[Snort-users] Nice formmail.pl probes

Chris Green cmg at ...671...
Thu Feb 28 10:29:06 EST 2002

Jim Forster <jforster at ...176...> writes:

> Anyone else seeing a formmail.pl search script running around your
> websites? 

It's right behind cmd.exe on things people try to access.  There are
tons of spam programs that will take advantage of it. 

> I was hit with it from users of pacbell.net, kscable.com,
> BFLO.splitrock.net, shreveport.la.da.uu.net, and tc.ph.cox.net last
> night, over 3 different class C's.  The subject was either "w00t
> x.com" or "www.x.com" (x being the domain it hit) going out to their
> addresses.  (nice their script left me contact info anyway) ;) I'm
> guesing worm, as 90% of the 'send to' addresses were the same AOL
> user - the other 10% were other AOL usernames.  

Not a worm, its people excited they can MAKE FUNNY FAST.  ( I would
have said money but I'm sick of getting bounces back to the
list/myself on stupid mail filters )

Aol accounts are just disposable
Chris Green <cmg at ...671...>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx

More information about the Snort-users mailing list