people seem to be scanning our servers looking for exploitable formmail scripts using Microsoft URL control. is there a way to block people from using this? has anyone come across this? any input is greatly appreciated. we are running mainly redhat and cobalt servers.

I don't think it is a good idea to block Microsoft URL Control completely as it might be used for legitimate things.

If formmail scanning happens, you should report the IP. If it happens again, block the IP, not the user agent.

RewriteCond %{HTTP_USER_AGENT} ^microsoft.url.control [NC]
RewriteRule ^.*$ - [F]


I am using the above code to block microsoft url control user agent. I don't really know what it is. Can someone explain what microsoft url control actaully is? :)

Originally posted by freakysid

I am using the above code to block microsoft url control user agent. I don't really know what it is. Can someone explain what microsoft url control actaully is? :)

It is a component included in various Microsoft development tools for creating an HTTP client. Pretty much like LWP in Perl, libwww, or curl in PHP.