Welcome to WebmasterWorld Guest from

Forum Moderators: Ocean10000 & incrediBILL

Message Too Old, No Replies




1:17 am on Dec 10, 2013 (gmt 0)

WebmasterWorld Senior Member lucy24 is a WebmasterWorld Top Contributor of All Time Top Contributors Of The Month

Anyone know what this is when it's at home? I don't keep raw logs for my test site, and have never seen it anywhere else, but its visits are becoming more frequent over the past half-year: - - [08/Dec/2013:22:06:46 -0800] "GET / HTTP/1.1" 301 518 "-" "wscheck.com/1.0.0 (+http://wscheck.com/)" - - [08/Dec/2013:22:06:46 -0800] "GET / HTTP/1.1" 200 1231 "-" "wscheck.com/1.0.0 (+http://wscheck.com/)" - - [08/Dec/2013:22:06:46 -0800] "GET / HTTP/1.1" 200 1231 "-" "wscheck.com/1.0.0 (+http://wscheck.com/)" - - [08/Dec/2013:22:06:46 -0800] "GET / HTTP/1.1" 200 1231 "-" "SEOstats 2.1.0          https://github.com/eyecatchup/SEOstats"

That's 10 (ten) spaces in the middle of the second UA. Based on processed logs, it's always this pattern: two or three requests for front page from wscheck UA followed by just one from github from the same IP. Far as I can tell, the IP really belongs to ws-something-- but who are they?

No robots.txt, but doesn't follow blatant honeypot link either. (Nobody does. Perhaps giving it the classname "honey" made it too blatant.)