I'm getting strange URL requests...

[sabka]

I'm using a 404 tracking page that logs every attempt for a non-existant page on my server.
Lately I've been getting requests for the following files (which don't exits):

http://www.domain.com/cgi-bin/formmail.cgi
and
http://www.domain.com/cgi-bin/formmail.pl

Is this a program trying to find open SMTP servers for spam?
Any harm in that (I don't have those cgi's anyways)?

Thanks

 

[Nothinman]

Google is your friend.

http://www.scriptarchive.com/formmail.html

Any users who have versions of FormMail prior to v1.91, including the popular version 1.6, should upgrade immediately. v1.91 plugs several more spam-related security holes.

 

[sabka]

Cool,

found some Info regarding this.
I guess I'm save since I don't have those files 🙂

 

[bsobel]

Originally posted by: Nothinman
Google is your friend.

http://www.scriptarchive.com/formmail.html

Any users who have versions of FormMail prior to v1.91, including the popular version 1.6, should upgrade immediately. v1.91 plugs several more spam-related security holes.

I guess we could all do a community service and claim to have those scripts, but then just blackhole the data (and take a LONG time to do it between posts...) 😉

Bill

 

[Nothinman]

True. But then you run the risk of DoSing your self, just make a fake formmail.pl a script that never returns would work but would leave a lot of outstanding connections/processes on your box too.

 

[glugglug]

Better yet....

make a formmail.pl that just adds the requester to your blocked senders list.

 

[sabka]

Originally posted by: glugglug
Better yet....

make a formmail.pl that just adds the requester to your blocked senders list.

That's a good idea. Just get their IP and report it 🙂
Or Blacklist it