Trend Micro

what do they want with our pdfs?

[Mokita]

I've just had this odd, out-of-the-blue entry in logs:

66.35.***.** - - [13/Nov/2005:11:41:42 -5000] "GET /pdfs/instruction-manual.pdf HTTP/1.1" 200 520040 "-" "Mozilla/4.0 (compatible; Trend Micro tmdr 1.0-1139)"

I have the /pdfs/ folder barred by robots.txt and there are no links anywhere that I can find, except from our pages. This file is the only one was requested from that IP all day.

I've read the following thread, and determined it really is Trend Micro coming calling as the IP range fits:
[webmasterworld.com...]

Why would they be downloading or scanning pdfs from our site? If they scanned all of the many, it would be a nasty drain on our bandwidth.

[wilderness]

Trend Micro as I recall is a PC Retailer.

Perhaps the vsitor just saved your page locally and then decided later to view the PDF, thereby accessing only that file through the www.

[Mokita]

Trend Micro sells anti-virus and anti-spyware products such as PC-cillin. They also have a very useful free online virus scanner named "House Call". It can be invaluable when a client's installed anti-virus has been disabled by something nasty.

But knowing what they are, doesn't help explain why they downloaded a large pdf from our site, without visiting a page. If someone wanted it scanned for viruses, surely they'd do it from their own hard drive.

If someone saved the page then downloaded the pdf later, their IP would have shown in the logs, not Trend Micro's.