On an old web server I ran for someone I renamed the original curl and wgets and replaces them with ones that just logged and did nothing else. After a year I had a nice list of URL’s for naughty scripts bots and exploits! (Server ran a load of Wordpress sites)
