Verified BingBot being blocked?

I’ve noticed the WAF has triggered lots of “Anomaly:Header:User-Agent - Fake Bing or MSN Bot” on my site today. I’ve checked the IP addresses they are coming from, e.g. 40.77.167.18 and 207.46.13.105, and these are verified by Bing - Verify Bingbot Tool

Bingbot is getting through to my site from other IP addresses close to these.

Any ideas what’s going on here? Thanks.

Can you post a screenshot of a firewall entry with these IP addresses?

It might be that these addresses were only recently added and Cloudflare does not consider them yet. In that case it might take a couple of days for that to update.

Here you go:

I assume this is from the past 24 hours, right? As mentioned, these might be new addresses and Cloudflare will still have to update their database. I’d suggest to wait a couple of days, respectively to open a support ticket if it is urgent.

Thanks, yes, all these addresses were able to access the site, as BingBot, just a few hours ago. It’s not urgent but I might open a support ticket anyway as it seems a little strange.

1 Like

So they were already able to access it? In that case I’d rather assume there’s some glitch on Cloudflare’s side and it’s best to clarify this with support.

You can open a ticket at support.cloudflare.com/requests/new.

1 Like

Hello,

From Firewall Events:
Managed Rules
100202 - Anomaly:Header:User-Agent - Fake Bot

Top events by source

IP Addresses

207.46.13.104

207.46.13.104 is a verified Bingbot (from bing Webmaster)

Do u know something about that?

Thank you

1 Like

Yes, there’re some events on my websites also showing legitimate Bing Bot IPs being blocked by WAF starting this morning. As @sandro stated earlier, this could be the result of IP addresses recently added that are not yet recognized by Cloudflare. @kirsty, did you open a support ticket? Do you mind posting the ticket # here so that @cloonan may also have a look?

If it hadn’t worked earlier (as kirsty suggested) I’d have assumed them to be new, but if they really worked earlier Cloudflare must have recognised them already and now pretends not to know them any more :smile:.

Just to clarify: I don’t know whether these IPs were being allowed before. What I know is that I see WAF blocks for that alleged reason (false Bing Bog) starting this morning, and the IPs listed as blocked all returned as verified Bing Bot IP addresses.

Kirsty’s earlier response suggested that was the case.

Either they are new or Cloudflare stopped recognising them for whatever reason.

1 Like

Since morning WAF is blocking bingbot. Any particular reason (rule id - 100202)

I’m experiencing the same issue. As far as I can see, they are the real BingBot, accessing from ASN “AS8075 MICROSOFT-CORP-MSN-AS-BLOCK.” Cloudflare has blocked over 5,000 of these requests to our site in the past 24 hours.


Hi folks

Just noticed a high number (11 k) of requests by Bingbot being blocked under the rule “100202 Anomaly:Header:User-Agent - Fake Bing or MSN Bot”

Checking the IP address for those requests on Bing Webmaster you see they are actually valid Bingbot (as opposed to someone using Azure and impersonating it).

This started happening in the last 12 hours but seem to have stopped about three hours ago (matching the Bingbot profile of scanning the site at certain hours).

Could’ve been a rule update gone rogue, change in Bingbot behaviour or something else?

Screenshots below - @cscharff shall I open a ticket for this or wait to see if it happens again?

Capture2

Just a quick followup to say that, for me, the issue suddenly went away after a few hours, and I’ve had feedback from Cloudflare support that it was fixed.

1 Like

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.