Forum Moderators: open

Message Too Old, No Replies

Not A Brand

         

lucy24

7:59 pm on Jul 30, 2023 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Has anyone noticed this name element? Conveniently RegExed as
Not.A.Brand
I’ve seen the forms
Not.A/Brand/8
Not_A Brand/99
Not/A)Brand/99
The first is sometimes followed by two spaces. (I block UAs with more than two, but double spaces do sometimes occur.) The only numbers I’ve seen are 8 and 99.

The element comes somewhere in the UA string, not in a consistent location. Visits are behaviorally human, IP generally but not exclusively Russia, no recurring features in the rest of the UA.

If we were allowed smileys, this one [cosgan.de] would just about fit the bill.

Pfui

10:46 pm on Jul 30, 2023 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



This verbatim variation from last week using a fake Google referrer is common-ish, but I can't say as I've paid much attention beyond serving 403s because of the backslashes (among other things):

"Not A;Brand\";v=\"99\", \"Chromium\";v=\"90\", \"Google Chrome\";v=\"90"

Courtesy of the always blocked .contaboserver.net.

lucy24

12:32 am on Jul 31, 2023 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



v=\"99\"
certainly does sound like someone making a hash of their Your New Robot script :)

Mine sometimes but not always carry a yandex referer, agreeing with the Russian IP.

dstiles

2:51 pm on Aug 1, 2023 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



There seems to be an answer of sorts at [stackoverflow.com...] and [github.com...]