blog.noetech.com: Weird Site Activity

June 30, 2003

Weird Site Activity

For the past two nights I've been getting a lot of hits from one address, some where around 700 page views in less than an half hour. The user agent is listed as "Microsoft URL Control -6.00.8862".

Anyone have any clue what this is?

tommy at 04:56 AM in Weblog | TrackBack (0)

Comments

Tne first link seems to indicate that you are being probed by an infected IIS server.

http://www.geocrawler.com/mail/msg.php3?msg_id=7417103&list=4890

However, both of the of these two links indicate that the Microsoft URL control is more involved with the e-mail capability of your web server. The second link seems to be the more promising of the two.

http://www.psychedelix.com/agents1.html
http://www.sendfakemail.com/fakemail/antispam.html

My guess would be that either your web server is being scanned to see if a spammer can relay e-mail messages through it or your web site is being scanned for valid e-mail addresses where spam mail can be sent.

Posted by: TJN at June 30, 2003 05:52 AM

Looks like that user agent is used by lots of things. Apparently it the default when building a spider using some Microsoft tool. I'll see if it does it again tonight and if so, block the ip. Thanks for the links.

A forum that talks about it.

Posted by: Thomas Noe at June 30, 2003 12:33 PM