Strange values in Accept-Language header?

[Alan Kennedy]

Alan Kennedy wrote:

>> On looking at my server logs for the Accept-Language headers (to
>> answer another post in this group), I came across some strange
values
>> that are definitely not ISO language codes. For example,
>> 
>> Accept-Language: en-us,x-ns1rDGeT4e2FpA,x-ns2f67971hgDw1
>> Accept-Language: x-ns13V8cN8S1Xz9,x-ns2T329gfxKa7d

Jeff Epler wrote:

> Searching on google turns up two hits in quoted mail message headers,
> both with Mozilla 4.7x.
>     http://www.google.com/search?q=accept-language+x-ns1
> 
> I wonder whether really ancient mozilla cvs might have some clues.  I
> groveled around a bit in bonsai but didn't come up with anything.

Jeff,

Thanks for the reply.

I've had some more time to analyse the logs. User agents that
submitted
these strange values are

Mozilla/4.75C-CCK-MCD {C-UDP; EBM-APPLE} (Macintosh; U; PPC)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:0.9.4.1) Gecko/20020508
Netscape6/6.2.3
Mozilla/4.77C-CCK-MCD {C-UDP; EBM-APPLE} (Macintosh; U; PPC)
Mozilla/4.73 (Macintosh; U; PPC)
Mozilla/5.0 (Macintosh; U; PPC; ja-JP; rv:0.9.4) Gecko/20011130
Netscape6/6.2.1
Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; VZ_IE5; YComp 5.0.0.0)
Mozilla/4.7 [en]C-CCK-MCD   (Win98; I)
Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Mozilla/4.79 (Macintosh; U; PPC)
UCmore

Approx 25% of these hits come through a (non-transparent) proxy, with
proxies from

marketscore.com
integrity.com

being the most common. Which is interesting, because marketscore.com
offer "faster surfing at no cost"

http://www.marketscore.com/e/surffaster.asp

Presumably they are modifying requests in some way to achieve that
"faster surfing"?

integrity.com is a filtering ISP that vets all content for obscenity

http://www.integrity.com/

So it is conceivable that they are implementing some form of custom
"signalling" to servers?

Of course, all of this is pure guess-work, but I'd bet that the 75% of
such hits that appear not to have come from a proxy are actually
coming through a transparent proxy of some kind.

That guess aside, I cannot see a single thing in common between all
the requests that contain these values.

I'd still be interested to hear from anyone who knows what these
values signify. I might email integrity.com and merketscore.com to see
if they can shed any light.

Sincerely,

alan kennedy
----------------------------------------------
check http headers here: xhaus.com/headers
email alan:              xhaus.com/mailto/alan