plainclothes facebook?

[lucy24]

This is a new one on me:

2a03:2880:21ff:8::face:{redacted} - - [24/Aug/2018:21:50:17 -0700] "GET / HTTP/1.1" 200 6196 "https://www.facebook.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134" 

... et cetera for all components of a human request, including favicon and piwik, where they claimed a slightly implausible 2000x2000 resolution. (I checked. Only the facebook-whatever-it-is has ever given this. That makes them easy to spot.) Human requests to this site often come in mixed, but this was pure IPv6 from a Facebook range. It's easy to identify, because even though they own the whole /29--which is a vast territory in IPv6-land--one element is always the hexadecimal string “face”.

Further investigation reveals they've been doing this since December of 2017, but I didn't previously notice because other visits have been to IPv4 sites (I found an 66.220.149.abc and a 173.252.92.abc and then stopped looking). Referers variously blank, m.facebook, or www.facebook.

:: wandering off to study my log-wrangling code to figure out why this didn't get flagged as Facebook in the first place ::

[keyplyr]

FB ranges I allow without a UA or ^(facebook|Facebot|visionuti)

31.13.64.0 - 31.13.127.255
31.13.64.0/18

66.220.144.0 - 66.220.159.255
66.220.144.0/20

69.63.176.0 - 69.63.191.255
69.63.176.0/20

69.171.224.0 - 69.171.255.255
69.171.224.0/19

173.252.64.0 - 173.252.127.255
173.252.64.0/18

[lucy24]

Well, there's the trick. It's not a null UA, it's a human(oid) one. On further investigation (after I posted), each UA turned out to be different. Some kind of preview, maybe? But what the ### kind of preview do you get when you profess to a 2000x2000 resolution?

:: uneasily thinking that if people are running around with 2560x1600 monitors--this seems to be the most popular size in the >2000 range, which currently runs around 4-5% of the total, with the rest split about 2:1 between 1000-plus and <1000 on my sites--they're seeing a lot of empty space on some pages ::

None of the current FB UAs--including, by definition, the null UA--begins in “Mozilla”. That makes it easier to identify these oddities.

[keyplyr]

I didn't intend to imply that how I do it was related to what you're seeing. That would have been block by my rules.

You never know what people do with your links at FB. I've had them create ads containing hot-linked images of mine. Then an odd FB media bot verified the link. Took hours to figure that out.

I just allow a select set of UAs from those ranges. Haven't found any others that clearly show a benefit.