TrendMicro attacks drupal site

Hostgator web hosting is our best host for drupal. Sign up with our recommended host for drupal here

This is a drupal question asked by rsbecker on 27 October 2009

It appears that after an authorized user creates or edits content on the site the site is visited by an anonymous user who attempts to edit the same content. In all cases the authorized user had TrendMicro Internet Security running on his computer. The anonymous user comes from a domain registered to TrendMicro or to an entity in Japan. Both the TrendMicro and Japanese domain appear to operate in unison or one follows the other. The anonymous user is denied access, so Drupal appears to be protecting the site’s content.

For example, authorized user goes edits the content at www.mysite.com/node/374 by going to www.mysite.com/node/374/edit. A few minutes later an anonymous user at a TrendMicro domain goes to www.mysite.com/node/374/edit and receives an Access Denied. I see this traffic in the site’s access log.

I first noticed this several weeks ago when in a span of 20 minutes the site got repeated calls from these domains to list user information www. … /user 32 and then to edit the same user at www. … /user/32/edit. There were numerous calls from the TrendMicro domains and the Japanese domains for a series of users. This sequence of events occurred some time after the authorized user edited those users and, I believe, she no longer was online.

More info at this drupal node or sign up with the leading choice for drupal hosting