Lame China scan from 111.37.2.50

No replies
RaT
RaT's picture
Offline
SX High Council
Joined: 2008/03/12

Blake said the shaming portion of the talk went over pretty well, so figured I'd post some fresh lamer logs.

111.37.2.50 did a lame scan:

111.37.2.50 - - [13/Aug/2014:08:47:25 -0400] "GET / HTTP/1.1" 200 12450 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36 CoolNovo/2.0.9.20"
111.37.2.50 - - [13/Aug/2014:08:47:51 -0400] "GET / HTTP/1.1" 200 8147 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36 CoolNovo/2.0.9.20"
111.37.2.50 - - [13/Aug/2014:08:56:16 -0400] "GET / HTTP/1.0" 302 436 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:19 -0400] "GET / HTTP/1.0" 302 436 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:19 -0400] "GET /robots.txt HTTP/1.1" 302 491 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:20 -0400] "GET /never_could_exist_file_nosec.nosec HTTP/1.0" 302 504 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:20 -0400] "GET / HTTP/1.1" 302 474 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:21 -0400] "GET /never_could_exist_file_nosec.aspx HTTP/1.0" 302 502 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:22 -0400] "GET /never_could_exist_file_nosec.shtml HTTP/1.0" 302 504 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:23 -0400] "GET /never_could_exist_file_nosec/ HTTP/1.0" 302 494 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:23 -0400] "GET / HTTP/1.1" 200 12181 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:26 -0400] "GET / HTTP/1.0" 200 29275 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:29 -0400] "GET / HTTP/1.1" 200 12085 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:32 -0400] "GET /never_could_exist_file_nosec.nosec HTTP/1.0" 404 15254 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:37 -0400] "GET /never_could_exist_file_nosec.aspx HTTP/1.0" 404 15254 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:41 -0400] "GET /never_could_exist_file_nosec.shtml HTTP/1.0" 404 15254 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:46 -0400] "GET /never_could_exist_file_nosec/ HTTP/1.0" 301 5089 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:54 -0400] "GET / HTTP/1.1" 302 417 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:54 -0400] "PUT /jsky_test.txt HTTP/1.1" 302 443 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:56 -0400] "TRACE /TRACE_test HTTP/1.1" 405 426 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:56 -0400] "PUT /jsky_web_scanner_test_file.txt HTTP/1.1" 302 477 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:57 -0400] "GET /Jsky_Web_Scanner_Test.dll HTTP/1.1" 302 467 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:57 -0400] "DELETE /Jsky_test_no_exists_file.txt HTTP/1.1" 302 473 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:58 -0400] "GET /%3Cscript%3Ealert(42873) HTTP/1.1" 302 465 "http://www.soldierx.com:80/<script>alert(42873)" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:56:58 -0400] "TRACK /TRACK_test HTTP/1.1" 302 437 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:00 -0400] "OPTIONS / HTTP/1.1" 302 417 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:00 -0400] "GET /%3Cscript%3Ealert(42873).do HTTP/1.1" 302 471 "http://www.soldierx.com:80/<script>alert(42873).do" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:01 -0400] "GET /%3Cscript%20s%3Ealert(42873) HTTP/1.1" 302 473 "http://www.soldierx.com:80/<script s>alert(42873);</script>" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:01 -0400] "GET /_vti_bin/_vti_adm/admin.dll HTTP/1.1" 302 471 "http://www.soldierx.com:80/_vti_bin/_vti_adm/admin.dll" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:02 -0400] "GET / HTTP/1.0" 302 436 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:02 -0400] "GET /_vti_bin/_vti_aut/author.dll HTTP/1.1" 302 473 "http://www.soldierx.com:80/_vti_bin/_vti_aut/author.dll" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:03 -0400] "GET /install.php HTTP/1.1" 302 439 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:03 -0400] "GET /_vti_bin/shtml.exe?_vti_rpc HTTP/1.1" 302 471 "http://www.soldierx.com:80/_vti_bin/shtml.exe?_vti_rpc" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:04 -0400] "GET /fckeditor/editor/filemanager/browser/default/browser.html HTTP/1.1" 302 531 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:04 -0400] "GET /server-info HTTP/1.1" 302 439 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:05 -0400] "HEAD /data/dvbbs8.mdb HTTP/1.1" 302 202 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:05 -0400] "GET /console/login/LoginForm.jsp HTTP/1.1" 302 471 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:03 -0400] "GET /never_could_exist_file_nosec.aspx.bak HTTP/1.0" 404 15254 "https://www.soldierx.com:443/never_could_exist_file_nosec.aspx.bak" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:06 -0400] "GET /extras/ipn_test_return.php HTTP/1.1" 302 469 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:06 -0400] "GET /jmx-console/ HTTP/1.1" 302 441 "http://www.soldierx.com:80/jmx-console/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:07 -0400] "GET /.svn/entries HTTP/1.1" 302 441 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:07 -0400] "GET /web-console/ HTTP/1.1" 302 441 "http://www.soldierx.com:80/web-console/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:08 -0400] "GET /extras/curltest.php?url=http://baike.baidu.com/robots.txt HTTP/1.1" 302 531 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:08 -0400] "GET /robots.txt HTTP/1.1" 302 437 "http://www.soldierx.com:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:09 -0400] "GET /uploads/ HTTP/1.1" 302 433 "http://www.soldierx.com:80/uploads/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:10 -0400] "GET /wp-content/ HTTP/1.1" 302 439 "http://www.soldierx.com:80/wp-content/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:08 -0400] "GET /never_could_exist_file_nosec.aspx.BAK HTTP/1.0" 404 15254 "https://www.soldierx.com:443/never_could_exist_file_nosec.aspx.BAK" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:11 -0400] "GET /logfiles/ HTTP/1.1" 302 435 "http://www.soldierx.com:80/logfiles/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:12 -0400] "GET /jsp-examples/ HTTP/1.1" 302 443 "http://www.soldierx.com:80/jsp-examples/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:13 -0400] "GET /log/ HTTP/1.1" 302 425 "http://www.soldierx.com:80/log/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:14 -0400] "GET /data/ HTTP/1.1" 302 427 "http://www.soldierx.com:80/data/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:15 -0400] "GET /logs/ HTTP/1.1" 302 427 "http://www.soldierx.com:80/logs/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:13 -0400] "GET /never_could_exist_file_nosec.aspx.zip HTTP/1.0" 404 15254 "https://www.soldierx.com:443/never_could_exist_file_nosec.aspx.zip" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:16 -0400] "GET /datas/ HTTP/1.1" 302 429 "http://www.soldierx.com:80/datas/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:17 -0400] "GET /example/ HTTP/1.1" 302 433 "http://www.soldierx.com:80/example/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:18 -0400] "GET /examples/ HTTP/1.1" 302 435 "http://www.soldierx.com:80/examples/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:19 -0400] "GET /upload/ HTTP/1.1" 302 431 "http://www.soldierx.com:80/upload/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:18 -0400] "GET /never_could_exist_file_nosec.aspx.ZIP HTTP/1.0" 404 15254 "https://www.soldierx.com:443/never_could_exist_file_nosec.aspx.ZIP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:20 -0400] "GET /WebService/ HTTP/1.1" 302 439 "http://www.soldierx.com:80/WebService/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:21 -0400] "GET /WEB-INF/ HTTP/1.1" 302 433 "http://www.soldierx.com:80/WEB-INF/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:22 -0400] "GET /aspnet/ HTTP/1.1" 302 431 "http://www.soldierx.com:80/aspnet/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:23 -0400] "GET /db/ HTTP/1.1" 302 423 "http://www.soldierx.com:80/db/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:24 -0400] "GET /manage/ HTTP/1.1" 302 431 "http://www.soldierx.com:80/manage/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:22 -0400] "GET /never_could_exist_file_nosec.aspx.tar.gz HTTP/1.0" 404 15254 "https://www.soldierx.com:443/never_could_exist_file_nosec.aspx.tar.gz" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:25 -0400] "GET /backup/ HTTP/1.1" 302 431 "http://www.soldierx.com:80/backup/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:26 -0400] "GET /old/ HTTP/1.1" 302 425 "http://www.soldierx.com:80/old/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:27 -0400] "GET /inc/ HTTP/1.1" 302 425 "http://www.soldierx.com:80/inc/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:27 -0400] "GET /include/ HTTP/1.1" 302 433 "http://www.soldierx.com:80/include/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:28 -0400] "GET /files/ HTTP/1.1" 302 429 "http://www.soldierx.com:80/files/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:27 -0400] "GET /never_could_exist_file_nosec.aspx.temp HTTP/1.0" 404 15254 "https://www.soldierx.com:443/never_could_exist_file_nosec.aspx.temp" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:29 -0400] "GET /logfiles/ HTTP/1.1" 302 435 "http://www.soldierx.com:80/logfiles/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:30 -0400] "GET /htdocs/ HTTP/1.1" 302 431 "http://www.soldierx.com:80/htdocs/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
111.37.2.50 - - [13/Aug/2014:08:57:31 -0400] "GET /conf/ HTTP/1.1" 302 427 "http://www.soldierx.com:80/conf/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"

