A couple of days ago I put several IP addresses in the IP Deny Manager and it currently shows this:

Current IP Addresses being blocked
200.58.161.146
148.241.2.17
207.50.195.162
200.174.69.242

However, today my access log shows that one of the IP addresses successfully accessed my site. Here is the log entry:

200.58.161.146 - - [21/May/2003:16:44:00 +0000] "POST /cgi-sys/formmail.pl HTTP/1.0" 200 93 "http://rncsoftware.net" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; AIRF; .NET CLR 1.0.3705)"

I do not use the /cgi-sys/formmail.pl FormMail script but apparently it is being targetted by spammers. I happended to discover this when I received a message from the mail system about a missing or malformed domain on a message I never sent.

I was attempting to block the spammer until the problem could be addressed but either the Deny IP doesn't work or maybe it just doesn't work for stuff in CGI-SYS.

Does anyone know?

My host is using:
cPanel Version: 6.4.2-RELEASE
cPanel Build: 5
Operating System: Linux
Kernel Version: 2.4.18-27.8.0
Apache Version: 1.3.27 (Unix)

Regards.

cPanel.net Support Ticket Number:

cPanel.net Support Ticket Number: