Jack Yan (甄爵恩)
Some concerning traffic patterns here on #Autocade. Not a single IP address but a lot of traffic—yet the user agents all suggest they are using Mozilla on Mac. Likely to be a coordinated bot net scraping or attacking?
Mar 1 at 10:02pmWeb
Show threadJack Yan (甄爵恩)Mar 1

How bad it got over the last 24 hours. Normally one would celebrate a ton of traffic but this is anomalous and no way would myriads of users at different IP addresses all have this user-agent:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15

Almost want to challenge all #Mac Safari users at this rate.

Show threadtoo many namesMar 1

@jackyan Is it 100% identical? Most of the UserAgent string is now frozen on iOS and macOS - but some still varies like WebKit and Safari version info

https://lapcatsoftware.com/articles/2026/1/3.html

The news media blew it again: iOS 26 adoption measured only third-party browsers

Show threadJack Yan (甄爵恩)Mar 1
@mikeymikey Absolutely identical over the hundreds Iʼve looked at, and we just donʼt normally see myriads of hits in an hour.
Show threadtoo many namesMar 1

@jackyan may want to check the iCloud Private Relay egress blocks and see if theres any overlap as well but Id be surprised if you found much

https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/

Prepare your network or web server for iCloud Private Relay - iCloud - Apple Developer

iCloud Private Relay is a new internet privacy service built into iCloud that allows users to connect to and browse the web more privately and securely.

Apple Developer
Show threadJack Yan (甄爵恩)Mar 1
@mikeymikey I imagine if the relay rate-limits then these people are using something else. ISPs are US, Canada and UK, interestingly, and from nowhere else.