What are they doing?

[toolman]

63.199.200.77 - - [09/Aug/2001:23:18:14 -0400] "GET /cgi-bin/formmail.pl?email=[e-mail]&recipient=[e-mail]&subject=www.XXXXX.com/cgi-bin/formmail.pl&=www.XXXXXX.com/cgi-bin/formmail.pl HTTP/1.0" 200 404 "-" "SSM Agent 1.0"

Very suspicious wouldn't you say? Never came into the site (as far as I can tell), just dropped me a little note.

Isn't that out your way LM?

[awoyo]

Is this the UA? adsl-63-199-200-77.dsl.lsan03.pacbell.net

I believe it's SPAM, possibly made to look like a sorry attempt at an FormMail exploit. I've seen it from another company (no product relation and sans formmail reference) who spammed my User Agent field. Of course the first thing I did when I saw it was visit their web site. Exactly what they wanted me to do.

Btw, in case you use it, there's a security upgrade for FormMail at his web site.