Welcome to WebmasterWorld Guest from 18.206.168.65

Forum Moderators: Ocean10000

Message Too Old, No Replies

Possible Bot or Spammer?

Or is this Live bot?

     
10:09 pm on Feb 27, 2007 (gmt 0)

Junior Member

10+ Year Member

joined:Nov 10, 2005
posts:139
votes: 0


I see something strange in my access log. At first glance, it appears someone came in from MSN Live on a search for "airlines" to my site which has nothing to do with airlines. That's the first red flag. The log file shows this:

tide526.microsoft.com - - [11/Feb/2007:02:10:22 -0500] "GET / HTTP/1.1" 200 3612 "http://search.live.com/result.aspx?q=airlines&mrt=en-us&FORM=LVSP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; WOW64; SV1)"

Yet, doing a search for this on Live brings an error page. A true search would look like this:
search.live.com/results.aspx?q=airlines&mkt=en-us&FORM=LIVSOP
Notice the differences:
results.aspx and LIVSOP and MKT
Looks awfully suspect to me. Can someone shed some light? Is this really a microsoft bot? If it really is from microsoft.com, why would they be performing fake searches?

Edit: I just checked January's log file. They used keyword "hydrocodone" last month (again, nothing to do with my site). What is up?

[edited by: EarleyGirl at 10:28 pm (utc) on Feb. 27, 2007]

10:41 pm on Feb 27, 2007 (gmt 0)

Administrator from US 

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 21, 1999
posts:38200
votes: 96


First, that user and host is ms corporate. I would say you are being visited by a human checking qc on selected keywords.
12:30 am on Feb 28, 2007 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
posts:5497
votes: 3


tide526.microsoft.com equals 207.46.18.30

Dan's page "DID" stay current on IP ranges of all the major bots.
His site however has changed.
An old link from Archive org
[web.archive.org...]

MS and all the major SE's are offering a variety of tools, tool bars, plug ins and such which offer a variety of IP ranges not formerly utilized.

7:30 pm on Feb 28, 2007 (gmt 0)

Junior Member

10+ Year Member

joined:Nov 10, 2005
posts:139
votes: 0


Odd that hydrocodone (a drug) would be used as a keyword for checking qc. My site has nothing to do with airlines or drugs nor would it appear in a search using those keywords.

Also, is the search being done from a desktop or different application? It doesn't work from a browser when I try it. It brings up an error, the URL isn't right. It might be from Microsoft but I don't think they were coming in from a search. It just appears that way. I wonder why?

First, that user and host is ms corporate. I would say you are being visited by a human checking qc on selected keywords.
7:33 pm on Feb 28, 2007 (gmt 0)

Administrator from US 

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 21, 1999
posts:38200
votes: 96


That doesn't mean your site wasn't seen in those kw's - and hence the qc check behind the scenes...
8:04 pm on Feb 28, 2007 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Mar 22, 2001
posts:2450
votes: 0


My site tracks specifically search engine spiders. I've never seen 207.46.18.30 displaying spider-like behavior.
8:36 pm on Feb 28, 2007 (gmt 0)

Junior Member

10+ Year Member

joined:Nov 10, 2005
posts:139
votes: 0


That doesn't mean your site wasn't seen in those kw's - and hence the qc check behind the scenes...

You've lost me on that one. I don't see how that's possible. I don't have a site search (or a wiki or comments or a forum for that matter) so that wasn't used by a spammer. Up until this month, it was a Flash site, nothing but an swf - no words to pick up.

Also, for the months of November and December, "www" was used as the keyword from tide525.microsoft.com. Why would that need a qc check?

[edited by: EarleyGirl at 8:38 pm (utc) on Feb. 28, 2007]

9:06 pm on Feb 28, 2007 (gmt 0)

Administrator from US 

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 21, 1999
posts:38200
votes: 96


They were checking THEIR index behind the scenes before pushing it live.
9:17 pm on Feb 28, 2007 (gmt 0)

Junior Member

10+ Year Member

joined:Nov 10, 2005
posts: 139
votes: 0


Thanks Brett. My apologies if I seem slow to catch on. I was just trying to understand it.
9:35 pm on Feb 28, 2007 (gmt 0)

Administrator from US 

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 21, 1999
posts:38200
votes: 96


I know it is all complicated.

What happens is:

- they build an index.
- it has errors in it.
- they run a util on high value kws that flags possible problems for a hand check.
- they do the hand check and delete obvious mistakes.

9:49 pm on Feb 28, 2007 (gmt 0)

Junior Member

10+ Year Member

joined:Nov 10, 2005
posts: 139
votes: 0


Thanks Brett. That clarifies things.