?source=post page---------------------------

What the--?

[Pfui]

Seen twice in the last two days via two different referring links, and a third time just now searching here before posting.

The identical 'phrase' appends itself to filenames:

/?source=post_page---------------------------
/directory/filename.html?source=post_page---------------------------

And it's here, too, on WW, in the URL of a search result (reattach initial parts to visit pages):

https ://www .google .com/ search?q=source%3Dpost_page&sourceid=webmasterworld&num=100&sitesearch=webmasterworld.com&gws_rd=ssl

https ://www .webmasterworld .com/forum36/366.htm?source=post_page---------------------------

The two visitors that spawned this were very different -- Sri Lanka IP; Australia Host -- ditto their platforms and UAs, and their URIs and REFs:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Mobile/15E148 Safari/604.1

Last but not least, the phrase does not appear on the long-time, and safe, referring pages. Something appears to be appending/inserting it along the way. Any idea as to what?

[Pfui]

(P.S. WW apparently omitted thread title's underscore above, in "post_page".)

[not2easy]

That is weird. I used your phrase "/?source=post_page---------------------------" in quotes and used our search, selecting Google from the dropdown and it found exactly one result: https://www.webmasterworld.com/forum36/366.htm?source=post_page--------------------------- from 2002 where there is nothing visible on the page to explain its selection as "the" result. Just strange. It looks like part of some UTM. Not something that is in use here AFAIK.

[lucy24]

Robot scraping URLs from some very, very outdated source? (Pause for quiet snicker at the thought of a botrunner paying money for an URL list that was last updated in 2002, heh heh.)

Out of curiosity I did a more general log search for "----" (four hyphens, which is more than could ever legitimately occur). But all that comes up is bogus referers in /xn----blahblah.

[Pfui]

- not2, ty for testing and replicating my results. I was surprised to see it here, too, even if it's not really here...
- lucy, beats me! But the pattern is very specific. And the referring pages, dated 2009 and 2017, are on large, active sites (e.g., Medium.com). Prior incomings have always been normal.

Additionally today, I got another hit, this time from a Norwegian Host via a known REF to a --

/directory/filename.html?source=post_page---------------------------

-- using:

Mozilla/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36

But since they were Android, their one hit turned into three because good old Google proxies hit twice more for good measure. (Why that typical conduct, essentially live tracking, doesn't bother more people is beyond me.)

Perhaps the REFs' platforms are the same, or their underlying CDNs or some such, and a recent update is misconfiguring their send-offs. Dunno.

[Pfui]

This Just In:

Looking at the REFs' resource files and scripts, both are part of the Medium.com world despite having totally different domain names. And every single non-Medium.com link I hovered over ended with the post_page phrase or something similar (?source=post_sidebar--------------------------post_sidebar-).

Which confirms it's a Medium-related REF thing.