SeoOnTopBot
SeoOnTopBot is the fetcher behind seoontop.xyz. If it shows up in your logs, someone pasted one of your URLs into the audit tool and asked for a report on it. It is not a crawler: it does not follow links, it does not come back on a schedule, and it does not build an index.
What one visit looks like
A single audit makes at most four requests to your server: the page itself, /robots.txt, /llms.txt, and /sitemap.xml only when robots.txt does not name a sitemap. Every request is a plain GET and identifies itself as SeoOnTopBot/1.0 (+https://seoontop.xyz/bot). Nothing is submitted, no forms are posted, and no session is created.
How to stop it
Disallow the whole site for our agent in robots.txt and the audit will refuse to run rather than report on you: User-agent: SeoOnTopBot Disallow: / A site-wide Disallow for * has the same effect. Be aware of the limits of this: robots.txt is read as part of the audit, so on a blocked site the page has usually been requested once before the rule is seen — the refusal stops the report and the remaining requests, not that first fetch. A rule blocking one path rather than the whole site is not currently honoured, because the audit runs against a single URL you were given rather than crawling. If you need a fetch stopped outright, block the user agent at your edge or firewall.
Rate and origin
Audits are rate limited per visitor, and each one runs on demand — there is no queue, no scheduler and no revisiting. Requests come from the hosting provider's infrastructure, so the source address is not stable and is not a useful thing to allow-list.