Lunacy Unleashed

Notes from the field in the War on Spam

Bad behavior from Microsoft?

Attention Bad Behavior users. I’ve received several reports of strange accesses from an IP address range traced to Microsoft Corporation. And I need your help to investigate this.

If you are using verbose logging (it’s on by default) then please check your bad_behavior_log for any accesses from the 131.107.x.x address range. (In phpMyAdmin, Search for `ip` REGEXP '^131.107.' and that will bring it up, then hit Export, in SQL format.) If you find anything, please send it to me at

Thank you!


November 2, 2005 - Posted by | Bad Behavior


  1. You got mine. What are the odds that this is MS Live connected?

    Comment by h0bbel | November 3, 2005

  2. I’m not sure, I try this
    SQL query:
    SELECT `wp_bad_behavior_log`.`ip`
    FROM wp_bad_behavior_log
    WHERE (
    `wp_bad_behavior_log`.`ip` REGEXP ‘^131.107.’
    LIMIT 0 , 5000

    The result is:
    MySQL returned an empty result set (i.e. zero rows). (Query took 0.0227 sec)

    Comment by theo | November 8, 2005

  3. theo, that means you have nothing, so that’s fine. Many people won’t find anything.

    Comment by Michael Hampton | November 8, 2005

  4. Thanks Michael, I “speak” mysql like I speak english 🙂
    I’m in Italy, maybe MS is looking for USA/Canada blog for now?

    Comment by theo | November 8, 2005

  5. From the security log of a router, here in Italy:

    2005/11/08 23:38:48
    Source IP: Port:80
    Dest IP:xx.xx.xx.xx Port:1243 is MS 😐

    Comment by theo | November 8, 2005

  6. theo, that looks like a typical perfectly normal access from msnbot, and is definitely NOT the sort of behaviour I’m looking for. 🙂

    Comment by Michael Hampton | November 9, 2005

  7. MSNbot scan every IP? It’s an adsl with a not static IP (and without a webserver) 😐

    Comment by theo | November 9, 2005

  8. it looks like MSN bot to me

    Comment by women | November 13, 2005

Sorry, the comment form is closed at this time.

%d bloggers like this: