That's 10 (ten) spaces in the middle of the second UA. Based on processed logs, it's always this pattern: two or three requests for front page from wscheck UA followed by just one from github from the same IP. Far as I can tell, the IP really belongs to ws-something-- but who are they?
No robots.txt, but doesn't follow blatant honeypot link either. (Nobody does. Perhaps giving it the classname "honey" made it too blatant.)