Access log IP's belong to Microsoft Corporation, but not verified Bingbot as per Bing Webmaster tools?

Question

When I checking the search engine bots access logs on my VPS, I can see that there are several bing bot logs, but when I use the Verify Bingbot tool (on Bing Webmaster Tools), it shows these IP's does NOT belong to Bingbot. Then I use whois lookup search and it shows these IPs belong to Microsoft Corporation.

What could be the reason? Is it a fake bot? If so, why it adds a "bingbot/2.0" phrase to access log and these IP's own Microsoft Corporation?

These are the few controversial IPs.

52.246.254.242
52.247.216.61
52.250.54.21

Access log.

52.246.254.242 - - [25/Oct/2020:02:34:48 +0530] "GET /2019/08/install-sony-update.html/amp HTTP/1.1" 301 5 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)

Answer 1

There are 2 separate things being looked at here -

the IP address - which from your advice is not tracking back to Microsoft. IP address is a strong predictor of prominence as it is difficult to forge (it's certainly possible, but not something your average user can do as it requires elevated access to networks which is not something most people have - and its very hard to implement at scale without being detected) if in doubt trust the IP address a lot more.

The Browser ID string is reporting Bingbot - this is trivial for a bot (or any web client) to set (in this case lie about). There is no checking or authentication of this field, so its mildly useful in getting a big picture about what visitors are using, but entirely unreliable.

One can only speculate what it is - it could be literally anything, including a web browser with a plugin or mis-configured benign bot unrelated to Microsoft, but it is more likely a mildly malicious hacking tool scouting for vulnerabilities. There is not a lot you can do about it and I would not worry too much - although WAFs (web application firewalls) may have lists blocking known bad IPs which might help.