[21:51:23] <andrewbogott>	 We just got an abuse notice for traffic that appears to be coming from cloud-vps. It's not malicious, just broken...
[21:51:33] <andrewbogott>	 wiki.lll.lu:80 185.15.56.1 - - [28/Dec/2023:20:36:04 +0100] "GET /api.php?action=query&meta=siteinfo&siprop=statistics&format=php&maxlag=5 HTTP/1.1" 200 713 "-" "${user_agent}"
[21:51:51] <andrewbogott>	 iirc there's no good way to tell what tool is doing that with the user_agent wrong like that... is that still true?
[21:59:45] * andrewbogott makes T354101
[22:08:27] <RhinosF1>	 andrewbogott: on their why is it probing for git, the siteinfo api shows git revisions if you use it
[22:08:40] <RhinosF1>	 They aren't probing for git
[22:08:46] <andrewbogott>	 ah, cool
[22:09:04] <andrewbogott>	 Mind writing that on https://phabricator.wikimedia.org/T354101 for posterity?
[22:09:32] <RhinosF1>	 Sure
[22:12:42] <andrewbogott>	 thank you!
[22:12:43] <RhinosF1>	 Done
[22:12:50] <RhinosF1>	 Hopefully I make sense
[22:18:48] <taavi>	 RhinosF1: I'm pretty sure it's wikistats that is sending the malformed requests in the first place, I see it's doing the exact same requests the email lists and also it does `ini_set('user_agent','${user_agent}');` in a few places trying to expand variables in a single-quote string
[22:19:03] <taavi>	 you are listed as a member of that project, so please fix
[22:19:31] * andrewbogott lols
[22:24:09] <RhinosF1>	 taavi: can you assign the task to me
[22:24:13] <RhinosF1>	 PR incoming
[22:32:10] <RhinosF1>	 taavi: PR is up
[22:32:15] <RhinosF1>	 I'll deploy in the morning