GET /cgi-bin/ax.cgi URI Open Redirect Weakness

[attritionorg]

176.107.36.196 (176.107.36.196) - - [18/Feb/2026:09:14:20 -0700] "GET /cgi-bin/ax.cgi?http://www.sinnocence.com/ HTTP/1.1" 404 734 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1500.55 Safari/537.36"
75.34.11.37.dynamic.jazztel.es (37.11.34.75) - - [18/Feb/2026:09:14:14 -0700] "GET /cgi-bin/ax.cgi?http://www.pretention.net HTTP/1.1" 404 773 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.215 Safari/535.1"
213-91-199-46.ip.btc-net.bg (213.91.199.46) - - [19/Feb/2026:03:48:06 -0700] "GET /cgi-bin/ax.cgi?http://www.bsd.org HTTP/1.1" 404 806 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.2 (KHTML, like Gecko) Chrome/6.0.451.0 Safari/534.2"
37.237.136.61 (37.237.136.61) - - [19/Feb/2026:03:48:17 -0700] "GET /cgi-bin/ax.cgi?http://www.pinkpurge.com HTTP/1.1" 404 731 "-" "Mozilla/5.0 (X11; U; FreeBSD x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16"
93-40-142-229.ip39.fastwebnet.it (93.40.142.229) - - [19/Feb/2026:04:35:51 -0700] "GET /cgi-bin/ax.cgi?http://www.cyber-rights.org HTTP/1.1" 404 741 "-" "Mozilla/5.0 (X11; U; Linux x86_64; zh-CN; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10"

Quite a few hits on Google about this being scanned for, nothing obvious as to vendor/software.