From: Chuck Murcko <chuck@telebase.com>
Message-Id: <199607161516.LAA25443@telebase.com.>
Subject: Re: Security probe
To: new-httpd@hyperreal.com
Date: Tue, 16 Jul 1996 11:16:24 -0400 (EDT)
In-Reply-To: <199607161503.KAA20381@sierra.zyzzyva.com> from "Randy Terbush"
 at Jul 16, 96 10:03:30 am
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-new-httpd@apache.org
Precedence: bulk
Reply-To: new-httpd@hyperreal.com

wood.com blew through here the same night/morning. I think this isn't a robot
per se; he only is checking for the notorious phf cgi-bin.

Randy Terbush liltingly intones:
> 
> 
> I'm forwarding this to Apache since I think it will be of
> general interest. This was originally posted by me to the
> robot-alert list that Rob Hartill, Brian Gough and I have
> recently started.
> 
> 
> ------- Forwarded Message
> 
> 
> While this is not necessarily a robot issue, I think it will be
> of interest to this list.  I had the following probes on a number
> of our servers. Malicious intent? You be the judge.
> 
> 
> First the accesses:
> 
> ...
> vh_nebmed.org/access_log-nebmed.org:sentry.wood.com - - [15/Jul/1996:05:32:50 -0500] "GET /cgi-bin/phf?Qalias=foo%0aid" 404 419
> 
> 
> And the errors:
> 
> ...
> [Mon Jul 15 07:27:53 1996] access to /docroot/global/northdallas.com/cgi-bin failed for sentry.wood.com, reason: File does not exist
> 
> ------- End of Forwarded Message
> 

chuck
Chuck Murcko	N2K Inc.	Wayne PA	chuck@telebase.com
And now, on a lighter note:
A diva who specializes in risqu'e arias is an off-coloratura soprano ...