Recently, I scanned a physical document for a friend, put it on my web server so that he could download it, and sent him the URL over the MSN chat network. I removed the file again shortly afterwards, but about an hour later, I got the following HTTP request for the same URL: - - [15/Apr/2014:03:58:48 +0200] "HEAD /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "-" is neither me nor my friend, but is in fact registered to "Microsoft Corporation", if whois is anything to go by. Note that it's a HEAD request, so Microsoft never fetched the actual contents.

About a week later, I started getting multiple requests per day to the same URL from various IP addresses with weird user agent from all over the net. Here are but a few of them: - - [22/Apr/2014:22:36:14 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.6; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ;  Embedded Web Browser from: http://bsalsa.com/; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; msn OptimizedIE8;ESES)" - - [22/Apr/2014:22:52:51 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; GTB6.4; SIMBAR={DBAB9A86-8527-4206-A26B-A5C3AFEEFC8D}; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; eSobiSubscriber; .NET4.0C; Windows Live Messenger 14.0.8117.0416)" - - [30/Apr/2014:23:26:39 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; chromeframe/11.0.696.57; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; SLCC1; OfficeLiveConnector.1.5; OfficeLivePatch.1.3; Tablet PC 2.0; .NET4.0C)" - - [03/May/2014:01:10:28 +0200] "GET /~fredrik/tmp/fskatt.pdf HTTP/1.1" - - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6.6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; ibrytetoolbar_playbryte; ShopperReports; SRS_IT_E8790771BC76555133AA96; OfficeLiveConnector.1.3; OfficeLivePatch.0.0)"

(The complete list can be seen here.)

Note that this URL has 404:ed ever since that day. Though, I'm not sure whether the file was yet removed when the first request from Microsoft was made at Apr 15.

Neither me nor my friend knowingly used the URL in any other place. Does this mean that Microsoft is scanning MSN chats for URLs, and sometimes does "stuff" with them? What is even happening in this following barrage of requests? Or is there some other explanation? Is this behavior known and documented somewhere?

I have also, of course, shared a lot of other private URLs over MSN, without detecting them having been scanned.

  • 1
    At least Skype scans URLs sent, official purpose is to prevent spam and phishing. Source
    – dst
    Commented May 3, 2014 at 3:16

2 Answers 2


Microsoft does indeed scan URLs in messages to see if they are "spam, fraud, or phishing" links. They assert this is the only reason they use them.

I'm not sure if the other requests from weird UAs are microsoft as well, but it's a fair bet, unless they're leaking the URLs somewhere. Given the "OfficeLive" in some of the user agents, I'd guess they're Microsoft, but of course, it's trivial to send whatever you want as a User-Agent header.


  • "I'd guess they're Microsoft" -- It's worth nothing that they aren't from Microsoft IP subnets, though.
    – Dolda2000
    Commented Jun 12, 2014 at 1:14
  • If I were building a system to scan for malware, I'd probably not want the requests to be too obvious. Like, say, coming from a well-defined netblock. (But this is just speculation.)
    – David
    Commented Jun 12, 2014 at 1:19

Here's the PowerShell script I used to iterate over the IPs:

$IPCollection = ",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,";
$IPCollection = $IPCollection.Split(",");
foreach ($ip in $IPCollection) {

It returns the following list of hostnames:

Interesting... (no not really)

Just kidding, Microsoft wants your soul.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .