That one is a spammer looking for a open relay CGI. I'm sure you've seen the spam that begins "Below are the results of your feedback form..."
--Daryl ----- Original Message ----- From: "Adaryl Wakefield" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, April 15, 2002 12:53 PM Subject: Re: [KCFusion] OT: browser type > Ahhhh I was wondering what that /cgi-bin/formmail.pl thing was that kept > showing up. What is that exactly and what are they after, and should I be > overly worried? > A. > > ----- Original Message ----- > From: "Daryl Banttari" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, April 15, 2002 10:36 AM > Subject: Re: [KCFusion] OT: browser type > > > > Probably a Java-based vulnerability scanner. If your site is linked a > lot, > > expect /many/ of these sorts of attempts every day. > > > > Things like: (a sample of the most popular vulnerability scans from my > > logs) > > /_vti_bin/_vti_aut/author.exe > > /cgi-bin/formmail.pl > > /msoffice/cltreq.asp > > /_vti_bin/owssvr.dll > > /cgi-bin/formmail.cgi > > /cgi-local/formmail.pl > > /cgi-local/formmail.cgi > > /cgibin/formmail.cgi > > /cgibin/formmail.pl > > > > And, of course, all of the usual CodeRed and CRII scans. (Which are > blocked > > by my firewall software and never make it into my logs.) > > > > --Daryl > > > > ----- Original Message ----- > > From: "Keith Purtell" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Monday, April 15, 2002 9:03 AM > > Subject: RE: [KCFusion] OT: browser type > > > > > > > Well, the page request came from an overseas IP address, and they were > > > trying to access a page that might contain information about > > administrators, > > > so I was suspicious. Thanks for the info. > > > > > > Keith Purtell, Web/Network Administrator > > > VantageMed Operations (Kansas City) > > > Email: [EMAIL PROTECTED] > > > > > > CONFIDENTIALITY NOTICE: This email message, including any attachments, > is > > > for the sole use of the intended recipient(s) and may contain > confidential > > > and privileged information. Any unauthorized review, use, disclosure or > > > distribution is prohibited. If you are not the intended recipient, > please > > > contact the sender by reply email and destroy all copies of the original > > > message. > > > > > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On > > > Behalf Of Ryan Hartwich > > > Sent: Monday, April 15, 2002 8:55 AM > > > To: [EMAIL PROTECTED] > > > Subject: RE: [KCFusion] OT: browser type > > > > > > > > > Java 1.3.0 is one of the current standard versions of the java virtual > > > machine. I believe the numbers are the same as what is installed by > > > Netscape 6/6.2 and is or was one of the versions that Jrun and the betas > > > of CF MX uses. You might be seeing another server trying to pull a page > > > versus a browser, or just a funky Unix browser like Mozilla that is > > > highly dependent on Java. > > > > > > Ryan > > > > > > > > > > > > > > > > > > ______________________________________________________________________ > > > The KCFusion.org list and website is hosted by Humankind Systems, Inc. > > > List Archives........ http://www.mail-archive.com/cf-list@kcfusion.org > > > Questions, Comments or Glowing Praise.. mailto:[EMAIL PROTECTED] > > > To Subscribe.................... mailto:[EMAIL PROTECTED] > > > To Unsubscribe................ mailto:[EMAIL PROTECTED] > > > > > > > > > > > > > > ______________________________________________________________________ > > The KCFusion.org list and website is hosted by Humankind Systems, Inc. > > List Archives........ http://www.mail-archive.com/cf-list@kcfusion.org > > Questions, Comments or Glowing Praise.. mailto:[EMAIL PROTECTED] > > To Subscribe.................... mailto:[EMAIL PROTECTED] > > To Unsubscribe................ mailto:[EMAIL PROTECTED] > > > > > > ______________________________________________________________________ > The KCFusion.org list and website is hosted by Humankind Systems, Inc. > List Archives........ http://www.mail-archive.com/cf-list@kcfusion.org > Questions, Comments or Glowing Praise.. mailto:[EMAIL PROTECTED] > To Subscribe.................... mailto:[EMAIL PROTECTED] > To Unsubscribe................ mailto:[EMAIL PROTECTED] > > ______________________________________________________________________ The KCFusion.org list and website is hosted by Humankind Systems, Inc. List Archives........ http://www.mail-archive.com/cf-list@kcfusion.org Questions, Comments or Glowing Praise.. mailto:[EMAIL PROTECTED] To Subscribe.................... mailto:[EMAIL PROTECTED] To Unsubscribe................ mailto:[EMAIL PROTECTED]
