I routinely get hits from Microsoft-owned IP addresses in the 13.x.y.z ranges of AS8075 (in these ranges) that present as Bingbot in the User Agent, but these addresses are listed on several block lists, do not pass the Verify Bingbot tool, and do not have hostnames so can't pass the forward-reverse DNS check. Known legit Microsoft bots in other Microsoft IP ranges typically have bi-directional DNS records linking the IP address to a *.search.msn.com hostname and vice versa.
I want to allow legitimate Microsoft bots to crawl my sites, but by all indications these IPs seem to be sketchy.
My question is: Despite indications, are these legitimate Microsoft bot IP addresses, and if these are legitimate Microsoft bots, why wouldn't Microsoft assign hostnames, clean up the malware, and add them to its Verify tool? If these are not actually legitimate Microsoft bots, why wouldn't Microsoft clean up the machines on their network (if they control them), or enforce some rules preventing bad bots on their IPs (if they are rented out to someone else)?