Then changed user agents and did a bit more...

11.37.2.50 - - [13/Aug/2014:09:04:55 -0400] "GET /news.jsp HTTP/1.1" 302 433 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:55 -0400] "GET /css/ HTTP/1.1" 302 425 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:55 -0400] "GET /css HTTP/1.1" 302 423 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:55 -0400] "GET /index.aspx?page=../../../../etc/passwd HTTP/1.1" 302 493 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:55 -0400] "GET /index.asp?page=../../../../etc/passwd/ HTTP/1.1" 302 493 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:55 -0400] "GET /index.jsp?page=../../../../etc/passwd HTTP/1.1" 302 491 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:55 -0400] "GET /index.asp?page=../../../../etc/passwd HTTP/1.1" 302 491 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:55 -0400] "GET /index.php?page=../../../../etc/passwd/ HTTP/1.1" 302 493 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:55 -0400] "GET /index.aspx?page=../../../../etc/passwd/ HTTP/1.1" 302 495 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /index.jsp?page=../../../../etc/passwd/ HTTP/1.1" 302 493 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /admin/index.asp HTTP/1.1" 302 447 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /admin/index.php HTTP/1.1" 302 447 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /about.asp HTTP/1.1" 302 435 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /about.aspx HTTP/1.1" 302 437 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /about.php HTTP/1.1" 302 435 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /admin/index.aspx HTTP/1.1" 302 449 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /index.php?page=../../../../etc/passwd HTTP/1.1" 302 491 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /robots.txt HTTP/1.1" 200 2084 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:57 -0400] "GET /img/ HTTP/1.1" 301 671 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /search.aspx HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:56 -0400] "GET /Inc HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:57 -0400] "GET /news.php HTTP/1.1" 404 10841 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:57 -0400] "GET /news.aspx HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:57 -0400] "GET /search.asp HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:57 -0400] "GET /search.jsp HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:57 -0400] "GET /search.php HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:57 -0400] "GET /img HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:57 -0400] "GET /news.asp HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:00 -0400] "GET /admin/index.jsp HTTP/1.1" 302 447 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:00 -0400] "GET /data HTTP/1.1" 302 425 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:04:59 -0400] "GET /css HTTP/1.1" 404 10841 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:00 -0400] "GET /css/ HTTP/1.1" 301 671 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:00 -0400] "GET /news.jsp HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:01 -0400] "GET /index.php?page=../../../../etc/passwd/ HTTP/1.1" 301 719 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:00 -0400] "GET /index.aspx?page=../../../../etc/passwd HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:01 -0400] "GET /index.jsp?page=../../../../etc/passwd HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:01 -0400] "GET /index.asp?page=../../../../etc/passwd HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:01 -0400] "GET /index.asp?page=../../../../etc/passwd/ HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:01 -0400] "GET /index.aspx?page=../../../../etc/passwd/ HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"
111.37.2.50 - - [13/Aug/2014:09:05:01 -0400] "GET /index.jsp?page=../../../../etc/passwd/ HTTP/1.1" 404 10979 "-" "Microsoft URL Control - 6.00.8169"