2

Recently, I scanned a physical document for a friend, put it on my web server so that he could download it, and sent him the URL over the MSN chat network. I removed the file again shortly afterwards, but about an hour later, I got the following HTTP request for the same URL:

65.52.100.214 - - [15/Apr/2014:03:58:48 +0200] "HEAD /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "-"

65.52.100.214 is neither me nor my friend, but is in fact registered to "Microsoft Corporation", if whois is anything to go by. Note that it's a HEAD request, so Microsoft never fetched the actual contents.

About a week later, I started getting multiple requests per day to the same URL from various IP addresses with weird user agent from all over the net. Here are but a few of them:

74.217.148.74 - - [22/Apr/2014:22:36:14 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.6; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ;  Embedded Web Browser from: http://bsalsa.com/; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; msn OptimizedIE8;ESES)"
64.124.203.74 - - [22/Apr/2014:22:52:51 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; GTB6.4; SIMBAR={DBAB9A86-8527-4206-A26B-A5C3AFEEFC8D}; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; eSobiSubscriber 2.0.4.16; .NET4.0C; Windows Live Messenger 14.0.8117.0416)"
64.124.203.71 - - [30/Apr/2014:23:26:39 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; chromeframe/11.0.696.57; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; SLCC1; OfficeLiveConnector.1.5; OfficeLivePatch.1.3; Tablet PC 2.0; .NET4.0C)"
208.50.101.158 - - [03/May/2014:01:10:28 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6.6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; ibrytetoolbar_playbryte; ShopperReports 3.1.69.0; SRS_IT_E8790771BC76555133AA96; OfficeLiveConnector.1.3; OfficeLivePatch.0.0)"

(The complete list can be seen here.)

Note that this URL has 404:ed ever since that day. Though, I'm not sure whether the file was yet removed when the first request from Microsoft was made at Apr 15.

Neither me nor my friend knowingly used the URL in any other place. Does this mean that Microsoft is scanning MSN chats for URLs, and sometimes does "stuff" with them? What is even happening in this following barrage of requests? Or is there some other explanation? Is this behavior known and documented somewhere?

I have also, of course, shared a lot of other private URLs over MSN, without detecting them having been scanned.

  • 1
    At least Skype scans URLs sent, official purpose is to prevent spam and phishing. Source – dst May 3 '14 at 3:16
1

Microsoft does indeed scan URLs in messages to see if they are "spam, fraud, or phishing" links. They assert this is the only reason they use them.

I'm not sure if the other requests from weird UAs are microsoft as well, but it's a fair bet, unless they're leaking the URLs somewhere. Given the "OfficeLive" in some of the user agents, I'd guess they're Microsoft, but of course, it's trivial to send whatever you want as a User-Agent header.

See:

  • "I'd guess they're Microsoft" -- It's worth nothing that they aren't from Microsoft IP subnets, though. – Dolda2000 Jun 12 '14 at 1:14
  • If I were building a system to scan for malware, I'd probably not want the requests to be too obvious. Like, say, coming from a well-defined netblock. (But this is just speculation.) – David Jun 12 '14 at 1:19
0

Here's the PowerShell script I used to iterate over the IPs:

