Chrome/50: fully human(oid)

[lucy24]

UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36

And your point is ...?

This is a “by their misdeeds shall ye know them” robot. Mercifully it has one tiny header deficiency, or I’d have a ### of a time blocking it.

In the beginning this was a legitimate human UA.
In mid-2016 it was picked up by a robot living in or about Nobis.
In October 2016 it moved over to OVH (mostly--I didn't check every last IP) and acquired a disagreeable new behavior: It sends a referer. But not referer spam; it's a wild and random assortment of sites, including some that I could easily see myself linking to, and others that look just like my actual referers except that the parameters are wrong. Most pages are probably discovered from the same source; here's a somewhat creepy exception that I found while fine-tooth-combing logs:

188.165.231.77 - - [22/Sep/2017:17:59:06 -0700] "GET /directory/pagename.html HTTP/1.1" 403 1827 "http://www.example.co.il/about/7b00ea9a-7193-4522-a5fa-f128ff45c2ad" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" 
188.165.231.77 - - [22/Sep/2017:17:59:06 -0700] "GET /directory/pagename.html' HTTP/1.1" 403 1827 "http://www.webmasterworld.com/sticky-sendmsg-v6.cgi?action=reply&member=username" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" 

/pagename.html is the page from my WebmasterWorld profile; username is a WebmasterWorld member of unimpeachable standing. I must say, I did not like that at all.

[keyplyr]

The referrer included the perp's WW member name? How is that possible?


BTW - current Chrome is version 61.0.3* (both desktop & mobile)

[lucy24]

How is that possible?

I did say I did not like it. Brrrr. (The least alarming conjecture is that a spammer received and replied to a Sticky from the moderator in question, and idiotically added that to their list of plausible referers. I am inclined to think that the WebmasterWorld connection between page and referer is pure coincidence.)

I haven't seen Chrome/50 from a human since
:: shuffling papers ::
well, mostly mid-2016--in fact around the same time the robot picked up this exact UA. The most recent non-blocked human was in April of this year; there have been later blocked humans. For this exact UA, including NT 10.0, the most recent is June 2016.

[keyplyr]

The referral string must be fake. I just sent myself a referral from WW and there's no membername besides my own as past of the referral link.

Sounds like someone is attempting to libel another member.

[fix typo]

[edited by: keyplyr at 4:49 am (utc) on Sep 27, 2017]

[lucy24]

Sounds like someone is attempting to libel another member.

Possibly sulking because that's who banned them? (Psst! Tell your smartphone that "libel" is not a typo for "liable", heh heh.)

The interesting thing is that you can get an URL in the specified format--but not when you’re replying to a received Sticky. It’s when you click someone’s name in their profile:

https://www.webmasterworld.com/sticky-sendmsg-v6.cgi?action=reply&member=username

And even then, the query string is left out of the actual request. (I tried it with my test site, which is https, so the query is supposed to be retained isn't it?) Note the change from & to & though.