# Mystery aocr.org Traffic Is Likely Crawlers

If you have noticed a burst of visits with the referrer `www.aocr.org` in GA4, PostHog, Plausible, Umami, Fathom, or Cloudflare, you are not alone. The short version: **the referrer is forged.** AOCR is not involved, and the fingerprint points to a likely ByteDance crawler stack. Who operates it is not proven.

This post adapts the findings of Tin Analytics, ["Getting traffic from aocr.org? That's ByteDance crawling your website"](https://tin.computer/blog/aocr-org-referrer-bot) (29 Oct 2026).

## What people are seeing

Since about 24 Sep 2026, many sites show visits with the referrer [www.aocr.org](http://www.aocr.org) (American Osteopathic College of Radiology). The pattern is consistent:

- One page per visit, with a bounce rate near 100%.
- One forum got 3,135 sessions in a day; another report cites 2,768 in a day.
- Targets include GitHub repos, docs sites, and large company sites.

On the sites Tin monitors: [clawmessenger.com](http://clawmessenger.com) had 187 visits (27-29 Oct, still active), tin.computer had 3, and two other sites had 74 (28 Sep-28 Oct).

#### Here is a screenshot from my own analytics traffic for [nandan.dev](http://nandan.dev)

![](https://cdn.hashnode.com/uploads/covers/628769bf89168247f55ee8b0/5a5bf8c5-544f-434b-875f-d0ba6acd44c2.png align="center")

## Why it is not a person, and not AOCR

Requests carry `Sec-Fetch-Site: none`, which means the page was typed in or opened by a program. A real click from another site would be `cross-site`. **The referrer is forged.**

AOCR does not link to your pages and shows no sign of a hack. **Do not contact them.** They have nothing to fix and nothing to tell you.

## Why it points to ByteDance

Tin confirmed several independent signals that line up.

### The network fingerprint

The TLS ClientHello sizes (1722/1754/1786/1818 bytes), HTTP/2 priority weight 256 exclusive, and an Accept header including `image/heif` match Bytespider, ByteDance's declared crawler. The numbers are stark:

| Traffic group | Matching requests |
| --- | --- |
| [aocr.org](http://aocr.org) crawler | 199 of 199 (100%) |
| Declared Bytespider/TikTokSpider | 646 of 1,142 (57%) |
| All other traffic | 115 of 137,964 (0.08%) |

### Browser timing fields stock Chrome lacks

The browser timing data includes `extensionTiming` with `forestResFrom` and `forestResLoadStart`, plus `htmlPredictorHit`. "Forest" is ByteDance's internal resource loader. Of 37 real-visitor recordings, 0 had these fields.

### The servers and the proxies

The real servers are in AS132510 (China Mobile, Shanxi). They run Linux x86_64 with 4 cores, 32 GB, and Chinese fonts, yet claim to be Windows. The time zone is Asia/Shanghai, the screen is 800x600, and each page gets a wait and scroll of about 28 seconds.

The IPs you see are not those servers. They are rented US proxies: 187 visits came from 186 different IPs (Datacamp/CDN77, Web2Objects, Ace Data Centres, EGIHosting, M247, and others) on ports 1180, 40000, and 60000, likely a commercial proxy pool.

## What is not proven

It is not established whether a ByteDance team runs this or a customer of a ByteDance service (for example, Volcano Engine) using the same browser. Tin asked ByteDance for comment on 29 Oct 2026.

Say "likely ByteDance crawler stack", not "ByteDance did this".

## Why now

The stack is old: Bytespider has existed since 2024. What is new since late Sep 2026 is a Windows Chrome 146 disguise, a US proxy pool, and the forged referrer. **The referrer made previously invisible traffic visible.**

There is precedent. In 2025, Cloudflare found that Perplexity ran undeclared stealth crawlers.

## What to do

**Do not block IPs.** There is a new one per visit, so a blocklist is useless. Do not contact AOCR either.

### Cloudflare WAF

1. Create a rule with action **Managed Challenge** (start in **Log mode**) when the `Accept` header contains `image/heif,image/avif` and there is no `sec-ch-ua` header.
2. Add a second rule where `referer` contains `aocr.org`.

### Analytics exclusions

- **GA4:** exclude session source `aocr.org`.
- **PostHog:** exclude `$referring_domain` = `www.aocr.org`. The durable filter is `$timezone` = `Asia/Shanghai` with `$screen_width` = 800.
- **Plausible, Umami, Fathom:** exclude the referrer.

## Expect it to change

Expect the referrer to change; the fingerprint probably will not. That is why the Accept/`sec-ch-ua` rule and the Asia/Shanghai + 800 screen-width filter matter more than the [aocr.org](http://aocr.org) referrer rule.

## Summary

- The [aocr.org](http://aocr.org) referrer is forged; AOCR is not involved.
- The fingerprint matches Bytespider in 199 of 199 requests, versus 0.08% of other traffic.
- Attribution is "likely ByteDance crawler stack", not proven.
- Challenge on the fingerprint (Log mode first), filter in analytics, and skip IP blocking.

Source: [tin.computer/blog/aocr-org-referrer-bot](https://tin.computer/blog/aocr-org-referrer-bot)