It's only an idea. I've recently logged that my server is scanned by w00tw00t tools.
I found many solutions to this, such as use of apache mod-security, fail2ban, etc..
The one I want to speak about, is usage of iptables to block such IP's, based on apache log matching.
If I would use any presented idea, about how to block those scanning address, we must point out important fact, which is requesting IP's are almost every time spoofed, which means, they don't belong to attacker.
Isn't this idea then causing damage to our common users? If I would block out IP, which was spoofed by attacker, I would block someone, who is not causing me a real damage, which means, in conclusion, none of the iptables based defense is usable, or am I wrong?
Or worse, could this server-side preventive measure be used as attack? Such as If I need prevent somebody from accessing site, I will spoof his IP and get it blocked by this preventive system using iptables blocking, isn't it?
Study material:
http://blog.urlvoid.com/w00tw00t-at-isc-sans-dfind-web-scanner/
https://serverfault.com/questions/125607/dealing-with-http-w00tw00t-attacks
http://profi-admin.com/Articles/Showfull/06/05/2010/Administration/How-i-got-rid-of-the-w00tw00t-entries-in-my-server-logs
http://foxpa.ws/2010/07/14/using-dfind-exe-and-blocking-w00tw00t-at-isc-sans-dfind/
http://www.myatus.com/2010/07/17/blocking-w00tw00t-scans/
http://spamcleaner.org/en/misc/w00tw00t.html