requesting form mail withan email address?

[mack]

dnvr-dsl-gw22-poolb251.dnvr.uswest.net - - [05/May/2002:23:17:35 +0100] "GET /cgi-bin/formmail.pl?recipient=[e-mail]&subject=www.alistair-mcintyre.com/cgi-bin/formmail.pl&email=[e-mail]&=www.alistair-mcintyre.com/cgi-bin/formmail.pl HTTP/1.1" 404 - "-" "Microsoft URL Control - 6.00.8862"

The url is mine but why is their an email address in there and why it it requesting formail???

[Key_Master]

If /cgi-bin/formmail.pl exists on your server, it is being used to send spam mail to those e-mail addresses. Rename formmail.pl to something else or remove it altogether.

[mack]

right thanks... how do i remove it... it is a remote server hosted by uk2.net???

[Key_Master]

If you have control over your cgi-bin simply go in and delete it. Otherwise, contact your host and have them delete it for you.

Upon closer inspection, I just noticed that your server gave a 404 error. Maybe formmail.pl doesn't exist on your server after all.

[mack]

yep i saw that also... the 404 would mean that the spider was unable to obtain what it requested... this is a good thing because customer suport at uk2.net is aparently very bad.

[lioness]

I have a similar message in my referral logs. However, there is no "GET". Does that have any significance? I also got a 404 error, which I would expect, because I am not using formmail.pl, and I've checked to make sure my provider didn't put one there. The message also came from an AOL user.

[diddlydazz]

If you are using UK2.NET then you don't have to worry

Your FormMail should be at [cgi.uk2.net...]

your formmail program is on THEIR servers and it has been renamed, also the form only works if the recipient is a UK2 domain, so dont worry.

dazz

(edited by: diddlydazz at 11:04 pm (utc) on May 21, 2002)

[lioness]

UK2.net??

[diddlydazz]

Lioness,

I was referring to Mack's problem, he is hosted on UK2 servers.

The people who do this normally send a test, and send theirselves an email first to confirm that the formmail program worked, so if it is the first attempt then the recipient address maybe the spammers address testing to see if it is effective.

hence it is normally a FREE email address

dazz

[gellyfish]

The Matt Wright FormMail program is basically insecure. Even the most recently updated version has problems. The version that we have made available at:

[nms-cgi.sourceforge.net...]

should be a drop in replacement (after the configuration) and fixes all of the problems with anonymous spamming that are noted in other similar programs.

If you have any questions about installing or configuring the program please feel free to email the support mailling list at:

[e-mail]

/J\