weird web log issue

[DrS]

This is not tcl related but I don't know where to address it. So, I
thought I would ask here to see if anyone has any suggestions.

Part of my job is to review server logs from a website periodically.
The web site sees very low traffic and is publicly accessible for plain
web pages. If a user is registered and has a valid account and
password, they can login and download certain documents.

Lately I have noticed something strange: After a valid user logs in and
downloads a document, the same url to download the same document gets
issued against the web server an hour or so later from a different IP
address. There is no attempt to login and no attempt to navigate to the
document location. They just seem to know the document names and paths.
No other URL is replicated like that; just the ones that contain
documents that the user downloaded earlier.

If a user is not logged in, there is no way (that I can see) that the
documents are served. This only happens with certain users. But the IP
addresses for the duplicate requests point to different geographic
locations than the location of those users. The web server will also
time out after a certain period. So, even if these users travel and
connect from a different access point, they should not be able to resume
their session.

But this happens for each new document that gets published, right after
users download them. So, unless this is a robot, I don't know why they
would try again and again because they can't access it: a person would
just stop trying. And how did they get the correct url in the first
place? (The IP addresses by the way point to Level3, AboveNet, etc.)

Any ideas what is happening? Are there search engines or ISP's that
recycle all url's they see? Or is this a hacking attempt or perhaps an
illegal file sharing scheme on part of users?

Thanks for any insights!

DrS