The requests are all from Internet Explorer 9 with compatibility mode turned on. We know compatibility mode is on, because of the trident attribute being sent in the user-agent string.

This just started recently.(3/28 around 6AM)

These are legitimate users, not bots, we have determined that and we cannot reproduce the issue.

Here is one new Google search result, and it appears that others are having the same issue.

  • Do you use this logo from McAfee by chance? What's the URL of your website? – Brendon Apr 8 '13 at 18:39
  • no, we do not use that logo. I wonder though if it's some 3rd party plugin for IE9, and perhaps a mcaffee plug in. – ttomsen Apr 8 '13 at 19:27
  • helps if you link the URL in question. – Simon Hayter Apr 8 '13 at 19:54
  • If you try googling 'scanImageUrl' is comes up with many URLs ending in that string... – DisgruntledGoat Apr 9 '13 at 13:32
  • We are getting plenty of /scanimageurl requests on our website especially for IE 8 and IE 9, anybody has any ideas of why its happening. – user27070 Apr 12 '13 at 19:04

One of my coworkers started exhibit the symptoms (random requests for http://www.vistaprint.com/scanImageUrl from IE8), so I hopped on her computer to figure out what was causing the issue.

The problem appears to be due to a malware IE add-on called Yontoo v2.051. I doubt anyone intentionally installs the software, but, among other installers, it is bundled with "EZ Fonts" (http://downloadfreely.com/start/?p=EZ-Fonts). Disabling both parts of the add-on from IE stops the issue.

On a fresh install on EC2, the problem seemed to instead stem from "Surf Canyon" v5.0.1. Disabling Yontoo v2.052 didn't fix the problem, but disabling Surf Canyon did. In addition to the requests for scanImageUrl, Surf Canyon even causes random redirects to completely malformed URLs.

| improve this answer | |
  • FYI, we also started to see the problem around 5:50AM EDT on 3/28. – Josh May 1 '13 at 19:09
  • Yes, that's the exact same time we have started encountering this issue. – ttomsen May 20 '13 at 13:48
  • Received the same problem. Grmbl, thought it was an error... – NicoJuicy May 22 '13 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.