Hi Stefaan, > I have a server with a lot of name-based virtual hosts. On > one of those sites the formmail.pl script is being abused, > a client is using an unsecure script. How can I find out > on what site this is? There is a security-bug in the formmail.pl-script from matt wright. You can use this script as an kind of "smtp-relay-server". I've found an secure one located at ftp://ftp.monkeys.com/pub/formmail/ . Regards, Paddy