Forum Moderators: open

Message Too Old, No Replies

Possible Bot or Spammer?

Or is this Live bot?

         

EarleyGirl

10:09 pm on Feb 27, 2007 (gmt 0)

10+ Year Member



I see something strange in my access log. At first glance, it appears someone came in from MSN Live on a search for "airlines" to my site which has nothing to do with airlines. That's the first red flag. The log file shows this:

tide526.microsoft.com - - [11/Feb/2007:02:10:22 -0500] "GET / HTTP/1.1" 200 3612 "http://search.live.com/result.aspx?q=airlines&mrt=en-us&FORM=LVSP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; WOW64; SV1)"

Yet, doing a search for this on Live brings an error page. A true search would look like this:
search.live.com/results.aspx?q=airlines&mkt=en-us&FORM=LIVSOP
Notice the differences:
results.aspx and LIVSOP and MKT
Looks awfully suspect to me. Can someone shed some light? Is this really a microsoft bot? If it really is from microsoft.com, why would they be performing fake searches?

Edit: I just checked January's log file. They used keyword "hydrocodone" last month (again, nothing to do with my site). What is up?

[edited by: EarleyGirl at 10:28 pm (utc) on Feb. 27, 2007]

Brett_Tabke

10:41 pm on Feb 27, 2007 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



First, that user and host is ms corporate. I would say you are being visited by a human checking qc on selected keywords.

wilderness

12:30 am on Feb 28, 2007 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



tide526.microsoft.com equals 207.46.18.30

Dan's page "DID" stay current on IP ranges of all the major bots.
His site however has changed.
An old link from Archive org
[web.archive.org...]

MS and all the major SE's are offering a variety of tools, tool bars, plug ins and such which offer a variety of IP ranges not formerly utilized.

EarleyGirl

7:30 pm on Feb 28, 2007 (gmt 0)

10+ Year Member



Odd that hydrocodone (a drug) would be used as a keyword for checking qc. My site has nothing to do with airlines or drugs nor would it appear in a search using those keywords.

Also, is the search being done from a desktop or different application? It doesn't work from a browser when I try it. It brings up an error, the URL isn't right. It might be from Microsoft but I don't think they were coming in from a search. It just appears that way. I wonder why?

First, that user and host is ms corporate. I would say you are being visited by a human checking qc on selected keywords.

Brett_Tabke

7:33 pm on Feb 28, 2007 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



That doesn't mean your site wasn't seen in those kw's - and hence the qc check behind the scenes...

volatilegx

8:04 pm on Feb 28, 2007 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



My site tracks specifically search engine spiders. I've never seen 207.46.18.30 displaying spider-like behavior.

EarleyGirl

8:36 pm on Feb 28, 2007 (gmt 0)

10+ Year Member



That doesn't mean your site wasn't seen in those kw's - and hence the qc check behind the scenes...

You've lost me on that one. I don't see how that's possible. I don't have a site search (or a wiki or comments or a forum for that matter) so that wasn't used by a spammer. Up until this month, it was a Flash site, nothing but an swf - no words to pick up.

Also, for the months of November and December, "www" was used as the keyword from tide525.microsoft.com. Why would that need a qc check?

[edited by: EarleyGirl at 8:38 pm (utc) on Feb. 28, 2007]

Brett_Tabke

9:06 pm on Feb 28, 2007 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



They were checking THEIR index behind the scenes before pushing it live.

EarleyGirl

9:17 pm on Feb 28, 2007 (gmt 0)

10+ Year Member



Thanks Brett. My apologies if I seem slow to catch on. I was just trying to understand it.

Brett_Tabke

9:35 pm on Feb 28, 2007 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



I know it is all complicated.

What happens is:

- they build an index.
- it has errors in it.
- they run a util on high value kws that flags possible problems for a hand check.
- they do the hand check and delete obvious mistakes.

EarleyGirl

9:49 pm on Feb 28, 2007 (gmt 0)

10+ Year Member



Thanks Brett. That clarifies things.