[Nms-cgi-devel] you know who your friends are

[Nicholas C. <ni...@un...>]

For some reason I'm tailing the ccl4.org error log. I spotted this:

[Sat Feb  1 11:10:54 2003] [error] [client 172.130.218.101] script not found or unable to stat: /data/vhost/www.ccl4.org/cgi-bin/formmail.pl
[Sat Feb  1 11:10:57 2003] [error] [client 172.130.218.101] script not found or unable to stat: /data/vhost/www.ccl4.org/cgi-bin/FormMail.pl
[Sat Feb  1 11:11:07 2003] [error] [client 172.130.218.101] script not found or unable to stat: /data/vhost/www.ccl4.org/cgi-bin/formmail.cgi
[Sat Feb  1 11:11:17 2003] [error] [client 172.130.218.101] script not found or unable to stat: /data/vhost/www.ccl4.org/cgi-bin/FormMail.cgi

whois says that 172.130.218.101 happens to be an AOL netblock

Interesting, but not surprising. A brute force attempt to try to find a
FormMail script to exploit. There are no other ccl4.org hits from that host.

Now I know what to look for, it seems that www.flirble.org has had 1670
attempts since June 2001.

Nicholas Clark