Results 1 to 5 of 5
  1. #1
    ABW Veteran Mr. Sal's Avatar
    Join Date
    January 18th, 2005
    Posts
    6,795
    Angry Spammers IP Address I collect today.
    These are some of the Spammers IP Address I collect today.

    In just a couple of minutes, they tried to find any e-mail address on my site by going from /cgi-bin/contact.pl to /scripts/formmail.pl

    Nice try, but they didn't get this time.

    I decided to post these IP's, just in case anyone is interested in blocking those IP's from their sites.

    As far as I can see, they're trying any file name and any directory, in order to find a email address they can later use to Spam the hell out of it.

    =======================
    ON YOUR SITE, xxxxxxx.Com
    ERROR CODE 404 MISSING URL
    OCCURRED ON Fri Jul 22 01:59:16 2005
    /cgi-bin/formmail.pl
    USER AT IP Address 213.223.67.45
    USER Remote Port ....
    Referring URL http : / / www. xxxxxxx.Com/
    Logged On To .........
    By The Name ..........
    THE BROWSER WAS ........

    =======================
    /cgi-bin/kontakt.pl USER AT IP Address 148.244.150.52
    /cgi-bin/contact.pl USER AT IP Address 69.29.7.18
    /cgi-bin/mailform.pl USER AT IP Address 212.0.138.90
    /cgi-bin/BFormMail.pl USER AT IP Address 64.71.177.72
    /cgi-bin/cgiemail/forms/order.txt USER AT IP Address 62.81.214.42
    /cgi-bin/fmail.pl USER AT IP Address 64.95.78.122
    /cgi-bin/formmail.cgi USER AT IP Address 72.3.132.162
    /cgi-bin/library/comments/comments.pl USER AT IP Address 212.138.47.14
    /cgi-bin/ezformml.cgi USER AT IP Address 211.75.91.2
    /cgi-bin/formmail.cgi USER AT IP Address 213.173.134.71
    /cgi-bin/formmail.pl USER AT IP Address 213.223.67.45
    /cgi-bin/mailform.pl USER AT IP Address 62.133.42.75
    /cgi-bin/BFormMail.pl USER AT IP Address 213.249.155.231
    /cgi-bin/cgiemail/forms/order.txt USER AT IP Address 207.248.240.118
    /cgi-bin/fmail.pl USER AT IP Address 200.77.144.246
    /cgi-bin/formmail.cgi USER AT IP Address 200.93.68.157
    /cgi-bin/formmail/formmail.cgi USER AT IP Address 63.230.254.29
    /cgi-bin/library/comments/comments.pl USER AT IP Address 167.206.204.68
    /cgi-bin/ezformml.cgi USER AT IP Address 167.206.204.69
    /cgi-bin/FormMail.cgi USER AT IP Address 129.44.134.186
    /cgi-bin/FormMail.cgi USER AT IP Address 200.115.153.114
    /cgi-bin/mail.pl USER AT IP Address 194.90.18.35
    /cgi-bin/form.pl USER AT IP Address 65.164.90.166
    /cgi-bin/FormMail.pl USER AT IP Address 213.223.67.45
    /cgi-bin/contact.cgi USER AT IP Address 200.115.153.114
    /cgi-bin/formmail USER AT IP Address 167.206.204.69
    /cgi-bin/form.cgi USER AT IP Address 65.164.90.166
    /cgi-bin/mailform USER AT IP Address 63.230.254.28
    /cgi-bin/yform.cgi USER AT IP Address 81.240.255.226
    /cgi-bin/tellafriend.cgi USER AT IP Address 129.44.134.186
    /cgi-bin/feedback.cgi USER AT IP Address 62.37.236.193
    /cgi-bin/feedback.pl USER AT IP Address 62.133.42.75
    /cgi-bin/mailer.cgi USER AT IP Address 203.215.77.161
    /cgi-bin/friends.cgi USER AT IP Address 205.208.226.61
    /cgi-bin/nether-mail.pl USER AT IP Address 200.115.153.114
    /cgi-bin/mailto.cgi USER AT IP Address 212.150.75.18
    /cgi-bin/mail.cgi USER AT IP Address 209.9.208.7
    /cgi-bin/forms.pl USER AT IP Address 63.230.254.28
    /cgi-bin/formmail/formmail.pl USER AT IP Address 195.149.138.30
    /cgi-bin/mailto.pl USER AT IP Address 213.223.67.45
    /cgi-bin/email.pl USER AT IP Address 205.208.226.61
    /cgi-bin/formmail2.pl USER AT IP Address 81.240.255.226
    /cgi-bin/mailform.cgi USER AT IP Address 200.93.68.157
    /cgi-bin/tmail/tmail.cgi USER AT IP Address 212.150.75.18
    /cgi-bin/chfeedback.pl USER AT IP Address 63.230.254.28
    /cgi-bin/register.pl USER AT IP Address 211.75.91.2
    /cgi-bin/easyrefer.cgi USER AT IP Address 63.230.254.28
    /cgi-bin/vlog.cgi USER AT IP Address 200.93.68.157
    /cgi-bin/anymail.cgi USER AT IP Address 148.244.150.52
    /cgi-bin/fm.pl USER AT IP Address 200.77.144.246
    /cgi-bin/FormMail USER AT IP Address 200.93.68.157
    /cgi-bin/eforms.cgi USER AT IP Address 195.169.128.119
    /cgi-bin/eforms.pl USER AT IP Address 81.240.255.226
    /cgi-bin/uniform USER AT IP Address 66.207.120.227
    /cgi-bin/uniform USER AT IP Address 213.249.155.231
    /cgi-bin/referral.cgi USER AT IP Address 62.133.42.75
    /cgi-bin/sender.pl USER AT IP Address 167.206.204.68
    /cgi-bin/contactus.cgi USER AT IP Address 194.90.18.35
    /cgi-bin/email.cgi USER AT IP Address 200.93.68.157
    /cgi-bin/mvforms.cgi USER AT IP Address 129.44.134.186
    /cgi-bin/mvforms.cgi USER AT IP Address 213.223.67.45
    /cgi-bin-local/FormMail.pl USER AT IP Address 194.151.36.170
    /cgi-bin/cgiemail/contact.txt USER AT IP Address 81.240.255.226
    /cgi-bin/contact/contact.cgi USER AT IP Address 65.164.90.166
    /cgi-bin/sendform.cgi USER AT IP Address 12.42.48.204
    /cgi-bin/order.cgi USER AT IP Address 200.77.144.246
    /cgi-bin/mailer.pl USER AT IP Address 66.45.254.226
    /cgi-bin/sendform.cgi USER AT IP Address 129.44.134.186
    /cgi-bin/formmail1.pl USER AT IP Address 195.113.148.193
    /cgi-bin/form/form.cgi USER AT IP Address 195.113.148.193
    /cgi-bin/wwrmail.pl USER AT IP Address 194.151.36.170
    /cgi-bin/bformmail.pl USER AT IP Address 213.223.67.45
    /cgi-bin/cgiemail/text.txt USER AT IP Address 195.113.148.193
    /cgi-bin/mailer/mailer.cgi USER AT IP Address 69.29.7.18
    /cgi-bin/gistelform.pl USER AT IP Address 63.230.254.29
    /cgi-bin/form-mail.cgi USER AT IP Address 64.95.78.122
    /cgi-bin/send.cgi USER AT IP Address 148.244.150.52
    /cgi-bin/GMFormMail.pl USER AT IP Address 213.249.155.231
    /cgi-bin/form1.cgi USER AT IP Address 195.149.138.30
    /cgi-bin/mail/mail.cgi USER AT IP Address 207.248.240.118
    /cgi-bin/formmail/FormMail.pl USER AT IP Address 62.37.236.193

