Yes they are definitely up to something!

[Russell Fulton <r.fulton () AUCKLAND AC NZ>]

From our referrer report of 30 minutes ago:

[ 2 ] http://www.iam.auckland.ac.nz.ezprx.com/Authn/UserPassword/login.htm
[10/Aug/2015: 17:39:18 +1200] - 222.154.125.101 
[11/Aug/2015: 03:44:18 +1200] - 74.125.63.33 


Two IPs visited the site 74.125.63.33 is Indian — probably testing but 222.154.125.101 is a local ISP.  And only one 
user has recently authenticated from that address!   Someone associated with the school of music.  Time to send our 
friend an email!

Using the referrers to find folk who visit sites like this from off campus is really useful — it isn’t fool proof but 
we get most of them.

Russell.