[Dshield] Someone is looking for formmail.pl script...

Jens Knoell jens at ing.twinwave.net
Wed Aug 22 14:48:25 GMT 2001


That's fairly common - we get scanned for that crap all the time...
formmail.pl get used a lot for spam too.

Jens

----- Original Message -----
From: <miroslaws at home.com>
To: <dshield at dshield.org>
Sent: Wednesday, August 22, 2001 11:25 AM
Subject: [Dshield] Someone is looking for formmail.pl script...


> Somebody is scanning domains and try to find existance of CGI script
> formmail.pl If the script exists, than the information is e-mailed to
> address woah at aol.com . In the below log the 'xxxxxxxxx.com' it is the
domain
> hosted by one of my web servers. I had to hide the real name of the domain
> because of my confindentiality agreement.
>
> 195.231.142.15 - - [15/Aug/2001:20:58:22 -0700] "GET
>
/cgi-bin/formmail.pl?email=itp642 at mek869.com&recipient=woah at aol.com&subject=
>
http://xxxxxxxxx.com/cgi-bin/formmail.pl&message=%0D%0A%0D%0Atime/date:%2011
>
:53:25pm%20/%2008/15/2001%0D%0Ahttp://xxxxxxxxx.com/cgi-bin/formmail.pl%20is
> %20valid.%20~vms HTTP/1.0" 404 0 "-" "-"
>
> Best Regards,
>
> Miroslaw
>
>
>
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www1.dshield.org/mailman/listinfo/dshield
>




More information about the list mailing list