Welcome to WebmasterWorld Guest from

Forum Moderators: Ocean10000 & incrediBILL & keyplyr

Message Too Old, No Replies

MSOffice 12

What were they thinking?

5:54 pm on Jan 18, 2013 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month

joined:Dec 27, 2004
votes: 56

Some chump from Indian(IN) IP range was trying to open the site in MS Word I guess, got blocked(UA and headers), then tried using different IP to do so 2 minutes later, got blocked again.

Seems like the requests come in pairs with about 5-6 seconds in between:

time: {ts '2013-01-18 07:41:58'}
method: HEAD
protocol: HTTP/1.1
User-Agent: Microsoft Office Existence Discovery

Few seconds later

time: {ts '2013-01-18 07:42:04'}
method: GET
protocol: HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; MSOffice 12)

Second pair was the same thing pretty much.

Looking at the logs for prior days, seems like they were trying to scrape the site with libwww-perl/6.04.

I just tried to do the same thing(open url in Microsoft Office Word 2007) and got pretty similar results as far as UAs go. The system has IE9 - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) but the UA from Word 2007 says MSIE 7.0