IEAutoDiscovery

Pre-fetcher, feed reader, e-mail harvester, or what?

[GaryK]

I've seen this user agent in my logs for over a year now. I never paid much attention to it because it's never been a pest. One of my users asked about it yesterday and I couldn't find anything concrete about it. So I asked him to search his logs for other user agents from the same IP Address. Here's what he found:

IEAutoDiscovery
198.103.172.*
2006-09-08 10:23:49

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
2006-09-08 14:20:59
198.103.172.*

The D quads are the same number. This is a small ISP whose NetRange for the D quad runs from 0 to 255.

I've heard some solid rumors about this being a pre-fetcher for IE7 but my contact at MS won't/can't confirm this. I've also read comments about it being an e-mail harvester or a feed reader.

Does anyone have any solid info about this user agent? Maybe even an URL? Many thanks.

~gary.

[nancyb]

I found it in my logs from 68.220.165.xx in Sept and 216.17.255.xx in Aug. Didn't go back any earlier.

The same IPs also showed these UAs:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727) in Sept.
and
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727) in Aug.

It found my page from a Google search in Aug and search.ezanga in Sept.

Both times (Sept and Aug) the IEAutodiscovery UA requested the same totally unrelated page two and up to six times before finishing loading images or going to another page.

68.220.165.xx - - [08/Sep/2006:15:17:13 -0600] "GET /images/brown/st1.jpg HTTP/1.1" 200 6039 "http://www.mydomain.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
68.220.165.xx - - [08/Sep/2006:15:17:14 -0600] "GET /cust-feedback.htm HTTP/1.1" 200 26249 "-" "IEAutoDiscovery"
68.220.165.xx - - [08/Sep/2006:15:17:14 -0600] "GET /cust-feedback.htm HTTP/1.1" 200 13633 "-" "IEAutoDiscovery"
68.220.165.xx - - [08/Sep/2006:15:18:00 -0600] "GET /images/blue/st2.jpg HTTP/1.1" 200 1575 "http://www.mydomain.com/color.htm" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"