>> Oct 15 15:30:04 mysrv sshd[9563]: Bad protocol version
>> identification 'POST
>> /unauthenticated//..%01/..%01/..%01/..%01/..%01/..%01/..
>> %01/..%01/..%01/..%01/..%01/..%01/..%01' from 59.106.20.158

as for this:

http://isc.sans.org/diary.html?date=2007-01-17

that seems to match in part.

________
jose nazario, ph.d. http://monkey.org/~jose/