Whilst checking some log files today I came across some errors where a non-logged in user was accessing pages that only a logged in user would ever see. Googlebot, MSNbot and others never try to index these pages because they can’t reach them so how was this bot getting there and why wasn’t it reporting itself as a bot?

Here’s the details on what I was seeing:

> UserAgent = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
> Referrer =
> User Host = 150.70.84.28

A quick search revealed that this address belongs to Trend Micro in Japan. One of our customers had their anti-virus software running and after each request they made we got another one from this IP address. Apparently it takes each request you make, sends it off to Japan and then they reissue the request from there pretending to be a normal user!

Presumably they are looking for viruses on your pages but what a dumb approach!

For starters, if I were a virus author it would be utterly trivial to spoof them with a ‘happy’ page, for another it’s a pretty abusive approach to ‘security’, and lastly do you really want all your browsing history to be in the hands of Trend Micro in Japan?!?!?!