I don’t use WordPress at all but multiple times per day, an unexplained bot pings random articles on our site. This bot is coming from Automattoque/wordpress.com IP addresses such as 74.114.154.10, 74.114.154.11, and 74.114.154.12. For those unaware, Automattoque (AKA Automattic) is the company that owns WordPress.com and creates many plug-ins for WordPress such as JetPack.
Specifically, this bot pings a handful of articles multiple times and nearly every ping has a different spoofed user agent such as:
* Tumblr/14.0.835.186
* Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)
* Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36
* Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
* Mozilla/5.0 (compatible; um-LN/1.0; mailto: [email protected]; Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1
* Mozilla/5.0 (iPhone; CPU iPhone OS 15\_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Mobile/15E148 Safari/604.1
Frequently, the user agent is empty.
Does anyone know what is doing this exactly? Is it some sort of scanning tool or plug-in?
[ad_2]
Have you double checked that those IP addresses belong to Automattic? User Agents can ve easily spoofed.
Jetpack does offer outage notifications, though, so traffic from a legitimate Automattic IP could be for that.