    /cgibin/formmailes.cgi USER AT IP Address 66.45.254.226

    /cgi/formmail USER AT IP Address 69.29.7.18
    /cgi/FormMail.pl USER AT IP Address 194.90.18.35
    /cgi/contact.cgi USER AT IP Address 212.150.75.18
    /cgi/formmail.pl USER AT IP Address 64.95.78.122

    /email.cgi USER AT IP Address 12.42.48.204

    /mail.cgi USER AT IP Address 63.230.254.28

    /formmail.cgi USER AT IP Address 64.95.78.122
    /formmail.pl USER AT IP Address 81.240.255.226
    /formmail/formmail.cgi USER AT IP Address 194.151.36.170
    /FormMail.pl USER AT IP Address 12.42.48.204
    /FormMail.cgi USER AT IP Address 213.249.155.231
    /FormMail.cgi USER AT IP Address 66.207.120.227

    /local-cgi/ToFM/tomail.cgi USER AT IP Address 167.206.204.69

    /contact.cgi USER AT IP Address 205.208.226.61

    /scripts/formmail.pl USER AT IP Address 207.248.240.118

    /dp_tellafriend/scripts/tellafriend.cgi USER AT IP Address 63.230.254.28

    =======================

    And some people still wonder, why we don't put a email address on our sites any longer.

    ...

  2. #2
    Moderator MichaelColey's Avatar
    Join Date
    January 18th, 2005
    Location
    Mansfield, TX
    Posts
    16,232
    Sal,

    Generally people looking for vulnerabilities will go through a variety of proxy servers to avoid detection. That's why you'll see a lot of IP address. It's often just one person.
    Michael Coley
    Amazing-Bargains.com
     Affiliate Tips | Merchant Best Practices | Affiliate Friendly? | Couponing | CPA Networks? | ABW Tips | Activating Affiliates
    "Education is the most powerful weapon which you can use to change the world." Nelson Mandela

  3. #3
    ABW Adviser Panel Dynamoo's Avatar
    Join Date
    January 18th, 2005
    Location
    Opposite the Slough of Despond
    Posts
    5,465
    In fact with FormMail, the originating IP address could be completely faked as the hacker will actually get a response through the FormMail program sending them an email, rather than a response directly from their connected session.
    Innovative advertising with Slimeware Corporation and Telephore. Mail-order fuel with Petrol Direct.

  4. #4
    Full Member garystarling's Avatar
    Join Date
    January 18th, 2005
    Posts
    277
    Why not have some fun - there is a formmail.cgi trap you can set that pretends to work, accumulates the evidence and then tells their ISP what they are trying to do.

    http://www.home-port.net/fmreport/

  5. #5
    Full Member asr_guy's Avatar
    Join Date
    June 12th, 2005
    Location
    Canada
    Posts
    310
    It's probably a bot anyway - I doubt there's a real person at the other end poking around. Spamcop.net is good at taking care of all the spammer reporting for you.

  6. Newsletter Signup

+ Reply to Thread

Similar Threads

  1. Replies: 0
    Last Post: January 14th, 2014, 11:22 AM
  2. Go-Collect?
    By purplebear in forum Commission Junction - CJ
    Replies: 4
    Last Post: September 16th, 2006, 08:25 PM
  3. Thanks Go Collect!
    By Ebudae in forum Midnight Cafe'
    Replies: 0
    Last Post: February 21st, 2002, 03:32 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •