G web server and hackers

[pwalsh]

Hello, I do some web hosting with the G Web server.  Occasionally, I'll look at the log and see if any odd requests come through.  I found this one today:

8/2/2006 11:19:00 PM: 209.197.58.66 - "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1"

I browsed to this link, and the G web server redirected it to the home page (the one with all the NI links and tutorials).  So G webserver must understand the request.  I did some googling and found that this is some sort of hacker trick.   Does anyone have any thoughts on how to handle this? 

Thanks,

Pat

[TravisGilbert]

It's a scanner.  Normally it looks for php related files.  I think it's pretty safe to ignore.  You could always block the IP and report the incident to the ISP of the offender.
http://isc.sans.org/diary.php?storyid=900
http://isc.sans.org/diary.php?storyid=591

Edit: changed links to clickable

Message Edited by LittlemanTAMU on 08-03-2006 06:32 PM

[pwalsh]

Thanks.  I was worried because G Web server knew how to handle the request (rather than just generating an error).  But it looks like this is php hacking attempt, and all of my server scripts are vi's.  Thanks again.

Pat