The Real Ryan J. Parker

Is Microsoft checking to see if your website contains perverse content by using unsavory search strings?

It sure seems so.

While running a quick check through my websites’ access logs this morning I came across an interesting line in the access log of a website I’m slowly developing:

131.107.0.95 - - [17/Mar/2007:10:45:07 -0400] “GET / HTTP/1.1″ 200 13016 “http://search.live.com/result.aspx?q=cumshot&mrt=en-us&FORM=LVSP” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; Win64; x64; SV1)”

If you’re having a hard time deciphering this line, here’s what it says: someone accessed my website using a referrer from Microsoft’s live.com using the query string of cumshot. What’s interesting to note, however, is that the referrer line is invalid, as the live.com search application isn’t result.aspx, it’s results.aspx.

Let me first say that I’ve seen websites request pages with their own website’s URL as the referrer string to try and get people to visit their website, but this is obviously not one of those cases as it sends me to live.com, not somerandompornsite.com.

Having no idea how someone would find Probability Calculators by searching for cumshot, I decided to dig a little deeper to see what was going on.

Doing a lookup on the IP address, 131.107.0.95, I get:

nslookup 131.107.0.95 ns1.msft.net
Server: ns1.msft.net
Address: 207.68.160.190#53

95.0.107.131.in-addr.arpa name = tide525.microsoft.com.

If you’ve never done an nslookup before, it’s basically saying that this IP address belongs to Microsoft, and Microsoft is giving me the authoritative answer.

Doing a reverse lookup on tide525.microsoft.com yields the same IP address, so it’s a good match.

Now the only question left is: Why?

Why is Microsoft doing this? Some websites take the searcher’s query string to provide targeted content to the user, but why is Microsoft checking for this query string? Is it really that hard to determine if a site is targeted to an adult audience?

To be honest, I’ve got no problem with unsavory search strings, but I doubt everyone feels the same way as I do, so I wanted to write this post. Have you seen this in your own access logs? Do you even care that Microsoft is doing this?

Let me know what you think.

Tags: microsoft, live search, live.com, unsavry, referrer, search, string