[VIM] soapCaller.bs

[security curmudgeon]

On Sun, 28 Sep 2008, George A. Theall wrote:

(late reply..)

: I've noticed recently a lot of scans from Morpheus for soapCaller.bs; eg,
: 
:  208.40.33.20 - - [27/Sep/2008:17:46:53 -0400] "GET /user/soapCaller.bs
: HTTP/1.1" 404 216 "-" "Morfeus Fucking Scanner"
: 
: Does anyone know what vulnerability the scanner's trying to exploit?

Figured with time passing, more information would come to light. 
Unfortunately, doesn't appear taht way.

Speculation it is XOOPS or Drupal related:
http://johannburkard.de/blog/www/spam/morfeus-fucking-scanner-revolt-other-vulnerability-scanners.html

A site that seems to have and use soapCaller.bs, which may explain why a 
scanner looks for it. If that is the name of the sample script and it 
comes with a default..:
https://www.cordance.org/user/soapCaller.bs

Another site that uses a 'sopcaller.bs'"
http://www.itjobfeed.com/soapcaller.bs-jobs


Rest of the hits on early pages of Google is talking about log activity, 
nothing really helpful.