SkypeUriPreview

[lucy24]

Anyone know anything? I've never seen them before in my life; in fact log wrangling sorted them into the Preview bin by understandable mistake:

23.101.61.176 - - [24/May/2015:16:09:52 -0700] "GET /fonts/custom_greek_it.html HTTP/1.1" 200 15548 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5" 
23.101.61.176 - - [24/May/2015:16:09:53 -0700] "GET //favicon.ico HTTP/1.1" 200 606 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5" 

(Yes, double leading slash, and yes, "Preview Preview".)

Admittedly, the sum total of my knowledge of Skype is contained in this number [youtu.be]. Where does a URI Preview fit in?

[Pfui]

Same UA seen by similar IPs in April and May:

23.101.172.224
23.102.5.211

I show those as belonging to -- wait for it --

Microsoft Corporation
23.96.0.0 - 23.103.255.255 (23.96.0.0/13)

The hits were to different, not obviously related pages. I don't Skype so I don't know if you can Skype links or not (or always or only via MS owner servers).

[keyplyr]

A quick web search using this UA returns mentions of various M$ Azure IP ranges. Could this possibly be a validation check within Skype itself when someone sends a URI using the service?

[lucy24]

Overlapping...

Microsoft Corporation

Yeah, I started from the assumption that it's a legitimate Skype entity. (Wonder what else MS does with this range? I'd never met it before-- the whole /13 was just labeled US-- and had to look it up.)

It is probably no surprise that a follow-up search for "SkypeUriPreview" leads to this very thread -- and absolutely nothing else, except assorted other threads in other venues similarly wanting to know who they are. And, of course, a few of those inexplicable cases of people's raw logs getting indexed on google. (Query: What possible combination of incompetence and foolhardiness could ever let this happen?)

[keyplyr]

Wonder what else MS does with this range?

It's just Azure, Microsoft's Cloud range, similar (I presume) to Amazon's Cloud - used more and more by apps.

I've recently had to poke quite a few holes in AWS, Digital Ocean, Contina and other cloud ranges because of app traffic I was mistakenly blocking.

[lucy24]

Contina

Is that what it is? I thought it was just another infection-prone russian ISP :(

The odd thing about this Skype thing-- I went over to Piwik and had a look-- is that it didn't come hot on the heels of some human visit to the page, the way you typically see with Facebook and Twitter. Even if they'd visited earlier, you'd think they would reopen the page for a moment just to refresh their memory on the URL.

:: shrug ::

[keyplyr]

Who knows what Skype is up to. Don't use it myself. People look all freaky.

[Pfui]

Three Skype Preview hits today, to the same file within the same minute, two from the 'regular' "23.101.172.224" a.k.a.:

United States Chicago Microsoft Corporation
23.96.0.0 - 23.103.255.255 (23.96.0.0/13)

(...which last May showed up as: Ireland Dublin Microsoft Corporation).

Interestingly, the triplet hit came from "104.45.18.178", a.k.a.:

Netherlands Amsterdam Microsoft Corporation
104.40.0.0 - 104.47.255.255 (104.40.0.0/13)

Oy. Tag-teaming with The Netherlands, long a MAJOR source of pestilence on my sites. Here's hoping MSN's worldwide clouds-for-hire don't become as bad as AWS's -- or worse, because they're offshore...