attempted to access form mail

[Busynut]

I hope this is the correct forum to report this behavior - this ip was found in my logs 3 times recently attempting to find form mail (.pl and .cgi)--

195.172.101.68 - - [03/Nov/2002:06:31:25 +1100] "POST /cgi-bin/FormMail.pl HTTP/1.0" 404 3542 "http://mydomain.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; AIRF; .NET CLR 1.0.3705)"

nslookup 195.172.101.68
Canonical name: percy.pmeasuring.co.uk
Addresses:
195.172.101.68

[Brett_Tabke]

We get 50 of them a day here.

[andreasfriedrich]

Some previous threads in this forum:
searching for formmail [webmasterworld.com]
A lot of requests for /cgi-bin/formmail.pl [webmasterworld.com]

Even more threads using the site search:
site search for /forum11/ formmail [searchengineworld.com]

[Mardi_Gras]

Good time to make sure you are using the latest version of form mail (1.91?)

[wilderness]

Not sure how many a day I get.
Too many to waste time counting. Especially since they all result in 404's.
My host has their forms configured to only allow delivery from within the domain :-)

[volatilegx]

wilderness, that method of protection is not secure.. it's easy to program faked referrer info into the HTTP header.

The only secure method is to hard code the email addresses the script is allowed to mail to.

[wilderness]

volatilegx

Thanks for the heads up :-)

<snip>that method of protection is not secure>

I'm not disputing what you say.
I've read the documentation for the vulnerabilities.
Perhaps my host takes some other precations which I'm not aware of?

In either event I have visitors daily attempting all combinations of the script to use my mail servers to send mail and the end result is a 404 for their cgi request.
Which pleases me, to say the least.

[volatilegx]

If anybody wants a decently secure script, stickymail me... It's based on the excellent Web Email Lite script by Wallace Keith Gardner, with a couple of security fixes by yours truly.

<added>Oops just read the copyright info on the script and it doesn't allow redistribution. Oh well, I can still send you the URL Gardner's site where you can download the original, and I can give you my mods...</added>