Comments on: Scraped by 208.50.101.153

By: AthenaOfDelphi

AthenaOfDelphi — Sat, 03 Sep 2011 07:59:55 +0000

We’ve already checked out these ranges. The 208 range is Global Crossing in the US and if I recall correctly, the 78 range is one of their data centres in Europe. I think we came to the conclusion that the SmartScreen servers are hosted by Global Crossing for Microsoft.

But thanks for the input. It was only as a result of a number of us working together that we got a handle on this.

Regards

Athena

By: Force

Force — Fri, 02 Sep 2011 23:34:59 +0000

http://whois.arin.net/rest/net/NET-78-0-0-0-1/pft
http://whois.arin.net/rest/net/NET-208-48-224-0-1/pft
this might help

By: Ador

Ador — Fri, 26 Aug 2011 15:18:21 +0000

I can confirm that 74.217.148.73 and 74.217.148.76 are also IPs that do those secret GET requests

I got abit sick when I saw the GET requests in the logs as I was moving some db files unprotected from 1 server to another. I feel abit better knowing it was a bot and I’m hoping microsoft doesn’t store them and/or go through them manually.

By: AthenaOfDelphi

AthenaOfDelphi — Wed, 24 Aug 2011 20:53:55 +0000

Thanks for those addresses Aaron. I've added the new ones to the wiki page that's been used to collect all the information I've been given about SmartScreen. That page is here.

By: Aaron

Aaron — Wed, 24 Aug 2011 19:09:06 +0000

I just put some files on my web server for a friend to download. I saw him begin to download, and within seconds, the same files were downloaded multiple times from these IP addresses. They appear to be coming back for more, so I’m replacing the files with 4 gigabyte piles of random crap for them to suck on.

64.124.203.71
64.124.203.72
64.124.203.73
64.124.203.74
64.124.203.77
74.217.148.72
74.217.148.73
74.217.148.75
74.217.148.76
208.50.101.152
208.50.101.153
208.50.101.156
208.50.101.157
208.50.101.158

By: miro

miro — Sun, 21 Aug 2011 17:09:30 +0000

Thanks for the info – I found out about it myself and only when I made the connection with SmartScreen Filter, I was able to find this entry. Maybe it is possible to add a few more/other keywords so it can be found more easily? I was google’ing for “lowercase HTTP requests” “MSN” “available.above.net” “browsing history” since that were the only hints I got from the logfile. Once I had “Smartscreen Filter” +lowercase, I was set. Thanks again for the detailed information!

By: dina

dina — Wed, 23 Feb 2011 10:39:26 +0000

Thanks for this usefull info! We got the same GET from 208.xxxx.

By: tibbz

tibbz — Wed, 15 Dec 2010 18:47:33 +0000

thanks for this information. I was certainly intrigued when viewing my httpd logs.

By: AthenaOfDelphi

AthenaOfDelphi — Fri, 10 Dec 2010 21:40:51 +0000

You’re welcome Eran, glad it helped

By: ES

ES — Fri, 10 Dec 2010 21:06:18 +0000

Thanks for all the info!! explains a lot. Was puzzled for a few hours about this until I found your blog.