Recently, one of our clients contacted about something rather strange: a « language » value in his newly Google Analytics setup that stated: « Secret.ɢoogle.com You are invited! Enter only with this ticket URL. Copy it. Vote for Trump! »
Of course, we all know that browser headers/requests can be easily altered, but we still wonder why Google allows such values in it’s [non-bot] visitor-related reports. And if it does some data validation / sanitizing or not really.
P.S. Beware that « secret.ɢoogle.com » differs from « secret.google.com ». Here are the ASCII code values:
Secret.ɢoogle.com: 115 101 099 114 101 116 046 201 162 111 111 103 108 101 046 099 111 109
secret.google.com: 115 101 099 114 101 116 046 103 111 111 103 108 101 046 099 111 109