I encountered something strange in the access log of our Apache server which I cannot explain. Requests for webpages that I or my colleagues do from the office's Windows network get repeated by another IP (that we don't know) a couple of seconds later.

The user agent repeating our requests is

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)

Has anyone an idea?

Update: I've got some more information now.

  • The referrer of the replicate is set to the URL I requested before and it's not the exact same request as the protocol version is changed from 'HTTP/1.1' to 'HTTP/1.0'.
  • The IP is not just one, it's just one of a subnet (80.40.134.*).
  • It's just the first request to a resource that's get repeated, so it seems the "spy" is building up some kind of cache of visited places.
  • The repeater is also picky. I tried randomly URLs with different HTTP status codes and different file patterns. 301s and 200s are redone, 404s not. Image extensions seem to be ignored.

While doing my tests I discovered that this behavior seems to be common as I found other clients visiting just after the first requests: - - [25/Oct/2012:10:51:33 +0100] "GET /foobar/ HTTP/1.1" 200 10952 "-" "Mediapartners-Google" - - [25/Oct/2012:10:51:33 +0100] "GET /foobar/ HTTP/1.1" 200 41312 "-" "Mozilla/5.0 (compatible; proximic; +http://www.proximic.com/info/spider.php)"

I wasn't aware about this practice, so I don't see it that much as a threat anymore. I still want to find out who this is, so any further help is appreciated. I'll try later if this also happens if I query some other server where I have access to the access logs and will update here then.

  • Maybe, but you really haven't provided enough information. A log entry or two would be helpful, or at least the suspicious IP address... Oct 24, 2012 at 23:40
  • (or if you don't want to provide the suspicious address, look it up!) Oct 24, 2012 at 23:46
  • Are we supposed to deduce the suspicious activity from the user agent string? It's Windows XP running Internet Explorer 8. Solved!
    – joeqwerty
    Oct 25, 2012 at 4:43

1 Answer 1


After some digging, I was able to determine that accesses from 80.40.134.* originated from TalkTalk Virus Alerts. This ISP is monitoring its users' web traffic and scanning the pages its users visit for viruses/malware.

Mediapartners-Google is just Google AdSense. You placed Google ads on your page, so Google is reading the page text in order to provide ads targeted to the content.

The final example you gave is self-documenting; try visiting the URL given.

  • Michael, thanks for your effort. As I stated before I was not aware that content relevant ads of course need to know what the content is. facepalm - The virus alerts thing is something I never heard about. How did you find out about this? Oct 25, 2012 at 16:25
  • I Googled random IP addresses in the range (since you didn't supply any) and it eventually came up. Oct 25, 2012 at 16:26
  • I must have been blind when I tried to identify the IPs by googleing before, so thanks again for opening my eyes. The whole process still seems rather strange to me and far away from a "security feature", but this shouldn't be discussed here. Oct 26, 2012 at 8:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .