As per the official guidelines at: https://www.bing.com/webmasters/help/how-to-verify-bingbot-3905dc26, to verify we a bingbot,
Perform a reverse DNS lookup using the IP address from the logs to verify that it resolves to a name that end with search.msn.com Do a forward DNS lookup using the name from step 1 to confirm that it resolves back to the same IP address
Now, I received requests from the subnet "40.77.202.0/24" with a user agent of:
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)
Given the "bingbot" in user agent, when I do step 1 of verifying the bot, I do not get a proper hostname. Some IP lookup tools just return the IP address itself while some say "No valid reverse DNS data is received from host. Try again later." and others do not return any hostname at all.
So all the IPs in this subnet fail step 1 (reverse DNS check) and hence should be considered as someone spoofing? But then,
A. As per official IP Address list, Bing is in fact claiming this subnet to be an official IP range used by bingbot!!? https://www.bing.com/toolbox/bingbot.json
B. When validating any IP address from the mentioned subnet using the official "Verify Bingbot" tool at: https://www.bing.com/toolbox/verify-bingbot, then again it says that it is an valid bingbot IP!!
Why this inconsistency and what to conclude?
Additionally, When I looked up a few IPs on AbuseIP database, I see all of them being getting reported. See: https://www.abuseipdb.com/check/40.77.202.79
If the IP is not returning proper hostname then how to trust it?
I want Bing to index my pages though I do not want any malicious traffic.