Help Identifying Reference to "NCO" Under cPanel Record of Visitors

I thought it was a bad-y until today when I saw its familiar IP address

[Webwork]

I've Googled for an answer without success so I now turn to better minds.

I've seen "NCO" listed as a user-agent many times when checking "Visitors" data in cPanel under the Visitors link. I thought it was a bad actor of some kind, until today, when I saw what looked like a familiar IP address. Yes, it was my IP address.

I browse using either Chrome or Firefox. I was logged in using Chrome when I saw the entry to NCO.

WTF is NCO? I don't know if I should be concerned . . or not.

Thx.

[lucy24]

You don't have a .mil site do you?

Did you mean NCO as an element of the UA string, or NCO as the complete UA? Do you use one of those "hide my UA" addons, and/or send the Dnt header? Do raw logs say the same thing, or is it only cPanel being officious? It sure sounds like a cPanel thing.

:: twiddling thumbs while I see how many TextWrangler finds* in raw logs ::


* Red herring, because I didn't specify \bNCO\b like that, so I dredged up a bunch of those mysterious search-engine parameters instead.

[Webwork]

cPanel gives NCO as the complete user agent string. I don't use a "hide my (anything)" add on. I am a bit concerned because, in the past, my IP was associated with the full gobbledygook string for Chrome. It's just so weird. WTF is NCO and why are there no references in search?

[keyplyr]

Webwork, as mentioned in other threads, you absolutely need to view your raw access logs to get valid information. Looking at anything else (including cPanel) is an interpretation. I suggest contacting your server admin and asking what their software interprets as NCO.

Having said that - Your cPanel may be written in (or use in part) netCDF accessing the GSL (GNU Scientific Library.) If so, the software may be displaying NCO for your own IP Address as default instead of a unique identifier (NCO may be one of the toolkits used.)

More info here: [nco.sourceforge.net...]

[Webwork]

Bizarre. At 12:47 today I'm nowhere near this site, but from my Raw Access Logs there is this:

71.168.xxx.xx - - [14/Jun/2016:12:47:19 -0400] "GET /favicon.ico HTTP/1.1" 404 - "-" "NCO"

Right now I'm hitting the site and I'm getting this:

71.168.xxx.xx - - [14/Jun/2016:21:09:29 -0400] "GET /tourist-attractions/BLAH-BLAH-BLAH/ HTTP/1.1" 200 3921 "http://example.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36"

Is there any reason from a Chrome browser to be fetching favicons at a time when I'm not visiting the site? (The site IS bookmarked but has no favicon.)

[keyplyr]

Is there any reason from a Chrome browser to be fetching favicons at a time when I'm not visiting the site? (The site IS bookmarked but has no favicon.)

Well it could be you bookmarker, especially if you use some type of Chrome add-on. In fact, an add-on could be the cause of the NCO UA. However, are you sure it is your exact IP address that is the culprit? Most ISPs are dynamic and change customer assignments periodically.

[lucy24]

<topic drift>

The site IS bookmarked but has no favicon.

Well, the browser doesn't know that. I didn't know Chrome had a favicon-fetching utility; I do know Firefox has or had one as an optional add-on. Periodically it goes through your bookmarks and fetches the favicon (only, not like some search engines that also fetch the page HTML). It makes the bookmark look more attractive-- and subliminally gives the impression you've been there recently-- so why not take a few minutes to make a favicon? Doesn't have to be anything fancy. Even a plain square in some site-appropriate color will make it stand out from other sites' bookmarks on your users' menu or bookmark bar.
</td>

[Webwork]

It's my exact IP address. Double checked. Same one a few days ago. Generally, unless my DSL modem is turned off, the IP remains fairly static.

Hmmm . .

I've played around a bit with making favicons. Guess I gotta get down to it . . . shoulda been done long ago . . . (Musical aside to your aside. :p )

[keyplyr]

Can you remember any changes just prior to the time you noticed this UA being associated with your IP address? Did you say it also happens when you use other browsers?

If it were me, just to be safe, I would run a full antivirus scan on my machine.

[Webwork]

Cannot remember any changes. Haven't tested with FF. I just ran both a remote AV "power scrub" and a local AV deep scan ~nothing but the usual tracking cookie crap. The bugger remains the recording of my IP at a time when I was not paying a visit. How . . on . . earth . . and Who . . and Why. (I hate this, even if it's (sic) "entirely benevolent", i.e., I don't recalling giving permission nor asking any app/software to do this. Argh. Thx to all for your insights and suggestions.

[keyplyr]

Webwork did you ever figure this out? Was it indeed your doppelganger?

[Andy Langton]

I did find this reference to an NCO requesting favicon: [aqtronix.com...]

There was also an old Symantec toolbar that used NCO somewhere. Does your AV have some sort of toolbar, add-on or 'web protection'?