| << Running out | 2002 > October | Logic 5.4 and Audio Units >> |
Thursday, 10 October 2002
Microsoft URL Control ::
I noticed an interesting web browser (more accurately, “user agent”) in my web logs recently, “Microsoft URL Control.” All it seems interested in is audio files, e.g.
adsl-67-113-225-67.dsl.snfc21.pacbell.net - - [12/Sep/2002:01:33:39 -0400] "GET /doug/audio/960614DrmDst.wav HTTP/1.1" 404 307 "-" "Microsoft URL Control - 6.00.8862" adsl-67-113-225-67.dsl.snfc21.pacbell.net - - [12/Sep/2002:01:33:39 -0400] "GET /doug/audio/950515Ting.wav HTTP/1.1" 404 305 "-" "Microsoft URL Control - 6.00.8862" adsl-67-113-225-67.dsl.snfc21.pacbell.net - - [12/Sep/2002:01:33:39 -0400] "GET /doug/audio/950413Em.wav HTTP/1.1" 404 303 "-" "Microsoft URL Control - 6.00.8862" adsl-67-113-225-70.dsl.snfc21.pacbell.net - - [28/Sep/2002:22:54:31 -0400] "GET /doug/audio/AccidentalBeauties.mp3 HTTP/1.1" 206 51 "-" "Microsoft URL Control - 6.00.8862" adsl-67-113-225-70.dsl.snfc21.pacbell.net - - [28/Sep/2002:22:54:32 -0400] "GET /doug/audio/AccidentalBeauties.mp3 HTTP/1.1" 206 4095 "-" "Microsoft URL Control - 6.00.8862" adsl-67-113-225-70.dsl.snfc21.pacbell.net - - [28/Sep/2002:22:54:32 -0400] "GET /doug/audio/AccidentalBeauties.mp3 HTTP/1.1" 206 128 "-" "Microsoft URL Control - 6.00.8862" adsl-67-113-225-70.dsl.snfc21.pacbell.net - - [28/Sep/2002:22:54:33 -0400] "GET /doug/audio/InvisiblePeople.mp3 HTTP/1.1" 206 51 "-" "Microsoft URL Control - 6.00.8862" adsl-67-113-225-70.dsl.snfc21.pacbell.net - - [28/Sep/2002:22:54:33 -0400] "GET /doug/audio/InvisiblePeople.mp3 HTTP/1.1" 206 4095 "-" "Microsoft URL Control - 6.00.8862" adsl-67-113-225-70.dsl.snfc21.pacbell.net - - [28/Sep/2002:22:54:34 -0400] " GET /doug/audio/InvisiblePeople.mp3 HTTP/1.1" 206 128 "-" "Microsoft URL Control - 6.00.8862"
At first I was concerned that it was sucking up bandwidth by repeatedly downloading the same MP3. But no, it seems to be able to do its business by only looking at the first 4K or so of the audio file. That’s only a quarter second of audio at 128 kbps.
Who would be interested in that? A Google search for “Microsoft URL Control” came up with some discussions about it possibly being an email address collector, or probing a CGI script security hole. No one seems to know, and it doesn’t appear that anyone has noticed it being particularly interested in audio.
My theory is that the RIAA is scouring the web for MP3's, looking at the ID3 tags (title, artist, etc.) and comparing to a database. It would be fun to make an MP3 with tags that suggest that it’s a popular song while the content is actually a diatribe against the RIAA. It’s been awhile since I’ve gotten an interesting letter from a lawyer.
Or maybe it’s just a programmer in San Francisco who’s got a bot out crawling the net looking for interesting music. Whoever it is has some stale URL’s in their database (note the 404's).
| << Running out | 2002 > October | Logic 5.4 and Audio Units >> |
5 comments
This is a bot harvesting e-mail addresses.
At my website, the company behind this runs [link].
They sell their harvested e-mails mainly to Chinese spammers.
– Anonymous, Thursday, 22 January 2004, 06:48 PST
My understanding is that “Microsoft URL Control” is a piece of Windows system software (an ActiveX control? dunno, I’m a Mac guy). So I imagine it’s being used by any number of programmers for any number of purposes. I’ve banned it from this site.
– Doug Wyatt, Thursday, 22 January 2004, 21:59 PST
i feed hin with some billions of faked e-mail adresses using a modified version of a little Perlscript called spamkiller.
– Wolf, Sunday, 25 January 2004, 10:13 PST
In my case “Microsoft URL Control” requested an HTML file that isn’t linked to on any of my site’s pages. In other words, “Microsoft URL Control” must reside on my pc itself in order to track this file. This seems to confirm comment number 2.
– emdo, Sunday, 25 April 2004, 13:50 PDT
Just read the following on: [link]
“Just to ley you know, programmers (e.g. visual Basic) have
access to a number of controls which can be used in the
development of software applications.
Such controls include a web browser control, or something called
the Internet Transfer Control (Inet) through which web
pages and their html code can be downloaded.
When an application/program using the above control accesses
your page then it leaves the “Microsoft URL Control” footprint.”
Tried it out and found it’s true!
emdo
– Anonymous, Sunday, 25 April 2004, 13:56 PDT
This discussion has been closed. Thanks to those who participated.