Hi, requests matching
http://\(es\|pt\).wikipedia.org/wiki/[dD]ata:image/png;base64,iVBORw0K.* are on the increase. Currently, ~500K/day. I cannot make sense of those requests, and they look wrong, as they seem to be a data URI appended to the a proper URL [1]. Corresponding bug is 66112 [2]. The requests' User-Agent identifies them as Firefox and Chrome, both on various flavors of Windows. It's not ancient browsers, as the biggest part identifies as Firefox 29 (~60%) and Chrome 35 (~31%). It does not seem to be simple bots faking User-Agents, as the number of requests shows a strong weekly pattern and the Client IPs match countries for the target wikis, and the IPs themselves differ a lot—covering 200-500 /24 nets per day in sampled-1000 stream. Requests go to desktop site of eswiki (~58%) and ptwiki (~38%). Referrers are mostly empty (~97%). The image data in the data uri scheme decodes to images from VectorBeta [3] like: VectorBeta/resources/typography/images/search-fade.png VectorBeta/resources/typography/images/tab-break.png VectorBeta/resources/typography/images/tab-current-fade.png VectorBeta/resources/typography/images/portal-break.png Any clues? Is this issue on our end or can for example rogue User-JS amount for that many skew requests? Have fun, Chrisitan P.S.: On stat1002, there are TSVs from the sampled-1000 stream filtered to the relevant requests for May and June at /home/qchris/data-uris . [1] Since they are just UI images, here are some concrete examples: http://es.wikipedia.org/wiki/data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAAuCAIAAABmjeQ9AAAARElEQVR42mVO2wrAUAhy/f8fz+niVMTYQ3hLKkgGgN/IPvgIhUYYV/qogdP75J01V+JwrKZr/5YPcnzN3e6t7l+2K+EFX91B1daOi7sAAAAASUVORK5CYII= http://pt.wikipedia.org/wiki/Data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAAuCAIAAABmjeQ9AAAARElEQVR42mVO2wrAUAhy/f8fz%2BniVMTYQ3hLKkgGgN/IPvgIhUYYV/qogdP75J01V%2BJwrKZr/5YPcnzN3e6t7l%2B2K%2BEFX91B1daOi7sAAAAASUVORK5CYII%3D http://es.wikipedia.org/wiki/data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAAQCAIAAABY/YLgAAAAJUlEQVQIHQXBsQEAAAjDoND/73UWdnerhmHVsDQZJrNWVg3Dqge6bgMe6bejNAAAAABJRU5ErkJggg== http://es.wikipedia.org/wiki/Data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAAQCAIAAABY/YLgAAAAJUlEQVQIHQXBsQEAAAjDoND/73UWdnerhmHVsDQZJrNWVg3Dqge6bgMe6bejNAAAAABJRU5ErkJggg%3D%3D [2] https://bugzilla.wikimedia.org/show_bug.cgi?id=66112 [3] But that's not to say that it's a VectorBeta issue. It might be for example our (or User-)JS walking DOM and firing off strange requests. -- ---- quelltextlich e.U. ---- \\ ---- Christian Aistleitner ---- Companies' registry: 360296y in Linz Christian Aistleitner Gruendbergstrasze 65a Email: christ...@quelltextlich.at 4040 Linz, Austria Phone: +43 732 / 26 95 63 Fax: +43 732 / 26 95 63 Homepage: http://quelltextlich.at/ ---------------------------------------------------------------
signature.asc
Description: Digital signature
_______________________________________________ Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
