Forum Moderators: open

Message Too Old, No Replies

A small list of IPs from MSFT

In Stealth Mode

         

blend27

6:10 pm on Sep 13, 2023 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



So MSFT is a lager network of IPs than most of IP holders out there.

What I have been observing since as far back as 2019 is that a set of 7 IPs, all from different /24s swarm on of the sites I manage.

6 - 10 seconds a part, so it kind of Blends(:)) in general traffic.

Only 7 IPs,
104.41.225.47
104.41.228.253
13.69.199.207
13.79.160.159
40.113.85.123
40.127.111.29
50.105.130.232

...all with the same UA: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko

The pages(URIs) the go after are(or were - in some cases) - 10 pages - linked from Home page at some point.

Each URI is requested several times from the same IP over the time period of half hour, and then they STOP for several month.

- Then comeback fro the same OLD URIs.

What Gives?

not2easy

7:40 pm on Sep 13, 2023 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



MSFT hosts businesses and bots. Their own crawlers come from a defined list (that is posted somewhere here) and my notes say those that are not from:
13.66.139.0/24
13.66.144.0/24
13.67.10.16/28
13.69.66.240/28
13.71.172.224/28
20.36.108.32/28
20.43.120.16/28
20.125.163.80/28
40.77.167.0/24
40.79.131.208/28
40.79.186.176/28
51.8.235.176/28
51.105.67.0/28
52.167.144.0/24
52.231.148.0/28
139.217.52.0/28
157.55.39.0/24
191.233.204.224/28
207.46.13.0/24
are Direct Allocation hosted things.

On your list I am blocking:
104.40.0.0 - 104.47.255.255
104.40.0.0/13

40.112.0.0/13

40.126.128.0 - 40.127.255.255
40.126.128.0/17, 40.127.0.0/16

and also:
13.64.0.0 - 13.107.255.255
13.64.0.0/11, 13.104.0.0/14, 13.96.0.0/13

51.140.0.0 - 51.145.255.255
51.140.0.0/14

dstiles

9:24 am on Sep 14, 2023 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I am wrestling with this problem at the moment. The list ot bot IPs is at...
[bing.com...]

The problem I'm having is blobking all MSFT IPs ib iptables but permanantly allowing the bot IPs. I have posed my problem here...
[webmasterworld.com...]