POST /formmail.php

hacking attempt?

[RobBroekhuis]

In my logs today:
67.X1.144.13. Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
09:04:28:POST /formmail.php [404], (1985 bytes)

I have no such file, nor have I ever had anything remotely similar to that name. Is this an attempt to hack? That one POST was the only entry for that IP address in my logs.
Rob

[edited by: DaveAtIFG at 2:17 am (utc) on April 26, 2004]
[edit reason] Obscured IP [/edit]

[encyclo]

Probably just random IP address scanning for vulnerable formmail scripts, which can be used for spamming. If you don't use formmail, then there should be no problem.

If you're bombarded with requests, you can think about using mod_rewrite to ban the originating IP addresses.