The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    Trendmicro servers from Japan - accessing webservers

    Discussion in 'Security and Anti-Virus Software' started by TheNomad, Dec 16, 2008.

  1. TheNomad

    TheNomad Notebook Guru

    Reputations:
    1
    Messages:
    68
    Likes Received:
    0
    Trophy Points:
    15
    Anyone can confirm or had experiences with the stuff below?

    I discovered Trendmicro is accessing / scanning webservers in apparent attempt to distinguish the good from the bad. Nothing new so far I guess. This is how they apparently do it after some time of digging & trapping.

    Trendmicro seems to use servers located in Japan with IP range 150.70.84.* When Trendmicro is running on a PC with the option "protect against web threaths", it'll send the full access path to Trendmicro. From there an inspection is scheduled to the webserver being accessed from 150.70.84.*.

    The thing is, the time between first access and inspection can be a only few minutes. And if it's in a secure area on the webserber the IP range 150.70.84.* is causing an avalanche of 404's. Such as webmail.

    Anyone seen this before?

    Google 150.70.84.* and you'll get info about comment spammers, dig deeper and you'll find TrendMicro.
    So far TrendMicro didn't confirm of deny :rolleyes:
     
    TheNomad, Dec 16, 2008
    #1
  2. Baserk

    Baserk Notebook user

    Reputations:
    2,503
    Messages:
    1,794
    Likes Received:
    1
    Trophy Points:
    56
    Trend Micro aswell as AVG's Linkscanner use 'Search Engine Spiders'/SERPs.
    One of the few responses from Trend Micro I found, states;

    ' From: [email protected]
    Sent: Friday, 23 May 2008 1:18:29 PM
    To: ......
    Cc: [email protected]

    Dear Site Owner,

    To protect our customers from visiting a malicious or harmful site, web pages of the applicable URLs are downloaded and scanned by our servers. Thus, you may have noticed a few visits from our IPs. Please be assured that this poses no security risk to your web sites as our servers do not perform any action other than scanning the sites.
    We then store the rating of the web site in our server cache so that our servers will no longer access those pages for analysis when a customer chooses to visit those web sites again. We have already asked our server owner to add the rating for the following domain(s);
    .....
    The setting will take effect soon, please verify it again on your site.
    Sorry for any inconvenience and please inform us of any other concerns you may have.
    Best Regards,
    Trend Micro    '

    So, at least here's one confirmation ;)
    In this XHTMLforum post more SERPs are mentioned.
    Cheers.
     
    Baserk, Dec 16, 2008
    #2
  3. TheNomad

    TheNomad Notebook Guru

    Reputations:
    1
    Messages:
    68
    Likes Received:
    0
    Trophy Points:
    15
    Thx, very interesting - also the link to the XHTMLforum - explains & comfirms!
     
    TheNomad, Dec 16, 2008
    #3