# Suspicious route?

**URL:** <https://www.ruby-forum.com/t/suspicious-route/121981>\
**Category:** Rails\
**Created:** [December 3, 2007, 4:46pm UTC](https://www.ruby-forum.com/t/suspicious-route/121981 "2007-12-03T16:46:00Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![george\_b](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecb155/32.png) [@george\_b](https://www.ruby-forum.com/u/george_b)\
**Post date:** [December 3, 2007, 4:46pm UTC](https://www.ruby-forum.com/t/suspicious-route/121981/1 "2007-12-03T16:46:00Z")

</div>

I have a small site that I put up this weekend. To see any errors I  
have rescue\_action\_in\_public  
send me an email.

This morning I received these errors:

no route found to match “/\_vti\_inf.html” with {:method=\>:get}  
(exception)no route found to match “/\_vti\_bin/shtml.exe/\_vti\_rpc” with  
{:method=\>:post}

Is that someone poking around?

---

<div class="post-metadata">

**Author:** ![george\_b](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecb155/32.png) [@george\_b](https://www.ruby-forum.com/u/george_b)\
**Post date:** [December 3, 2007, 5:21pm UTC](https://www.ruby-forum.com/t/suspicious-route/121981/2 "2007-12-03T17:21:26Z")

</div>

seems to be a common problem, read this

> **[Many, many, many security holes in the Microsoft Frontpage extensions](https://insecure.org/sploits/Microsoft.frontpage.insecurities.html)**
>
> There are many horrible security holes in the Microsoft Frontpage extensions. For example, you can list all files in directories on FP enabled sites, you can download password files on many of them, and a lot of FP sites even let you UPLOAD your own...

or throw “/\_vti\_bin/shtml.exe/\_vti\_rpc” into google to get even more  
details…

---

<div class="post-metadata">

**Author:** ![george\_b](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecb155/32.png) [@george\_b](https://www.ruby-forum.com/u/george_b)\
**Post date:** [December 3, 2007, 5:54pm UTC](https://www.ruby-forum.com/t/suspicious-route/121981/3 "2007-12-03T17:54:47Z")

</div>

On Dec 3, 2007, at 10:21 AM, Thorsten M. wrote:

> seems to be a common problem, read this  
> [Many, many, many security holes in the Microsoft Frontpage extensions](http://insecure.org/sploits/Microsoft.frontpage.insecurities.html)
> 
> or throw “/\_vti\_bin/shtml.exe/\_vti\_rpc” into google to get even more  
> details…

Thanks Thorsten. So within hours someone was up to no good. They were  
only a day late, as the version before mine had been using frontpage.

---

<div class="post-metadata">

**Author:** ![george\_b](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecb155/32.png) [@george\_b](https://www.ruby-forum.com/u/george_b)\
**Post date:** [December 3, 2007, 7:20pm UTC](https://www.ruby-forum.com/t/suspicious-route/121981/4 "2007-12-03T19:20:07Z")

</div>

> Thanks Thorsten. So within hours someone was up to no good. They were  
> only a day late, as the version before mine had been using frontpage.

maybe they knew that or even had success with it?

---

<div class="post-metadata">

**Author:** ![george\_b](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecb155/32.png) [@george\_b](https://www.ruby-forum.com/u/george_b)\
**Post date:** [December 3, 2007, 10:09pm UTC](https://www.ruby-forum.com/t/suspicious-route/121981/5 "2007-12-03T22:09:06Z")

</div>

On Dec 3, 2007, at 12:20 PM, Thorsten M. wrote:

> maybe they knew that or even had success with it?

I was wondering the same thing. I wasn’t involved, but a quick look at  
previous logs didn’t reveal anything obvious.

---

<div class="post-metadata">

**Author:** ![george\_b](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecb155/32.png) [@george\_b](https://www.ruby-forum.com/u/george_b)\
**Post date:** [December 3, 2007, 7:34pm UTC](https://www.ruby-forum.com/t/suspicious-route/121981/6 "2007-12-03T19:34:17Z")

</div>

On Dec 3, 2007 12:20 PM, Thorsten M.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > Thanks Thorsten. So within hours someone was up to no good. They were  
> > only a day late, as the version before mine had been using frontpage.
> 
> maybe they knew that or even had success with it?

This sort of url activity happens all the time on popular web servers.  
It’s really nothing to gasp about.

–  
Greg D.  
[http://destiney.com/](http://destiney.com/)

---

<div class="post-metadata">

**Author:** ![george\_b](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/ecb155/32.png) [@george\_b](https://www.ruby-forum.com/u/george_b)\
**Post date:** [December 3, 2007, 10:10pm UTC](https://www.ruby-forum.com/t/suspicious-route/121981/7 "2007-12-03T22:10:52Z")

</div>

On Dec 3, 2007, at 12:33 PM, Greg D. wrote:

> This sort of url activity happens all the time on popular web servers.  
> It’s really nothing to gasp about.

Thanks Greg. I didn’t know what it was, and at first thought I’d done  
something wrong in setting it up, as it happened so soon after going  
live.