old UA:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en; rv:1.9.0.13) Gecko/2009073022 Firefox/3.5.2 (.NET CLR 3.5.30729) SurveyBot/2.3 (DomainTools)
new UA:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:59.0) Gecko/20100101 Firefox/59.0
current IP:
64.246.165.abc
or, more exactly, 64.246.165.\d\d?0 (i.e. the last bit is always a multiple of 10; maybe someone else’s site gets the ones ending in 1 or 2 or etcetera.)
This is the robotic equivalent of a good news / bad news joke, or at best “two steps forward, one step back”. Since they thoughtfully include a From: header, I'll see what they have to say.
I think they changed around the beginning of April. Concurrently it looks as if they stopped sending a referer (blahblahdomaintools.com/sitename).
(And what the heck is a Wshost or a Wsip? The former seems to mean “wrong form of your hostname”--which reminds me that, although they request robots.txt, they don't actually read it, because they only request it from the wrong name, which on this site leads to a redirect.)
