Is youtube-dl used by any browser plugins?

[adamdullenty]

Hi,

Bizarre question but we are seeing an issue where a suspicious browser agent string accesses our service from a client's IP address about 2 seconds after a request from Chrome. The weird user agent seems to match that which is reported by youtube-dl (or perhaps an older version of it) so just wondering whether this might be related to some kind of youtube downloader browser plugin which uses youtube-dl code internally is grabbing a copy of the page after loading:

Initial request, presumably legitimate from Chrome:

2015-06-17 11:28:29 +0100   Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36

Second request, strange user agent:

2015-06-17 11:28:31 +0100   Mozilla/5.0 (X11; Linux x86_64; rv:10.0) Gecko/20100101 Firefox/10.0 (Chrome)

Both from the same IP address.

This happens repeatedly throughout the logs and it is causing havoc with our user tracking code and causing this guy to be logged off for duplicate sign ins regularly.

It could just be a massive coincidence but I'm guessing not. Any help in identifying the browser extension at fault would be gratefully received.

[jaimeMF]

I don't know.
But it could just be someone accessing your webpage and then calling youtube-dl from the command line.

[adamdullenty]

Thanks for the reply. Not sure why but this happens regularly for this user, reliably 1-2 seconds after every page request, over the course of several hours. We don't have youtube videos on any of our pages so not sure why they would go to the trouble.

Any other thoughts?

[jaimeMF]

If the first request is actually from browsing (ie not some tool downloading just the webpage, it's strange. Maybe he tried to automate the download and it's failing.