Question: I'm seeing entries in my Apache logs like the following

```
178.216.185.210 - - [24/Feb/2014:11:46:40 -0500] "COOK /freesearch.php?portal=0a9&... HTTP/1.0" 303 589 "-" "Mozilla/4.0 (compatible; Synapse)"

```

with `COOK` in place of the usual `GET` or `POST`.

I've tried a variety of search terms and can't find any info on what this might be. I've also Googled the user-agent string and discovered that it is likely a script built with [Ararat Synapse](http://sourceforge.net/projects/synalist/). And judging by the other requests made with that user-agent string, this is someone who is up to no good.

So is this just some made up request method?

How does Apache handle unknown request methods? The response status code for all `COOK` requests is logged as 303. So is Apache saying *See Other* and just providing the same URI? I don't see another hit from same IP, so I am assuming response is simply logged or ignored. They probably come back later from another IP.

So my script is never run, correct?

Answer: 
The COOK verb appears to be synonymous with the User-Agent string containing "Synapse". 
The term Synapse is a free TCP/IP library written in Pascal (see here: <http://wiki.freepascal.org/Synapse#From_an_HTTP_server>) that is used to create bots, scrapers and crawlers as well as other legitimate software.
This method of attack is most likely usually tied to a user agent as mentioned previously, such as with SYNAPSE, and because this tool is commonly used for malicious probing and hacking, is most probably used in this method as a way to probe if you are blocking or have some sort of firewall or application in place that will block based on unknown HTTP Methods. Depending on the response you may be able to gain insight into the tools used.

Knowing that you have a firewall or some sort of other tool in place to deny these requests, they then craft the attack to avoid that common default blocking behaviors used by that type of firewall/tool.