RE: [cobalt-users] [OT] Email spam

["Andy Jacobs" <andy@xxxxxxxxxxxxxx>]

> -----Original Message-----
> From: cobalt-users-admin@xxxxxxxxxxxxxxx
> [mailto:cobalt-users-admin@xxxxxxxxxxxxxxx]On Behalf Of Andy Clyde,
> oxfordmusic.net
> Sent: 27 August 2002 12:09
> To: cobalt-users@xxxxxxxxxxxxxxx
> Subject: Re: [cobalt-users] [OT] Email spam
>
>
>
> >
> >
> > > -----Original Message-----
> > >
> > >
> > > very off-topic i know but if someone could point me in the right place
> for
> > > an answer i'd be most grateful, otherwise just delete...
> > >
> > > one of my clients has had his email hijacked for spam about
> Viagra. i've
> > > checked our server and it doesn't seem to be coming through us (i ran
> 'cat
> > > maillog | grep viagra' and nothing showed up, plus our IP does not
> feature
> > > in the email headers). is there anything we can do about this, or are
> they
> > > just forging the email header and we have to put up with it. we only
> found
> > > out coz our client got 1000 bounce back emails this morning.
> > >
> > > much obliged
> >
> > They're not using the FormMail exploit are they?
> >
>
> wouldn't that still show up in the maillog?

I'm not sure about that.  It would show up in the web logs for the site
though.  Something like this:

http://www.domain.com/cgi-bin/formmail.pl?recipient=fred@xxxxxxxxxxxxxxxxxx&;
message=Buy%20viagra