jdMorgan - 3:52 pm on Aug 25, 2007 (gmt 0)

The IP addresses beginning with 131.107 indicate the same exploit discussed in this thread [webmasterworld.com], where someone is using MSN's "tide" proxy servers to make it appear that these requests are coming from Microsoft when in fact, they're proxied requests. These can easy be blocked by denying access if the REMOTE_HOST contains "tideNNN.microsoft.com", where NNN is a series of numbers. This is discussed in the previous thread.

The 65.55.165.*** address range resolves back to MSN as well, but no PTR records exist for this range so it's not possible to tell if these are also proxy servers at MSN. However, it may still be possible to block these requests by looking for VIA or X-FORWARDED_FOR headers on the requests.

Jim