/cgi/addon_csf.cgi and the formmail log

[AndyB78]

Hello,

I have a spammer situation on a server and PSM installed a formmail logger. However most entries have some connection to a "/cgi/addon_csf.cgi". There is an addon_csf.cgi in /usr but why would this appear so frequently in the formmail log?

I have searched the entire /home folder plus the /tmp for this (for the case when this was the spamming script) but there is none...

Regards!

 

[rhenderson]

Check in /usr/local/cpanel/whostmgr/docroot/cgi/ it is part of CSF firewall.

 

[AndyB78]

Yes, I know but why would it appear in my formmail.log like it sent mail?!

 

[rhenderson]

You might ask over at configserver.com forums. I would assume it is a check CSF is making to be able to notify you if some kind of spam script is running.