homepage Welcome to WebmasterWorld Guest from 184.73.104.82
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Pubcon Platinum Sponsor 2014
Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL

Search Engine Spider and User Agent Identification Forum

This 131 message thread spans 5 pages: < < 131 ( 1 2 3 4 [5]     
MSN fakes referrers
SEOPTI

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 3875363 posted 6:14 pm on Mar 20, 2009 (gmt 0)

This has been discussed in 2007:
[webmasterworld.com...]

They do it again, I see hundreds of fake visitors from MSN IPs across all of my domains.

Are there any news what they try to accomplish by doing this?

 

Ocean10000

WebmasterWorld Administrator 10+ Year Member



 
Msg#: 3875363 posted 1:44 pm on Aug 18, 2009 (gmt 0)

New version of the Referrer spam bot using invalid IE User-Agent Strings coming from 65.55.165.*

Mozilla/4.0+(compatible;++MSIE+6.0;++Windows+ NT+5.2;++SV1;+ +.NET+CLR+1.1.4325;++.NET+CLR+2.0.40607;++.NET+CLR+3.0.04506.648)
Mozilla/4.0+(compatible;++MSIE+6.0;++Windows+ NT+5.1;++SV1;+ +.NET+CLR+1.1.4325;++.NET+CLR+2.0.50727;++.NET+CLR+3.0.04506.648)
Mozilla/4.0+(compatible;++MSIE+6.0;++Windows+ NT+5.1;++SV1;+ +.NET+CLR+1.1.4322;++.NET+CLR+2.0.40607;++.NET+CLR+3.0.30729;++.NET+CLR+3.5.30707)

[edited by: Brett_Tabke at 12:50 pm (utc) on Jan. 12, 2010]
[edit reason] (fixed formatting) added space before NT [/edit]

wilderness

WebmasterWorld Senior Member wilderness us a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



 
Msg#: 3875363 posted 6:40 pm on Aug 18, 2009 (gmt 0)

I'm sure the forum is going to butcher these trailing blank spaces, however there are TWO trailing blank spaces after every phrase/section of the UA (excluding the end).

65.55.165.107 - - [18/Aug/2009:18:50:01 +0100] "GET /myFolder/myPage.html HTTP/1.1" 403 1159 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4325; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)"

rehabguy

10+ Year Member



 
Msg#: 3875363 posted 8:22 pm on Aug 24, 2009 (gmt 0)

I'm recieveing over 10,000 visits from the Bing spoof bot on a daily basis...

smokeybarnable

5+ Year Member



 
Msg#: 3875363 posted 2:53 am on Aug 25, 2009 (gmt 0)

yeah this is annoying. They claimed they "fixed" it in this thread:

[bing.com...]

I wonder what this is really all about. It almost seems like they are crawling their own search engine.

1EightT

10+ Year Member



 
Msg#: 3875363 posted 11:00 pm on Aug 25, 2009 (gmt 0)

They are probably trying to see if sites generate a page on the fly based on the incoming referrer. I know they discuss that as a method for spam detection in some of their research papers.

dstiles

WebmasterWorld Senior Member dstiles us a WebmasterWorld Top Contributor of All Time 5+ Year Member



 
Msg#: 3875363 posted 10:10 pm on Aug 26, 2009 (gmt 0)

Well, it works here. They get a 403 page. :)

Disco Legend Zeke

5+ Year Member



 
Msg#: 3875363 posted 2:08 pm on Sep 1, 2009 (gmt 0)

Bing is late to the dance, so they seem to be a little hyper.

On the other hand, they seem very willing to act on complaints, for example i was #2 behind a completely blank page, and within a week of complaining, i was promoted to #1

if the re-searches are actually from BING, and are for spam recognition, then i think it is working. Also, by faking user agents, they may defeat some spam tools such as cloaking.

As for non-msn referrals looking for phone numbers, you probably had the same searches in google, but so spread out over time (as the phonelist scrapers came on line) that you didn't notice.

The surge of all traffic from BING, including scrapers and other junk, could be explained by the success of their advertising and marketing campaigns.

wilderness

WebmasterWorld Senior Member wilderness us a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



 
Msg#: 3875363 posted 3:21 pm on Sep 1, 2009 (gmt 0)

As for non-msn referrals looking for phone numbers, you probably had the same searches in google, but so spread out over time (as the phonelist scrapers came on line) that you didn't notice.

Many thanks for the tip on how to read our logs ;)

blend27

WebmasterWorld Senior Member 5+ Year Member



 
Msg#: 3875363 posted 11:37 pm on Sep 1, 2009 (gmt 0)

-- success of their advertising and marketing campaigns --

If you'd call it a marketing campaign, they truly deserve the 403, JUST for trying out new and exciting things ;)

-- they may defeat some spam tools such as cloaking --

truly, people that use cloaking to spam already know where it comes from simply by matching IP to the well known ranges, seriously .... my cat knows those IP Ranges...

THIS Tread should be renamed to: NO RESPONSE TO WEBMASTERS CONCERNS or NO CASH for WASTED Bandwidth.

sidney1310

5+ Year Member



 
Msg#: 3875363 posted 1:12 am on Sep 2, 2009 (gmt 0)

It looks like they finally took care of it. See the August 28 posting from Brett Yount in this thread

[bing.com...]

I haven't seen any more of these hits in my access logs since August 27.

Pfui

WebmasterWorld Senior Member 5+ Year Member



 
Msg#: 3875363 posted 6:47 am on Sep 7, 2009 (gmt 0)

On 09-02, I moved a site onto our server (temp placement; the owner's changing boxes). Within 36 hours of DNS broadcast, MSN's bots hit it scores and scores of times via 65.55 servers using faked referers and cloaked browsers. E.g.:

msnbot-65-55-104-68.search.msn.com
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SLCC1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30707; InfoPath.2)

msnbot-65-55-104-65.search.msn.com
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SLCC1; .NET CLR 1.1.4325; .NET CLR 2.0.40607; .NET CLR 3.0.30729; .NET CLR 3.5.30729; MS-RTC LM 8)

msnbot-65-55-165-44.search.msn.com
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SLCC1; .NET CLR 1.1.4325; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)

msnbot-65-55-165-46.search.msn.com
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4325; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648)

Yesterday (09-05) saw more hits from MSN's faked referers than from any other host, all having to do with common words per usual. Also per usual, the cloaked+fake MSN bots are strangers to robots.txt.

In short: Same old, same old.

This 131 message thread spans 5 pages: < < 131 ( 1 2 3 4 [5]
Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved