w00tw00t.at.ISC.SANS.DFind

[jitspoe]

I constantly get this crap in my apache error_log:

[Mon Jan 07 13:21:15 2008] [error] [client 217.218.103.104] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)[Mon Jan 07 13:21:15 2008] [error] [client 217.218.103.104] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)[Mon Jan 07 13:21:15 2008] [error] [client 217.218.103.104] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)[Mon Jan 07 13:21:15 2008] [error] [client 217.218.103.104] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)[Mon Jan 07 13:21:15 2008] [error] [client 217.218.103.104] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)

Is there a way to block it so I don't have to scan through as much garbage to find real errors?

[KnacK]

OK I found some info on it:

From SANS.org: http://isc.sans.org/diary.html?storyid=900

Published: 2005-11-29,
Last Updated: 2005-11-30 05:49:00 UTC
by Swa Frantzen (Version: 1)
Following our request for help, a while ago, we received another submission of somebody finding the following in his web logs:

"GET /w00tw00t.at.ISC.SANS.DFind:)"

It seems that we forgot to tell our whitehat readers that the search is off. We know what's behind it.  It's a web vulnerability scanner that has this fingerprint. Find and use it at your own risk. We at the Internet Storm Center distance ourselves from this tool that is labeled by at least one security company as a hacker tool..

Here is a filter you can try. Read the entire thread: http://www.webmasterworld.com/apache/3481679.htm

[jitspoe]

Yeah, I saw that thread.  His solution was to filter it in his log parser, not the log itself.

[KnacK]

oh I misread that then.

Let me keep looking.

Maybe XB has an idea.

[XtremeBain]

Ugh, burning ears...

http://httpd.apache.org/docs/2.2/logs.html#conditional

[jitspoe]

Ugh, burning ears...

http://httpd.apache.org/docs/2.2/logs.html#conditional

Thanks... but why are your ears burning?

[Eiii]

Ear candles.
(Don't work at all, btw.)

[Zorchenhimer]

Ear candles.
(Don't work at all, btw.)

You've tried?  Haha.

[jitspoe]

Ear candles cannot be legally sold in Canada.

Bain's right up there with the rest of his Canadian buddies in illicit medicinal devices.