Fake visitors from search.live.com - Webmaster Forums - Webmaster forum for HTML, PHP, ASP, CSS and more

Debriter · 06-10-2009, 11:37 AM

I noticed a rather regular pattern of hits against my web server which appear to be referrals from search.live.com. These hits are fake -- they aren't human searches. I have seen enough search-referrals against my site to make that statement. These are 100% bounces too -- the visitor _never_ follows another link after entering the site.

What bothers me is that, they are not identified as bot. In fact, they pose as an IE 6. Secondly, they skew stats of how many users come from what search engine.

The visitor IPs (narrow range) point at Microsoft Corp. Is this some sort of PING they have? Has anyone else seen it? A log snippet with relevant entries is below.

Thank you

65.55.110.159 - - [07/Jun/2009:12:50:56 -0500] "GET /p/mariette-himes-gomez/4-12 HTTP/1.0" 200 14748 "http://search.live.com/results.aspx?q=price" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.109.233 - - [07/Jun/2009:13:08:23 -0500] "GET /p/floor-lamps/4-12 HTTP/1.0" 200 15030 "http://search.live.com/results.aspx?q=floor" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.107.236 - - [07/Jun/2009:13:14:00 -0500] "GET /i/dauphine-upholstered-floor-mirror/HC9893-10.html HTTP/1.0" 200 9225 "http://search.live.com/results.aspx?q=mirror" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.109.42 - - [07/Jun/2009:13:18:47 -0500] "GET /p/chandeliers/1-12 HTTP/1.0" 200 15479 "http://search.live.com/results.aspx?q=light" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.109.118 - - [07/Jun/2009:13:25:39 -0500] "GET /p/james-river/5-12 HTTP/1.0" 200 15746 "http://search.live.com/results.aspx?q=price" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.110.23 - - [07/Jun/2009:13:25:51 -0500] "GET /p/james-river/2-12 HTTP/1.0" 200 15390 "http://search.live.com/results.aspx?q=price" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.107.243 - - [07/Jun/2009:14:16:43 -0500] "GET /i/brimfield-table-72-x-40/HC5740-72.html HTTP/1.0" 200 11437 "http://search.live.com/results.aspx?q=table" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.109.130 - - [07/Jun/2009:15:22:14 -0500] "GET /p/bar-and-entertainment/4-12 HTTP/1.0" 200 11384 "http://search.live.com/results.aspx?q=total" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.109.211 - - [07/Jun/2009:15:39:43 -0500] "GET /i/alta-iron-bird-sculpture/AH3097.html HTTP/1.0" 200 8240 "http://search.live.com/results.aspx?q=arteriors" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.109.10 - - [07/Jun/2009:15:39:49 -0500] "GET /i/club-door-lantern/VCCHO2500AB.html HTTP/1.0" 200 8771 "http://search.live.com/results.aspx?q=visual" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.110.110 - - [07/Jun/2009:16:54:01 -0500] "GET /p/james-river/8-12 HTTP/1.0" 200 16380 "http://search.live.com/results.aspx?q=price" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"
65.55.109.173 - - [07/Jun/2009:20:13:49 -0500] "GET /i/abba-short-glass-vasecloth-sleeve/AH6285.html HTTP/1.0" 200 8285 "http://search.live.com/results.aspx?q=arteriors" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)"

bigcat1967 · 06-15-2009, 06:25 PM

You know, I don't know what that is - but the same thing happened to me. And it was GoogleBot that did it. I looked at my UV one morning - it was like triple the traffic. I then looked at the log, it was a bot from Google that kept on visiting my site.

If you learn what happened - could you pm me? I would like to know.

dogfence456 · 06-16-2009, 01:56 AM

We don't know what that is - but the same thing happened to me. And it was GoogleBot that did it. I looked at my UV one morning - it was like triple the traffic.

bigcat1967 · 06-16-2009, 10:04 PM

Hey DogFence - stop spamming. I looked at your comment - and it's basically the same as my reply.

leadpros · 06-16-2009, 11:33 PM

In my experience you're absolutely correct. I used to advertise pretty heavily in MSN but I've cut practically all their traffic as a result of the search.live traffic.

jonamurray · 06-18-2009, 10:47 AM

I always vouch and evangelize to my clients to advertise only in Google PPC for return on their investment rather than MSN and Yahoo.

leadpros · 06-18-2009, 02:41 PM

Here, Here you do your clients proud

Debriter · 06-18-2009, 05:17 PM

I attached two time-of-day page-hit charts. The first one is just the awstats's chart showing all of site's traffic. You can see for example, how it gets quiet between the hours of 3am and 6am. The second attachment shows only page-hits referred by search.live.com. There, the distribution is flatter and doesn't correlate with the overall site traffic.

Smoking gun?

zimmyboosh · 01-18-2010, 02:52 AM

good information .

i don't know ago.

HowieSun · 01-18-2010, 02:54 PM

I would suspect these to be search engine spiders rather than fake visitors. Looks like they're crawling your site.