vBSEO User Agent

Question about referer

[grandma genie]

Hello,

Found this unusual log entry today. I have never seen this user agent before, but it would appear to have been around for awhile. The question I have is about the referer. Here is the log entry:

184.173.199.nnn - - [27/Sep/2011:15:40:52 -0400] "GET / HTTP/1.0" 200 28153 "http://mywebsite.be0.biz/" "Mozilla/4.0 (vBSEO; [vbseo.com)"...]

The referer is [mywebsite.be0.biz....] If you put that in your browser it takes you to my website minus any pictures. But I do not use that term .biz. So is this a copy of my website that someone else is using. Before I contact my host about this, I thought I would ask the real experts first. My website is a .com

I typed .be0.biz into Google, but all the links were questionable and I was afraid to click on them. Didn't want to download something nefarious. Is anyone familiar with this be0.biz ending?

The IP is from SoftLayer The Planet.

Grandma_genie

[keyplyr]

So two proactive measures I recommend:

Block SoftLayer/Planet:
(184.172.0.0 - 184.173.255.255)
184.172.0.0/15

Block "SEO" in any Ua


As for the suspicion about being scraped/copied? Dunno, never come across be0.biz before (thanks for the heads-up.)

[Pfui]

1.) Referrers are routinely forged; I see hundreds of robotic fakes every day. So just because a visitor came from X referrer doesn't mean they did -- or that X referrer even exists.

One kind of forged/fake referrers are also known as log-spamming.

Either way, you were wise not to take the bait. I never go to any referrer that doesn't appear to fit with my content.

2.) robtex.com is a great place to find out all sorts of things about IPs/domains without going anywhere near them. Here you go, for "be0.biz" [robtex.com...]

[grandma genie]

Thanks guys. Will take care of the suggestions from keyplyr and I read the stuff from robtex.com. Very interesting. None of the contact info seems legit. Totally fake phone number and the contact name - Bob Smith - yeah, right.

I only got the log entry yesterday. None today. But there were two others yesterday. Same user agent but different IPs. The IPs were from GoDaddy and Rapidvps.net. Both server hosts. All three log entries only hit the home page, nothing else. All had the same referer. Very odd.

Thanks for the info Pfui.