12

The requests are all from Internet Explorer 9 with compatibility mode turned on. We know compatibility mode is on, because of the trident attribute being sent in the user-agent string.

This just started recently.(3/28 around 6AM)

These are legitimate users, not bots, we have determined that and we cannot reproduce the issue.

Here is one new Google search result, and it appears that others are having the same issue.

Improve this question
6
  • Do you use this logo from McAfee by chance? What's the URL of your website?
    – Brendon Boshell
    Commented Apr 8, 2013 at 18:39
  • no, we do not use that logo. I wonder though if it's some 3rd party plugin for IE9, and perhaps a mcaffee plug in.
    – ttomsen
    Commented Apr 8, 2013 at 19:27
  • helps if you link the URL in question.
    – Simon Hayter
    Commented Apr 8, 2013 at 19:54
  • If you try googling 'scanImageUrl' is comes up with many URLs ending in that string...
    – DisgruntledGoat
    Commented Apr 9, 2013 at 13:32
  • We are getting plenty of /scanimageurl requests on our website especially for IE 8 and IE 9, anybody has any ideas of why its happening.
    – user27070
    Commented Apr 12, 2013 at 19:04

1 Answer 1

Reset to default
4

One of my coworkers started exhibit the symptoms (random requests for http://www.vistaprint.com/scanImageUrl from IE8), so I hopped on her computer to figure out what was causing the issue.

The problem appears to be due to a malware IE add-on called Yontoo v2.051. I doubt anyone intentionally installs the software, but, among other installers, it is bundled with "EZ Fonts" (http://downloadfreely.com/start/?p=EZ-Fonts). Disabling both parts of the add-on from IE stops the issue.

On a fresh install on EC2, the problem seemed to instead stem from "Surf Canyon" v5.0.1. Disabling Yontoo v2.052 didn't fix the problem, but disabling Surf Canyon did. In addition to the requests for scanImageUrl, Surf Canyon even causes random redirects to completely malformed URLs.

Improve this answer
3
  • FYI, we also started to see the problem around 5:50AM EDT on 3/28.
    – Josh
    Commented May 1, 2013 at 19:09
  • Yes, that's the exact same time we have started encountering this issue.
    – ttomsen
    Commented May 20, 2013 at 13:48
  • Received the same problem. Grmbl, thought it was an error...
    – NicoJuicy
    Commented May 22, 2013 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.