that
indicate that the server software is MS IIS. No idea what the third
request is about.

--
Brian
follow the directions in my address to email me

Ivo

"Brian" <usenet1@mangymutt.com.invalid-remove-this-part> wrote in message
news:ocXeb.482123$cF.167948@rwcrnsc53...[color=blue]
> Sebastian Luemmer wrote:
>
>[color=green]
> > I found several strange requests for files, which are
> > definitely not on my webserver.[/color]
>
> This is ot for a www authoring group. You might have better luck in
> ciwa-site design, or alt.www.webmaster.
>[color=green]
> > /_vti_inf.html
> > /_vti_bin/shtml.exe/_vti_rpc
> > /IMagEs/loGO/LOgo_ICo.IcO
> >
> > They do not match or even look like anything on the server! Where do
> > these requests come from? I don't think that anybody types
> > http://www.foo.bar/IMagEs/loGO/LOgo_ICo.IcO when opening his browser.
> > Are these requests coming from bots or worms or viruses or something
> > like that? Who knows that?[/color]
>
> The first two look like Code Red/Nimda worms looking for files that
> indicate that the server software is MS IIS. No idea what the third
> request is about.
>
> --
> Brian
> follow the directions in my address to email me
>[/color]

I also see numerous requests each month for /formmail.cgi with various
capitalizations although no such file has ever existed on my site. Even
stranger, non-existing files also show up as refferer!?
Would it be possible to detect if it is indeed a worm, and then output a
rather large number of megabytes or something to choke it?
Ivo

"Ivo" <no@thank.you> wrote in news:3f7da731$0$447$1b62eedf@news.wanadoo.nl:
[color=blue]
> I also see numerous requests each month for /formmail.cgi with various
> capitalizations although no such file has ever existed on my site. Even
> stranger, non-existing files also show up as refferer!?
> Would it be possible to detect if it is indeed a worm, and then output a
> rather large number of megabytes or something to choke it?[/color]

Matt Wright's original formmail script is a godsend to spammers, since it's
willing to send to any email address that's included in the form that
invokes it. If you've ever gotten a spam that talks about the results of
your request, you've seen what can happen when a spammer gets a hold of an
unintentional spam gateway. I assume someone is scanning you to see if you
have that particular vulnerability.

Brian

Ivo wrote:[color=blue][color=green][color=darkred]
>>>I found several strange requests for files[/color]
>>[color=darkred]
>>> /_vti_inf.html[/color]
>>
>>Code Red/Nimda worms looking for files that
>>indicate that the server software is MS IIS.[/color]
>
> I also see numerous requests each month for /formmail.cgi with various
> capitalizations although no such file has ever existed on my site.[/color]

Spammers, looking for a cgi mail interface. They hope to use your
copy of formmail.pl as a mule to send their spam, which will appear to
be coming from you domain. Well, it would be coming from your domain,
but you would not have been the spam's author.
[color=blue]
> Would it be possible to detect if it is indeed a worm, and then output a
> rather large number of megabytes or something to choke it?[/color]

It might be. As I said earlier, this is OT for this group, so you may
not get that question answered here. The simplest thing you can do is
redirect requests for files such as these to invalid domains.

redirect /cgi-bin/ http://stop.spam.invalid
redirect /_vti_bin http://stop.the.virus.invalid

Please include the .invalid. There is no reason to punish some domain
by making them the target of the redirects.

--
Brian
follow the directions in my address to email me

Recommended Links

Softpanorama hot topic of the month

Softpanorama Recommended

Top articles

Sites

Hypertext Transfer Protocol - Wikipedia, the free encyclopedia

PHP Page Hits Script - Strangly tracking non-existing contents on server - Web Hosting Talk

non existing page requests (Hacking attempts

Internal links



Etc

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in our efforts to advance understanding of environmental, political, human rights, economic, democracy, scientific, and social justice issues, etc. We believe this constitutes a 'fair use' of any such copyrighted material as provided for in section 107 of the US Copyright Law. In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit exclusivly for research and educational purposes.   If you wish to use copyrighted material from this site for purposes of your own that go beyond 'fair use', you must obtain permission from the copyright owner. 

ABUSE: IPs or network segments from which we detect a stream of probes might be blocked for no less then 90 days. Multiple types of probes increase this period.  

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotesSomerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose BierceBernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOSProgramming Languages History : PL/1 : Simula 67 : C : History of GCC developmentScripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-MonthHow to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Haterís Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least


Copyright © 1996-2016 by Dr. Nikolai Bezroukov. www.softpanorama.org was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License.

The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to make a contribution, supporting development of this site and speed up access. In case softpanorama.org is down you can use the at softpanorama.info

Disclaimer:

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.

Last modified: September, 12, 2017