I have what appears to me to be a spammer using MY formmail.cgi script to
send spam out of my server today... here are a couple entries from my log
file.
204.212.202.25 - - [25/Apr/2001:02:54:49 -0400] "GET
/cgi-bin/formmail.pl?[EMAIL PROTECTED]&[EMAIL PROTECTED],
[EMAIL PROTECTED],&subject=Hey+sweety!+++++++++++++++++++++++++++++++++++++++++++
++
lhzqr&message=Hey+join+my+chat+click+<+a+href%3D"OIJASDFLHWEARLJHAWEKRJHAWLE
RHWRLHWAHERLWAELRALWHERLAWEKJHKNBEKARBGJEKLRJGBAKERJBGLAEKJRBGKALEJGBKLEJRBG
[EMAIL PROTECTED]">here</a>!<p><p><p><p><p><p><p><p><p><p>cqsz
HTTP/1.0" 200 837 "-" "Microsoft URL Control - 6.00.8169"
204.212.202.25 - - [25/Apr/2001:02:58:33 -0400] "GET
/cgi-bin/formmail.pl?[EMAIL PROTECTED]&[EMAIL PROTECTED]
om,[EMAIL PROTECTED],&subject=Hey+sweety!+++++++++++++++++++++++++++++++++++
++++++++++
elpqu&message=Hey+join+my+chat+click+<+a+href%3D"OIJASDFLHWEARLJHAWEKRJHAWLE
RHWRLHWAHERLWAELRALWHERLAWEKJHKNBEKARBGJEKLRJGBAKERJBGLAEKJRBGKALEJGBKLEJRBG
[EMAIL PROTECTED]">here</a>!<p><p><p><p><p><p><p><p><p><p>gdst
HTTP/1.0" 200 845 "-" "Microsoft URL Control - 6.00.8169"
I have since removed the cgi script so this can't happen at the moment. Can
someone tell me where exactly these are coming from and what web pages they
are referring to? Do you think the IP address is bogus? Any other helpful
suggestions appreciated!
_______________________________________________
SpamCop-Help mailing list
[EMAIL PROTECTED]
http://news.spamcop.net/mailman/listinfo/spamcop-help
