[Dshield] Someone is looking for formmail.pl script...
jens at ing.twinwave.net
Wed Aug 22 14:48:25 GMT 2001
That's fairly common - we get scanned for that crap all the time...
formmail.pl get used a lot for spam too.
----- Original Message -----
From: <miroslaws at home.com>
To: <dshield at dshield.org>
Sent: Wednesday, August 22, 2001 11:25 AM
Subject: [Dshield] Someone is looking for formmail.pl script...
> Somebody is scanning domains and try to find existance of CGI script
> formmail.pl If the script exists, than the information is e-mailed to
> address woah at aol.com . In the below log the 'xxxxxxxxx.com' it is the
> hosted by one of my web servers. I had to hide the real name of the domain
> because of my confindentiality agreement.
> 220.127.116.11 - - [15/Aug/2001:20:58:22 -0700] "GET
/cgi-bin/formmail.pl?email=itp642 at mek869.com&recipient=woah at aol.com&subject=
> %20valid.%20~vms HTTP/1.0" 404 0 "-" "-"
> Best Regards,
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
More information about the list