Recently, one of our clients contacted about something rather strange: a „language” value in his newly Google Analytics setup that stated: „Secret.ɢoogle.com You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!”
Of course, we all know that browser headers/requests can be easily altered, but we still wonder why Google allows such values in it’s [non-bot] visitor-related reports. And if it does some data validation / sanitizing or not really.
P.S. Beware that „secret.ɢoogle.com” differs from „secret.google.com”. Here are the ASCII code values:
Secret.ɢoogle.com: 115 101 099 114 101 116 046 201 162 111 111 103 108 101 046 099 111 109
secret.google.com: 115 101 099 114 101 116 046 103 111 111 103 108 101 046 099 111 109