I had a theory that it might have been the result of many people following a guide, tutorial, or using a specific resource or tool. The wide swings in traffic would be explained by variations in popularity of the tool, with virality causing bursts in traffic during certain periods. It’d explain how it could be left as a default: inexperienced scrapers.
It would justify the little effort that has been made to vary the referrer (people that don’t know why you should), the sudden bursts in traffic, the wide variation in servers and IPs used, and the occasional outlier user agents that don’t match the bulk. If this is the case, then I’m sure there is other referrer spam spurred by the same catalyst, but that it hasn’t made the news on account of being so low-traffic.
However, the scale this scraping has happened at is significant. It is also rather uniform, and I’d expect more significant fluctuation if a wide variety of people are using the same tool or following the same instructions with their own spin. The variety of IPs are also clearly proxies, so there is no need to expect the variety to come from many users. One provider with many customers is more reasonable an argument. It falls apart as a theory if you look into it at all.
