Tonight, between 18:10:59 and 18:18:51 local time (PDT) and again between 18:35:28 and 18:38:01 my site had another series of "active" users that seem suspicious. Two interesting points are that all but one was from "Trendmicro" (the oddball was from "Wtp-g3-maya10" but was from the same /8 ip subnet). All addresses are APNIC and issued to Japan. The log indicates that at least there were two incidents of two connections from two separate IP addresses simultaneously. All but one of these read the index page. I cannot tell whether there were any click-throughs.
Interesting, I thought.