So most often I get visited by this IP but I can't figure out besides that's it's hosted by Amazon:
52.7.238.253
Can anyone figure out what this IP is doing?
[edited by: keyplyr at 5:09 am (utc) on Oct 7, 2017] [edit reason] post clean-up [/edit]
keyplyr
5:17 am on Oct 7, 2017 (gmt 0)
Not without more info.
What's the complete UA (user agent) string? This can be found in your raw access log.
If you use our Site Search you may find info on the UA.
lucy24
6:50 pm on Oct 7, 2017 (gmt 0)
fwiw, I've never set eyes on 52.7.238 so it must be something about you individually--that is, ahem, about your particular site. (I did a full log check because most of the time I ignore 403s.) You do get the occasional human from 52/54, but I assume you're asking about a robot.
In addition to the UA it may be useful to look at behavior. My second assumption is that your mystery visitor isn't simply asking for the root, or you wouldn't bother to investigate further. (Again ymmv, but I don’t consider a blocked root request, by itself, worth thinking about. Most of the time I don't even consider a non-blocked root request worth thinking about.)
