msnbot using IE UA

should i suspect screenshots?

[GaryK]

In this thread [webmasterworld.com] Bill said:

When you see a bot IPs suddenly start showing browser UAs, and always the same UA, the logical conclusion to draw is that they are starting to take screen shots.

So far this has been the case every time I've seen this pattern happen but it's almost always a Firefox UA, rarely MSIE

So last week I saw this in my logs:

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SLCC1; .NET CLR 1.1.4325; .NET CLR 2.0.40607; .NET CLR 3.0.30729; .NET CLR 3.5.30707; InfoPath.2)

65.55.104.72
msnbot-65-55-104-72.search.msn.com

And I had to wonder if it was doing screen captures.

Any thoughts on this, Bill? Thanks.

[Pfui]

Gary, did the MSIE 6.0 hit have a basically fake referer? Because MSN uses all sorts of 'regular' UAs with its spurious ref scheme. E.g.:

msnbot-65-55-104-74.search.msn.com
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4322; .NET CLR 2.0.40607; .NET CLR 3.0.04506.648)

Fake ref: [search.live.com...]

More examples here: "MSN fakes referrers [webmasterworld.com]"

[GaryK]

Fake ref: [search.live.com...]
Yes, the referrers looked exactly like that. I found three more of them after I submitted this thead.

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4325; .NET CLR 2.0.40607; .NET CLR 3.0.30729; .NET CLR 3.5.30707; MS-RTC LM 8)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4322; .NET CLR 2.0.40607; .NET CLR 3.0.04506.648)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4325; .NET CLR 2.0.40607; .NET CLR 3.0.04506.648)

ADDED: Thanks for the link to the other thread. Now that this is happening to me I understand what that thread is all about. I posted all my examples there. Thanks so much, Pfui.

[edited by: GaryK at 11:35 pm (utc) on June 21, 2009]