Http scanning for cgi based mail-relays.

From: measl@mfn.org
Date: Wed Jul 18 2001 - 06:17:03 PDT

Next message: w1re p4ir: ""Code Red" worm questions"

Previous message: Elliott Perrin: "Packets destined for ports 6970 and 6972"
Next in thread: Chip McClure: "Re: Http scanning for cgi based mail-relays."
Reply: Chip McClure: "Re: Http scanning for cgi based mail-relays."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Greetings.

	Below is an excerpt from one of our http server logs.  Rather
cute, ya?  Just for the record, the skr1pt k1dd1e
("truzoom@aol.com") doing the scanning is still online with AOL, even
though (1) AOL was sent copies of email from this kid acknowledging the
scans were his/hers; (b) AOL recieved copies of the full logs; (c) AOL
sent us their standard boilerplate "Thanks for reporting this, we have
dealt with it according to our AUP".

-- 
Yours, 
J.A. Terranson
sysadmin@mfn.org

==========================================================================
lsanca1-ar9-189-190.lsanca1.dsl.gtei.net - - [17/Jul/2001:22:45:56 -0500]
"GET /cgi-bin/formmail.cgi?email=eroticascanner@aol.com&recipient=
truzoom@aol.com&subject=www.mfn.org/cgi-bin/formmail.cgi&msg=Hiya
HTTP/1.0" 404 282 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"



----------------------------------------------------------------------------


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see:

http://aris.securityfocus.com

Next message: w1re p4ir: ""Code Red" worm questions"
Previous message: Elliott Perrin: "Packets destined for ports 6970 and 6972"
Next in thread: Chip McClure: "Re: Http scanning for cgi based mail-relays."
Reply: Chip McClure: "Re: Http scanning for cgi based mail-relays."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Jul 18 2001 - 09:57:56 PDT