Hi,
requests matching
http://\(es\|pt\).wikipedia.org/wiki/[dD]ata:image/png;base64,iVBORw0K.*
are on the increase. Currently, ~500K/day.
I cannot make sense of those requests, and they look wrong, as they
seem to be a data URI appended to the a proper URL [1].
Corresponding bug is 66112 [2].
The requests' User-Agent identifies them as Firefox and Chrome, both
on various flavors of Windows.
It's not ancient browsers, as the biggest part identifies as
Firefox 29 (~60%) and Chrome 35 (~31%).
It does not seem to be simple bots faking User-Agents, as the number
of requests shows a strong weekly pattern and the Client IPs match
countries for the target wikis, and the IPs themselves differ a
lot—covering 200-500 /24 nets per day in sampled-1000 stream.
Requests go to desktop site of eswiki (~58%) and ptwiki (~38%).
Referrers are mostly empty (~97%).
The image data in the data uri scheme decodes to images from
VectorBeta [3] like:
VectorBeta/resources/typography/images/search-fade.png
VectorBeta/resources/typography/images/tab-break.png
VectorBeta/resources/typography/images/tab-current-fade.png
VectorBeta/resources/typography/images/portal-break.png
Any clues?
Is this issue on our end or can for example rogue User-JS amount for
that many skew requests?
Have fun,
Chrisitan
P.S.: On stat1002, there are TSVs from the sampled-1000 stream
filtered to the relevant requests for May and June at
/home/qchris/data-uris
.
[1] Since they are just UI images, here are some concrete examples:
http://es.wikipedia.org/wiki/data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA…
http://pt.wikipedia.org/wiki/Data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA…
http://es.wikipedia.org/wiki/data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA…
http://es.wikipedia.org/wiki/Data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA…
[2]
https://bugzilla.wikimedia.org/show_bug.cgi?id=66112
[3] But that's not to say that it's a VectorBeta issue. It might be
for example our (or User-)JS walking DOM and firing off strange
requests.
--
---- quelltextlich e.U. ---- \\ ---- Christian Aistleitner ----
Companies' registry: 360296y in Linz
Christian Aistleitner
Gruendbergstrasze 65a Email: christian(a)quelltextlich.at
4040 Linz, Austria Phone: +43 732 / 26 95 63
Fax: +43 732 / 26 95 63
Homepage:
http://quelltextlich.at/
---------------------------------------------------------------