Login
You're viewing the y.diskcat.com public feed.
  • Nov 10, 2026, 3:34 PM

    Have you been getting suspicious traffic referred from aocr.org? You’re not alone.

    Curious traffic the pervasive overtness of which I haven’t seen before has been doing the rounds, so I’ve looked as deeply into it as I’m capable of doing.

    Short but dense: https://vale.rocks/micros/20261110-1531

    💬 3🔄 1⭐ 0

Replies

  • Nov 10, 2026, 3:35 PM

    I’m sure there is more about this story to discover.

    This traffic has actually been significant enough to raise the site from position 650,813 to position 631,034 on the Majestic Million list, and position ~4.28M to position 2,150,373 in the Tranco list over the past month.

    Pretty major.

    💬 0🔄 0⭐ 0
  • Nov 10, 2026, 3:50 PM

    Ege Demir traced it back to AS132510, which would invalidate the Volcano Engine or BytePlus theory, but AS132510 is so frequently a routing hop in Chinese net traffic that I feel it can be discounted.

    Otherwise, it could very well be ByteDance leasing compute (I think they mainly use AS150436?).

    💬 0🔄 0⭐ 0
  • Nov 10, 2026, 3:57 PM

    I had a theory that it might have been the result of many people following a guide, tutorial, or using a specific resource or tool. The wide swings in traffic would be explained by variations in popularity of the tool, with virality causing bursts in traffic during certain periods. It’d explain how it could be left as a default: inexperienced scrapers.

    It would justify the little effort that has been made to vary the referrer (people that don’t know why you should), the sudden bursts in traffic, the wide variation in servers and IPs used, and the occasional outlier user agents that don’t match the bulk. If this is the case, then I’m sure there is other referrer spam spurred by the same catalyst, but that it hasn’t made the news on account of being so low-traffic.

    However, the scale this scraping has happened at is significant. It is also rather uniform, and I’d expect more significant fluctuation if a wide variety of people are using the same tool or following the same instructions with their own spin. The variety of IPs are also clearly proxies, so there is no need to expect the variety to come from many users. One provider with many customers is more reasonable an argument. It falls apart as a theory if you look into it at all.

    💬 0🔄 0⭐ 0