Bot traffic: security.wholereach.com

all sites · all domains · last 15 days

All sites · All Domains · Visit security.wholereach.com

Who is really visiting security.wholereach.com?

Between Oct 23 and Nov 6, security.wholereach.com received 3,741 requests. About 99% came from automated software and about 0.5% look like real people.

That works out to about 8 human visitors, roughly fewer than 1 a day, who opened 11 pages between them. 3 of them read more than one page.

The biggest source is bots that say who they are. Most of those are normal and some, like search engines, help people find the site.

Bottom line: the hit counts on the All Domains worksheet are almost entirely bots. Use the human visitor figure here to judge this site's real audience.

99%of requests from bots
8human visitors (estimate)
11pages opened by people
3,741total requests, 15 days

Where the requests came from

People 0.5%Named bots 42%Disguised bots 30%Scanners 26%Unclear 0.7%

Requests per day

PeopleNamed botsDisguised botsScannersUnclear
0150300450600Oct 23Oct 25Oct 27Oct 29Oct 31Nov 2Nov 4Nov 6

Human visitors per day

Same days, people only, on their own scale so they are visible.

01234Oct 23Oct 25Oct 27Oct 29Oct 31Nov 2Nov 4Nov 6

The breakdown

SourceRequestsΣ 3,741ShareData sentBlockedby the serverWhat this means
Disguised scrapers1,08529%41 MB0Claims to be a normal browser but only downloads pages, never the images or icons a real browser fetches, reads many pages without ever clicking a link, or runs from a cloud provider.
Search engines65518%23 MB0Crawlers that say who they are, such as Google, Bing, Apple and Amazon. Usually welcome: this is how people find the site.
Break-in scanners58716%5 MB6Probing for WordPress logins, password files and other common weak spots.
Other named bots53314%14 MB1Any other software that identifies itself as a bot.
Scanners posing as browsers40211%10 MB0Other requests from an address also caught probing for weak spots.
AI crawlers2286.1%6 MB0AI companies gathering pages or answering a user's question, and saying so.
SEO and marketing tools1554.1%4 MB60Commercial tools that sell data about websites.
Scripts and tools491.3%2 MB0Programs such as curl or Python, or anything with an unrecognizable name.
Unclear280.7%<1 MB0Browser name, but fetched only an image or data file and no page. Could be either.
Likely people170.5%<1 MB0Opened a page and also fetched its images or icons, at a human pace, from a non-cloud address.
Possibly people20.1%<1 MB0Read 1 to 3 pages, arrived from a search engine or social link, no icons fetched. Referrers can be faked, so treat these as maybe.

Named bots

Botas it names itselfTypeRequests
PetalBotSearch engines433
ElevenlabsCrawlerOther named bots240
meta-webindexerOther named bots137
OAI-SearchBotAI crawlers106
SERankingBacklinksBotSEO and marketing tools93
ClaudeBotAI crawlers81
ApplebotSearch engines76
Amzn-SearchBotSearch engines69
GoogleOtherOther named bots59
RiverBotOther named bots50
SemrushBot-BASEO and marketing tools47
bingbotSearch engines40
GPTBotAI crawlers32
GooglebotSearch engines27
facebook.comOther named bots17

What people opened

Pages opened by at least two different human visitors.

PageHuman visitors
/5

How people arrived

Referring siteHuman visitors
m.baidu.com1

Where disguised bots operate from

Address blocks, not individual addresses. A heavily used block with many addresses suggests one operator rotating through them.

Address blockRequestsAddresses used
158.173.0.0/16522
47.79.0.0/161815
47.82.0.0/161615
62.212.0.0/16161
45.149.0.0/16141
87.81.0.0/161313
184.163.0.0/16131
128.65.0.0/16121

Day by day

DayHuman visitorsHuman pagesNamed botsrequestsDisguisedrequestsScannersrequestsUnclearrequestsAllrequestsBot share
Oct 230014256302250299.6%
Oct 24113916015796%
Oct 2500122280115199.3%
Oct 2611140790322498%
Oct 271110586196139099.2%
Oct 28001241380226499.2%
Oct 29001151470326599%
Oct 300061460210998%
Oct 313383400113095%
Nov 11219874158243599%
Nov 2002036884135699.7%
Nov 3009093144433199%
Nov 4232217484228798%
Nov 500104160212298%
Nov 600237321111899.2%

How this was measured

Every request in the server log was sorted by what it did, not only what it claimed to be. Bots that name themselves are counted as named. Anything claiming to be a browser had to act like one: open a page, fetch its images or icons, move at human speed, and come from outside the big cloud providers. These are estimates. A careful bot can pass the test, and a person with images blocked or a cached icon can fail it, so read the human figures as a good approximation, not an exact count. One person using two devices counts as two visitors. Google Analytics-style tools would show different numbers because most bots never run their script. Logs are kept for 15 days.

Built 2026-11-06 22:41 UTC from 15 log files.