FYI - we picked up active scanning for Ruby on Rails XML vulns - http://blog.spiderlabs.com/2013/01/honeypot-alert-active-probes-for-ruby-on-rails-xml-vulns.html This is a perfect example of the type of stuff we aim to catch. We got lucky this attacker happened to hit our honeypot. We need to deploy more sensors! Let me know if you can get any online and if you need any help with setup. Cheers -- Ryan Barnett