TrendMicro attacks drupal site

I have seen similar behavior on two drupal sites on different shared hosts. Both running Drupal 6.14.

It appears that after an authorized user creates or edits content on the site the site is visited by an anonymous user who attempts to edit the same content. In all cases the authorized user had TrendMicro Internet Security running on his computer. The anonymous user comes from a domain registered to TrendMicro or to an entity in Japan. Both the TrendMicro and Japanese domain appear to operate in unison or one follows the other. The anonymous user is denied access, so Drupal appears to be protecting the site's content.

For example, authorized user goes edits the content at www.mysite.com/node/374 by going to www.mysite.com/node/374/edit. A few minutes later an anonymous user at a TrendMicro domain goes to www.mysite.com/node/374/edit and receives an Access Denied. I see this traffic in the site's access log.

I first noticed this several weeks ago when in a span of 20 minutes the site got repeated calls from these domains to list user information www. ... /user 32 and then to edit the same user at www. ... /user/32/edit. There were numerous calls from the TrendMicro domains and the Japanese domains for a series of users. This sequence of events occurred some time after the authorized user edited those users and, I believe, she no longer was online.

It was not until a few days ago, on a different site, that I saw this pattern occur within a minute after an authorized user edited content.

I have reported this behavior to TrendMicro and asked for an explanation. But all I have gotten is techs telling me the company's products don't do those kinds of things. One posited that TrendMicro was probing these sites looking for malware that might infect the user's computer.

As noted above the calls from these domains never got past Drupal's security. But it is very worrysome and TrendMicro apparently has no explanation for why these apparent attacks are coming from its domains or what purpose they serve. I'm hoping someone has seen this and can explain what is going on and why.

Thanks