Hi,

requests matching

http://%5C(es%5C%7Cpt%5C).wikipedia.org/wiki/%5BdD%5Data:image/png;base64,iV...

are on the increase. Currently, ~500K/day.

I cannot make sense of those requests, and they look wrong, as they seem to be a data URI appended to the a proper URL [1]. Corresponding bug is 66112 [2].

The requests' User-Agent identifies them as Firefox and Chrome, both on various flavors of Windows.

It's not ancient browsers, as the biggest part identifies as Firefox 29 (~60%) and Chrome 35 (~31%).

It does not seem to be simple bots faking User-Agents, as the number of requests shows a strong weekly pattern and the Client IPs match countries for the target wikis, and the IPs themselves differ a lot—covering 200-500 /24 nets per day in sampled-1000 stream.

Requests go to desktop site of eswiki (~58%) and ptwiki (~38%).

Referrers are mostly empty (~97%).

The image data in the data uri scheme decodes to images from VectorBeta [3] like:

VectorBeta/resources/typography/images/search-fade.png VectorBeta/resources/typography/images/tab-break.png VectorBeta/resources/typography/images/tab-current-fade.png VectorBeta/resources/typography/images/portal-break.png

Any clues?

Is this issue on our end or can for example rogue User-JS amount for that many skew requests?

Have fun, Chrisitan

P.S.: On stat1002, there are TSVs from the sampled-1000 stream filtered to the relevant requests for May and June at

/home/qchris/data-uris

.

[1] Since they are just UI images, here are some concrete examples:

http://es.wikipedia.org/wiki/data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA...

http://pt.wikipedia.org/wiki/Data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA...

http://es.wikipedia.org/wiki/data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA...

http://es.wikipedia.org/wiki/Data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA...

[2] https://bugzilla.wikimedia.org/show_bug.cgi?id=66112

[3] But that's not to say that it's a VectorBeta issue. It might be for example our (or User-)JS walking DOM and firing off strange requests.