RE: [cobalt-users] Mail Bomb ... I'm stumped

["Dan Kriwitsky" <list1@xxxxxxxxxxxxxxxxxxxx>]

> 
> Both access and error logs report nothing of interest
> - no pl, cgi, asp or php being called at the time it
> started. Nothing in there but single html and image
> calls. Other logs, such as xfer, auth, fpexec, etc
> have nothing of note in them either.
> 
> Does anyone have the slightest clue how this can be happening?
> 

Are you sure you don't have an old FormMail.pl v1.6 on the server?
Search for FormMail.pl and/or FormMail.cgi

If someone forges your domain name as the return-path/From address and
sends to an address on your server it will bounce back to you. It's a
spammer trick.
-- 
Dan Kriwitsky

Please reply to the list only. Offlist replies are not read.