$IPCollection = "74.217.148.74,64.124.203.74,74.217.148.73,208.50.101.157,208.50.101.156,208.50.101.155,208.50.101.154,74.217.148.78,64.124.203.74,208.50.101.157,208.50.101.155,74.217.148.76,64.124.203.71,64.124.203.76,64.124.203.76,64.124.203.73,74.217.148.75,64.124.203.74,64.124.203.73,208.50.101.153,208.50.101.158,74.217.148.72,208.50.101.155,74.217.148.71,64.124.203.75,74.217.148.76,208.50.101.152,74.217.148.71,208.50.101.152,74.217.148.72,64.124.203.76,74.217.148.73,74.217.148.75,208.50.101.157,74.217.148.75,64.124.203.71,208.50.101.152,208.50.101.151,64.124.203.76,208.50.101.157,74.217.148.75,74.217.148.76,64.124.203.74,74.217.148.71,74.217.148.78,74.217.148.77,74.217.148.76,64.124.203.78,64.124.203.77,64.124.203.74,64.124.203.71,74.217.148.71,74.217.148.72,64.124.203.72,74.217.148.72,64.124.203.74,74.217.148.76,208.50.101.158,64.124.203.72,74.217.148.74,74.217.148.76,208.50.101.158,64.124.203.71,74.217.148.74,64.124.203.74,74.217.148.73,74.217.148.76,64.124.203.75,208.50.101.154,208.50.101.154,208.50.101.154,64.124.203.77,64.124.203.76,64.124.203.71,64.124.203.74,208.50.101.151,64.124.203.72,64.124.203.77,74.217.148.76,64.124.203.71,74.217.148.71,208.50.101.151,64.124.203.78,74.217.148.78,64.124.203.78,208.50.101.151,208.50.101.158,74.217.148.76,74.217.148.76,64.124.203.77,74.217.148.76,208.50.101.155,208.50.101.155,64.124.203.77,64.124.203.73,64.124.203.72,64.124.203.77,74.217.148.77,208.50.101.152,74.217.148.74,64.124.203.72,74.217.148.78,64.124.203.73,74.217.148.71,64.124.203.74,64.124.203.72,64.124.203.75,74.217.148.71,74.217.148.73,74.217.148.71,208.50.101.158,208.50.101.158,74.217.148.76,74.217.148.71,64.124.203.77,74.217.148.78,208.50.101.151,64.124.203.78,208.50.101.158,208.50.101.158,208.50.101.156,64.124.203.75,74.217.148.75,208.50.101.156,208.50.101.158,64.124.203.72,64.124.203.72,74.217.148.78,74.217.148.73,64.124.203.72,64.124.203.74,64.124.203.78,208.50.101.153,74.217.148.78,64.124.203.76,208.50.101.157,64.124.203.72,208.50.101.156,208.50.101.153,208.50.101.158,74.217.148.78,64.124.203.78,64.124.203.76,208.50.101.156,74.217.148.72,64.124.203.75,74.217.148.77,64.124.203.77,74.217.148.75,64.124.203.75,208.50.101.156,208.50.101.154,64.124.203.71,74.217.148.74,208.50.101.155,74.217.148.72,64.124.203.72,208.50.101.157,64.124.203.75,64.124.203.74,208.50.101.151,64.124.203.76,64.124.203.71,64.124.203.76,64.124.203.73,64.124.203.71,208.50.101.158,208.50.101.158,74.217.148.74,64.124.203.72,208.50.101.151,64.124.203.75,64.124.203.76,208.50.101.158,74.217.148.72,64.124.203.75,64.124.203.74,208.50.101.153,208.50.101.151,74.217.148.78,64.124.203.76,208.50.101.157,64.124.203.73,64.124.203.76,208.50.101.153,74.217.148.76,74.217.148.78,64.124.203.76,208.50.101.158";
$IPCollection = $IPCollection.Split(",");
foreach ($ip in $IPCollection) {
    [System.Net.Dns]::gethostentry($ip);
}

It returns the following list of hostnames:

64.124.203.74.available.above.net
64.124.203.74.available.above.net
64.124.203.71.available.above.net
64.124.203.76.available.above.net
64.124.203.76.available.above.net
64.124.203.73.available.above.net
64.124.203.74.available.above.net
64.124.203.73.available.above.net
64.124.203.75.available.above.net
64.124.203.76.available.above.net
64.124.203.71.available.above.net
64.124.203.76.available.above.net
64.124.203.74.available.above.net
64.124.203.78.available.above.net
64.124.203.77.available.above.net
64.124.203.74.available.above.net
64.124.203.71.available.above.net
64.124.203.72.available.above.net
64.124.203.74.available.above.net
64.124.203.72.available.above.net
64.124.203.71.available.above.net
64.124.203.74.available.above.net
64.124.203.75.available.above.net
64.124.203.77.available.above.net
64.124.203.76.available.above.net
64.124.203.71.available.above.net
64.124.203.74.available.above.net
64.124.203.72.available.above.net
64.124.203.77.available.above.net
64.124.203.71.available.above.net
64.124.203.78.available.above.net
64.124.203.78.available.above.net
64.124.203.77.available.above.net
64.124.203.77.available.above.net
64.124.203.73.available.above.net
64.124.203.72.available.above.net
64.124.203.77.available.above.net
64.124.203.72.available.above.net
64.124.203.73.available.above.net
64.124.203.74.available.above.net
64.124.203.72.available.above.net
64.124.203.75.available.above.net
64.124.203.77.available.above.net
64.124.203.78.available.above.net
64.124.203.75.available.above.net
64.124.203.72.available.above.net
64.124.203.72.available.above.net
64.124.203.72.available.above.net
64.124.203.74.available.above.net
64.124.203.78.available.above.net
64.124.203.76.available.above.net
64.124.203.72.available.above.net
64.124.203.78.available.above.net
64.124.203.76.available.above.net
64.124.203.75.available.above.net
64.124.203.77.available.above.net
64.124.203.75.available.above.net
64.124.203.71.available.above.net
64.124.203.72.available.above.net
64.124.203.75.available.above.net
64.124.203.74.available.above.net
64.124.203.76.available.above.net
64.124.203.71.available.above.net
64.124.203.76.available.above.net
64.124.203.73.available.above.net
64.124.203.71.available.above.net
64.124.203.72.available.above.net
64.124.203.75.available.above.net
64.124.203.76.available.above.net
64.124.203.75.available.above.net
64.124.203.74.available.above.net
64.124.203.76.available.above.net
64.124.203.73.available.above.net
64.124.203.76.available.above.net
64.124.203.76.available.above.net

Interesting... (no not really)

Just kidding, Microsoft wants your soul.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.