msnbot getting zenid

[stride-r]

I'm running ZC 1.3.8a (patched and current)

I Just noticed today that msnbot spider is getting a zenid.
(see attached screenshot, from just this morning) The other spiders currently online are all not receiving them - just the "msnbot". I seem to recall seeing it visit before and that it did not get one in the past.

I checked and my spiders.txt and it includes "msnbot" on line 196 and the file version is:
$Id: spiders.txt 6506 2007-06-16 20:36:51Z drbyte $


Any ideas why it would not be identified as a bot??

[stride-r]

Here's the Screenshot:
View Screenshot

[ksookma]

Very interesting, thats a very big concern. Did you find a solution to what would be causing this? I found a post online the other week that explained how to remove the zenid from showing in the URL.

Tried it but it didnt work. What is the effect of not using zenid's at all i wonder?

[gjh42]

The code needs to use the zenid the first time, but after that it stores the info in a session cookie (provided the user's computer allows session cookies). So most users should only see the zenid once when first entering the store; spiders should never get a zenid at all.

If you were to eliminate the zenid from the start, you would not be able to keep track of past events in the session, and probably not keep a shopping cart.

[ksookma]

thanks, so I wonder why the msn robot is able to see the ID?

[gjh42]

There are two different visitors from the msnbot host, but their user agents look like pc's, not spiders, and they are both trying to login. Could it be some kind of hacker probe spoofing the source?

[ksookma]

Interesting, thanks for your help!

[DrByte]

You'll all off track.

The real issue in this case is that the alleged msnbot isn't using "msnbot" in its UserAgent. Thus it's not being treated as a spider by the store. The only indication of it possibly being msnbot here is the dns name resolution.

[gjh42]

Would the real msnbot ever not use "msnbot" in its user agent? As I said, that has the look of a personal-type computer. Could somebody legitimately be using that host and surfing as a person?