Attack?

L

Logan

Perch
I've got the following lines in my log files several times yesterday...

2004-04-02 00:34:00 218.247.190.93 - W3SVC405 FORM-TI1SWLDILP <ip> 80 GET /cgi-sys/formmail.pl - 404 3 4184 156 0 HTTP/1.0 - - http://www.mydomain.com/

Is this some sort of attack, because this formmail file does not exist on my site so I don't know why anyone would try to access it, unless it was some sort fo random attempt to break in or something. (I replaced the server/site IP with "<ip>" to protect the innocent.)
 
Could be someone scanning for mailforms that are abusable so they can send spam through them or something?
I don't really know, but I think something along that line is likely.
 
yes that is a standard form mail scanner that someone was looking to expliot.
 
You must log in or register to reply here.
Back
Top