Welcome to WebmasterWorld Guest from 54.82.10.219

Forum Moderators: Ocean10000 & keyplyr

Message Too Old, No Replies

Help Identifying Reference to "NCO" Under cPanel Record of Visitors

I thought it was a bad-y until today when I saw its familiar IP address

     
8:20 pm on Jun 13, 2016 (gmt 0)

Moderator

WebmasterWorld Administrator webwork is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:June 2, 2003
posts:8032
votes: 79


I've Googled for an answer without success so I now turn to better minds.

I've seen "NCO" listed as a user-agent many times when checking "Visitors" data in cPanel under the Visitors link. I thought it was a bad actor of some kind, until today, when I saw what looked like a familiar IP address. Yes, it was my IP address.

I browse using either Chrome or Firefox. I was logged in using Chrome when I saw the entry to NCO.

WTF is NCO? I don't know if I should be concerned . . or not.

Thx.
10:15 pm on June 13, 2016 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member lucy24 is a WebmasterWorld Top Contributor of All Time 5+ Year Member Top Contributors Of The Month

joined:Apr 9, 2011
posts:15313
votes: 708


You don't have a .mil site do you?

Did you mean NCO as an element of the UA string, or NCO as the complete UA? Do you use one of those "hide my UA" addons, and/or send the Dnt header? Do raw logs say the same thing, or is it only cPanel being officious? It sure sounds like a cPanel thing.

:: twiddling thumbs while I see how many TextWrangler finds* in raw logs ::


* Red herring, because I didn't specify \bNCO\b like that, so I dredged up a bunch of those mysterious search-engine parameters instead.
3:25 pm on June 14, 2016 (gmt 0)

Moderator

WebmasterWorld Administrator webwork is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:June 2, 2003
posts:8032
votes: 79


cPanel gives NCO as the complete user agent string. I don't use a "hide my (anything)" add on. I am a bit concerned because, in the past, my IP was associated with the full gobbledygook string for Chrome. It's just so weird. WTF is NCO and why are there no references in search?
7:40 pm on June 14, 2016 (gmt 0)

Moderator This Forum from US 

WebmasterWorld Administrator keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 26, 2001
posts:12913
votes: 891


Webwork, as mentioned in other threads, you absolutely need to view your raw access logs to get valid information. Looking at anything else (including cPanel) is an interpretation. I suggest contacting your server admin and asking what their software interprets as NCO.

Having said that - Your cPanel may be written in (or use in part) netCDF accessing the GSL (GNU Scientific Library.) If so, the software may be displaying NCO for your own IP Address as default instead of a unique identifier (NCO may be one of the toolkits used.)

More info here: [nco.sourceforge.net...]
1:21 am on June 15, 2016 (gmt 0)

Moderator

WebmasterWorld Administrator webwork is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:June 2, 2003
posts:8032
votes: 79


Bizarre. At 12:47 today I'm nowhere near this site, but from my Raw Access Logs there is this:

71.168.xxx.xx - - [14/Jun/2016:12:47:19 -0400] "GET /favicon.ico HTTP/1.1" 404 - "-" "NCO"

Right now I'm hitting the site and I'm getting this:

71.168.xxx.xx - - [14/Jun/2016:21:09:29 -0400] "GET /tourist-attractions/BLAH-BLAH-BLAH/ HTTP/1.1" 200 3921 "http://example.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36"

Is there any reason from a Chrome browser to be fetching favicons at a time when I'm not visiting the site? (The site IS bookmarked but has no favicon.)
1:37 am on June 15, 2016 (gmt 0)

Moderator This Forum from US 

WebmasterWorld Administrator keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 26, 2001
posts:12913
votes: 891


Is there any reason from a Chrome browser to be fetching favicons at a time when I'm not visiting the site? (The site IS bookmarked but has no favicon.)
Well it could be you bookmarker, especially if you use some type of Chrome add-on. In fact, an add-on could be the cause of the NCO UA. However, are you sure it is your exact IP address that is the culprit? Most ISPs are dynamic and change customer assignments periodically.
2:53 am on June 15, 2016 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member lucy24 is a WebmasterWorld Top Contributor of All Time 5+ Year Member Top Contributors Of The Month

joined:Apr 9, 2011
posts:15313
votes: 708


<topic drift>
The site IS bookmarked but has no favicon.

Well, the browser doesn't know that. I didn't know Chrome had a favicon-fetching utility; I do know Firefox has or had one as an optional add-on. Periodically it goes through your bookmarks and fetches the favicon (only, not like some search engines that also fetch the page HTML). It makes the bookmark look more attractive-- and subliminally gives the impression you've been there recently-- so why not take a few minutes to make a favicon? Doesn't have to be anything fancy. Even a plain square in some site-appropriate color will make it stand out from other sites' bookmarks on your users' menu or bookmark bar.
</td>
3:32 am on June 15, 2016 (gmt 0)

Moderator

WebmasterWorld Administrator webwork is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:June 2, 2003
posts:8032
votes: 79


It's my exact IP address. Double checked. Same one a few days ago. Generally, unless my DSL modem is turned off, the IP remains fairly static.

Hmmm . .

I've played around a bit with making favicons. Guess I gotta get down to it . . . shoulda been done long ago . . . (Musical aside to your aside. :p )
3:41 am on June 15, 2016 (gmt 0)

Moderator This Forum from US 

WebmasterWorld Administrator keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 26, 2001
posts:12913
votes: 891


Can you remember any changes just prior to the time you noticed this UA being associated with your IP address? Did you say it also happens when you use other browsers?

If it were me, just to be safe, I would run a full antivirus scan on my machine.
3:07 pm on June 15, 2016 (gmt 0)

Moderator

WebmasterWorld Administrator webwork is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:June 2, 2003
posts:8032
votes: 79


Cannot remember any changes. Haven't tested with FF. I just ran both a remote AV "power scrub" and a local AV deep scan ~nothing but the usual tracking cookie crap. The bugger remains the recording of my IP at a time when I was not paying a visit. How . . on . . earth . . and Who . . and Why. (I hate this, even if it's (sic) "entirely benevolent", i.e., I don't recalling giving permission nor asking any app/software to do this. Argh. Thx to all for your insights and suggestions.
10:27 am on July 2, 2016 (gmt 0)

Moderator This Forum from US 

WebmasterWorld Administrator keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 26, 2001
posts:12913
votes: 891


Webwork did you ever figure this out? Was it indeed your doppelganger?
3:01 pm on July 2, 2016 (gmt 0)

Senior Member from GB 

WebmasterWorld Senior Member andy_langton is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Jan 27, 2003
posts:3332
votes: 140


I did find this reference to an NCO requesting favicon: [aqtronix.com...]

There was also an old Symantec toolbar that used NCO somewhere. Does your AV have some sort of toolbar, add-on or 'web protection'?
 

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members