On Tuesday 06 July 2004 20:30, Pim Bliek wrote: > Hi, > > I got this in my logs: > > 12.135.225.155 - - [30/Jun/2004:13:41:07 +0200] "POST > /cgi-bin/formmail.pl HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 > foo.bar > 205.155.196.131 - - [30/Jun/2004:13:41:17 +0200] "POST > /cgi-bin/contact.cgi HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 > foo.bar > 209.181.61.81 - - [30/Jun/2004:13:41:21 +0200] "POST > /cgi-bin/mailform.pl HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 > foo.bar > 209.188.66.29 - - [30/Jun/2004:13:41:24 +0200] "POST > /cgi-bin/formmail.cgi HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 1 > foo.bar > 216.11.71.2 - - [30/Jun/2004:13:41:25 +0200] "POST > /cgi-bin/FormMail.pl HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 > foo.bar > 193.224.42.8 - - [30/Jun/2004:13:41:27 +0200] "POST /mail.cgi > HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 foo.bar > 213.142.20.29 - - [30/Jun/2004:13:41:32 +0200] "POST /cgi-bin/fmail.pl > HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 foo.bar > 205.160.241.50 - - [30/Jun/2004:13:41:35 +0200] "POST > /cgi-bin/form.cgi HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 > foo.bar > 67.69.34.194 - - [30/Jun/2004:13:41:37 +0200] "POST > /cgi-bin/contact.pl HTTP/1.1" 404 14523 "http://www.foo.bar/"; "-" 1 > foo.bar > 212.55.154.69 - - [30/Jun/2004:13:41:43 +0200] "POST /cgi/formmail > HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 1 foo.bar > 206.107.198.2 - - [30/Jun/2004:13:41:47 +0200] "POST /cgi-bin/mail.cgi > HTTP/1.1" 404 14523 "http://www.foo.bar/"; "-" 1 foo.bar > 67.98.236.153 - - [30/Jun/2004:13:41:49 +0200] "POST /formmail.pl > HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 foo.bar > 195.77.24.14 - - [30/Jun/2004:13:41:51 +0200] "POST > /cgi-bin/feedback.cgi HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 > foo.bar > 209.235.241.82 - - [30/Jun/2004:13:41:53 +0200] "POST /contact.cgi > HTTP/1.1" 404 14523 "http://www.foo.bar/"; "-" 1 foo.bar > 209.2.108.2 - - [30/Jun/2004:13:41:58 +0200] "POST /form-bin/deliver > HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 foo.bar > 80.16.106.83 - - [30/Jun/2004:13:41:59 +0200] "POST > /cgi-bin/cgiemail/contact.txt HTTP/1.0" 404 14523 > "http://www.foo.bar/"; "-" 0 foo.bar > 207.44.198.13 - - [30/Jun/2004:13:42:04 +0200] "POST /cgi-bin/form.pl > HTTP/1.1" 404 14523 "http://www.foo.bar/"; "-" 1 foo.bar > 193.146.142.66 - - [30/Jun/2004:13:42:05 +0200] "POST > /cgi-bin/mailform.cgi HTTP/1.1" 404 14523 "http://www.foo.bar/"; "-" 0 > foo.bar > 65.77.28.122 - - [30/Jun/2004:13:42:07 +0200] "POST > /cgi-bin/feedback.pl HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 > foo.bar > 64.56.118.178 - - [30/Jun/2004:13:42:09 +0200] "POST /cgi-bin/mail.pl > HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 0 foo.bar > 207.68.98.5 - - [30/Jun/2004:13:42:11 +0200] "POST /cgi-bin/sender.pl > HTTP/1.0" 404 14523 "http://www.foo.bar/"; "-" 1 foo.bar > 12.104.198.106 - - [30/Jun/2004:13:42:12 +0200] "POST > /cgi-bin/mailer/mailer.cgi HTTP/1.0" 404 14523 "http://www.foo.bar/"; > "-" 0 foo.bar > > > > Apparently all from different IP's but certainly coordinated, because > it is on the same time, same kind of requests. > > Anyone knows how this can be done? Is there any possibility to trace > who might have done this? > > Best regards, > Pim Bliek
Dont tell me you are running an old version of that formmail script ! Robbert -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
