Anyone have the remotest idea what this
means as a referer
Cursory research suggests that it's the URL of the block page (duh) used by certain security programs. But what on earth would it mean in the referer slot? Even if you open a page locally, and click on a link in that page, the referer doesn't show up as 127.0.0.1; it's simply blank.
Human request from plausible Canadian IP, preceded by Bluecoat request for same page. Bluecoat is blocked by IP (the uniquely satisfying "Deny from 8"), but it points to the idea that visitor is hyper-security-conscious. So does the "Dnt" header. But if they think sending an obviously bogus referer is the way to go, they are sadly mistaken.