Forum Moderators: phranque
202.103.216.170 - - [21/Sep/2003:11:39:08 -0700] "GET /cgi-bin/formmail.pl HTTP/1.0" 200 1135 "http//www.Blahblah.com/" "-"
202.103.216.170 - - [21/Sep/2003:11:39:09 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 936 "http//www.Blahblah.com/" "-"
80.58.33.235 - - [21/Sep/2003:11:39:12 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 933 "http//www.Blahblah.com/" "-"
203.190.139.72 - - [21/Sep/2003:11:39:14 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 939 "http//www.Blahblah.com/" "-"
66.30.27.104 - - [21/Sep/2003:11:39:16 -0700] "POST /cgi-bin/formmail.pl HTTP/1.1" 200 927 "http//www.Blahblah.com/" "-"
...and the first one all within two (2) seconds.
24.147.198.154 - - [14/Sep/2003:20:16:39 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 936 "http//www.Blahblah.com/" "-"
209.107.77.84 - - [14/Sep/2003:20:16:40 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 912 "http//www.Blahblah.com/" "-"
66.204.69.3 - - [14/Sep/2003:20:16:41 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 942 "http//www.Blahblah.com/" "-"
209.247.34.204 - - [14/Sep/2003:20:16:41 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 939 "http//www.Blahblah.com/" "-"
Since these two events clearly are NOT a matter of happenstance, I thougth I pass this along.
Pendanticist.
I guess they figured if they broadened the scope of time this globally organized assault would somehow look less....organized. <he said facetiously>
202.103.216.170 - - [22/Sep/2003:01:41:38 -0700] "GET /cgi-bin/formmail.pl HTTP/1.0" 200 1135 "http//www.Blahblah.com/" "-"
202.103.216.170 - - [22/Sep/2003:01:41:54 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 942 "http//www.Blahblah.com/" "-"
194.243.112.69 - - [22/Sep/2003:01:41:59 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 936 "http//www.Blahblah.com/" "-"
66.30.27.104 - - [22/Sep/2003:01:42:01 -0700] "POST /cgi-bin/formmail.pl HTTP/1.1" 200 945 "http//www.Blahblah.com/" "-"
217.215.130.17 - - [22/Sep/2003:01:42:02 -0700] "POST /cgi-bin/formmail.pl HTTP/1.1" 200 948 "http//www.Blahblah.com/" "-"
Both 202.103.216.170 and 66.30.27.104 being the returnees.
Pendanticist.
>.. are you not seeing any GET attempts?
You'll notice there is only one GET during each attack. As to what, or why that is, I have no idea.
Must be some hierarchal reason for only one attacker requesting a GET? Something server-side perhaps?
...all in two (2) seconds.
65.247.155.207 - - [25/Sep/2003:02:28:24 -0700] "GET /cgi-bin/formmail.pl HTTP/1.0" 200 1135 "http*//www.Blahblah.com/" "-"
65.247.155.207 - - [25/Sep/2003:02:28:24 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 939 "http*//www.Blahblah.com/" "-"
65.105.130.53 - - [25/Sep/2003:02:28:25 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 933 "http*//www.Blahblah.com/" "-"
65.172.164.2 - - [25/Sep/2003:02:28:25 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 939 "http*//www.Blahblah.com/" "-"
206.15.234.214 - - [25/Sep/2003:02:28:26 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 942 "http*//www.Blahblah.com/" "-"
You'll notice that was also the case this time, a single GET and that the, uh, returnee is absent during this attack.
Pendanticist.
207.218.85.90 - - [26/Sep/2003:21:24:01 -0700] "GET /cgi-bin/formmail.pl HTTP/1.0" 200 1135 "http*//Blahblah.com/" "-"
207.218.85.90 - - [26/Sep/2003:21:24:05 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 942 "http*//Blahblah.com/" "-"
66.90.9.18 - - [26/Sep/2003:21:24:06 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 936 "http*//Blahblah.com/" "-"
63.114.100.241 - - [26/Sep/2003:21:24:08 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 939 "http*//Blahblah.com/" "-"
66.90.9.18 - - [26/Sep/2003:21:24:09 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 936 "http*//Blahblah.com/" "-"
These are all new players too.
Pendanticist.
205.158.63.45 - - [27/Sep/2003:11:09:59 -0700] "GET /cgi-bin/formmail.pl HTTP/1.1" 200 1147 "http*//Blahblah.com/" "-"
205.158.63.45 - - [27/Sep/2003:11:10:00 -0700] "POST /cgi-bin/formmail.pl HTTP/1.1" 200 945 "http*//Blahblah.com/" "-"
216.162.31.2 - - [27/Sep/2003:11:10:03 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 942 "http*//Blahblah.com/" "-"
198.143.64.80 - - [27/Sep/2003:11:10:04 -0700] "POST /cgi-bin/formmail.pl HTTP/1.0" 200 939 "http*//Blahblah.com/" "-"
65.223.72.41 - - [27/Sep/2003:11:10:05 -0700] "POST /cgi-bin/formmail.pl HTTP/1.1" 200 951 "http*//Blahblah.com/" "-"
Again with all new players and a single GET.
Enterprising individuals ain't they? <chuckle>
Pendanticist.
As for "why a mix of GET & POST" I think they are probably edging their bets, maybe each request represents an attempt to exploit a different brand/version of the script?
- Tony
Anyway, you really need to change that script's name or password protect the directory. That 200 is a magnet for them. No wonder they keep coming back to you so frequently.
as for the 200s... i, too, feed them 200's... why? because its a script specially set up to gather their info, log it, and report it... what they are doing is wrong and the only time someone should be accessing a formmail script is when they are manually accessing a site and posting via that site...
i've even several years worth of data on them doing this... started logging it the very first time they ever hit my site and i've never had a formmail script or even a guestbook... it is obvious that they have never visited my site to even see if there is a formmail script available... they're just hitting all the sites they can find and hoping to come across one that has a formmail script that is insecure...
they're just hitting all the sites they can find and hoping to come across one that has a formmail script that is insecure...A support rep at my hosting company told me that there are scripts available from hacking boards to do exactly that. It was during a discussion that resulted from a formmail script being hacked on my site. I "mysteriously" began receiving bounced emails that I never sent. Lots of 'em!
In response, I deleted formmail scripts on all of my sites and moved to a more secure solution.
Great input, but no time for me to reply tonight.
ZZZzzzzz.....
Pendanticist.
/claus
