Tim Flight

Yesterday in a routine overview of server log files I came across one website that had substantially more traffic than usual. An investigation started. I was hoping to find evidence of the “slashdot effect” and discover the traffic was real. However that was not the case.

Instead I discovered that one particular IP address had made over 21,000 requests for the same page within 30 minutes. The IP address was 131.107.0.102 and I immediately started blocking that IP address at the firewall.

The IP address resolves back to tide532.microsoft.com. At first I suspected MSNbot had become dazed and confused while crawling the site. However I also noticed that the User-Agent wasn’t reported as MSNbot, but rather as a Windows 98 PC. Weird.

I started to Google things like “tide.*microsoft.com”, “tide.microsoft.com”, “tide microsoft.com” and came up with some interesting results. Some websites seemed to think that it was indeed MSNbot. But why they use a user-agent of Windows 98 and totally hide the fact that it was a bot? Perhaps they are having trouble with sites serving up different content for bots than “regular” visitors and they are being stealthy?

Other websites seemed to be pointing to some sort of conspiracy theory that the tide servers are a way Microsoft is measuring market-share of their IIS webserver software. Several websites mentioned this was the function of those servers.

So I sent an email to MSN Search asking if the IP address was MSNbot. They didn’t answer my question but instead asked to see server logs. I sent them two or three lines and asked again if the IP address was part of MSNbot. And again they replied without answering my question, instead asking for more server logs. I sent them a few hundred grepped lines of the IP address making the same request over and over for the same URL. I also repeated my query to them if the IP was MSNbot. So far no response.

All of my other emails were responded to within an hour, my last email to them hasn’t been responded to yet and it has been almost 24 hours. So my search for an answer continues… Who or what is tide.*microsoft.com? Why did it make 21,000+ requests for the same URL on my site within 30 minutes? Inquiring minds want to know!

This entry was posted on Thursday, May 12th, 2005 at 1:11 pm and is filed under Computer Technology, SEO Search Engine Optimization, Website Development. You can subscribe via RSS 2.0 feed to this post's comments. Both comments and pings are currently closed.