MS weirdness

[keyplyr]

Saw several of these in tonight's log:

65.55.108.92 - - [16/Aug/2009:00:22:06 -0700] "GET www.example.com/page.html^^^^^^^^^^l0s/e7O2KfzGhQ^^^^^DocID=104213421152 HTTP/1.1" 403 937 "-" "WinHttp"

I've noticed Microsoft requesting pages with WinHttp for a few weeks now. They gewt 403'd because of UA, otherwise would have got a 404 due to this weirdness. Anyone else seeing this form MS?

[wilderness]

Seen a couple of WinHttp and seeing some occasional other crap.

None of it though, seems to be consistent.

[dstiles]

Maybe not MS themselves? Looks like it may be proxies. The IP you quote has no rDNS (here) and a nearby one looks proxy-ish. Others on the same /24 include msnbot, though.

Having said that, not one of the 65.55.108.-65.55.108.255 range of IPs this month (at least some with rDNS msnbot) has had a proper UA. Most (if not all) seem to be Mozilla/4.0 (complete string). Which results in a 405.

Maybe it's time to block 65.55.108.0-65.55.108.255? Or maybe block 65.52.0.0-65.55.255.255? :)

[blend27]

Don,

What do you mean "some"?

[wilderness]

blend,
I made a notation on the end of the MSN Fake thread for one.
I see some solitary requests from non-standard UA's, however considering all the crap that comes from MSN, I generally don't make any notation of the UA, until it becomes a reoccurring problem.

My apologies for the confusion.

I may add a multi-condition restriction based on MS bots and IP's, as I've done previously for Google and Yahoo.

Don