If you have noticed a burst of visits with the referrer www.aocr.org in GA4, PostHog, Plausible, Umami, Fathom, or Cloudflare, you are not alone. The short version: the referrer is forged. AOCR is not involved, and the fingerprint points to a likely ByteDance crawler stack. Who operates it is not proven.

This post adapts the findings of Tin Analytics, "Getting traffic from aocr.org? That's ByteDance crawling your website" (29 Oct 2026).

What people are seeing

Since about 24 Sep 2026, many sites show visits with the referrer www.aocr.org (American Osteopathic College of Radiology). The pattern is consistent:


  • One page per visit, with a bounce rate near 100%.


  • One forum got 3,135 sessions in a day; another report cites 2,768 in a day.


  • Targets include GitHub repos, docs sites, and large company sites.


On the sites Tin monitors: clawmessenger.com had 187 visits (27-29 Oct, still active), tin.computer had 3, and two other sites had 74 (28 Sep-28 Oct).

Here is a screenshot from my own analytics traffic for nandan.dev

Why it is not a person, and not AOCR

Requests carry Sec-Fetch-Site: none, which means the page was typed in or opened by a program. A real click from another site would be cross-site. The referrer is forged.

AOCR does not link to your pages and shows no sign of a hack. Do not contact them. They have nothing to fix and nothing to tell you.

Why it points to ByteDance

Tin confirmed several independent signals that line up.

The network fingerprint

The TLS ClientHello sizes (1722/1754/1786/1818 bytes), HTTP/2 priority weight 256 exclusive, and an Accept header including image/heif match Bytespider, ByteDance's declared crawler. The numbers are stark:

Traffic group Matching requests
aocr.org crawler 199 of 199 (100%)
Declared Bytespider/TikTokSpider 646 of 1,142 (57%)
All other traffic 115 of 137,964 (0.08%)

Browser timing fields stock Chrome lacks

The browser timing data includes extensionTiming with forestResFrom and forestResLoadStart, plus htmlPredictorHit. "Forest" is ByteDance's internal resource loader. Of 37 real-visitor recordings, 0 had these fields.

The servers and the proxies

The real servers are in AS132510 (China Mobile, Shanxi). They run Linux x86_64 with 4 cores, 32 GB, and Chinese fonts, yet claim to be Windows. The time zone is Asia/Shanghai, the screen is 800x600, and each page gets a wait and scroll of about 28 seconds.

The IPs you see are not those servers. They are rented US proxies: 187 visits came from 186 different IPs (Datacamp/CDN77, Web2Objects, Ace Data Centres, EGIHosting, M247, and others) on ports 1180, 40000, and 60000, likely a commercial proxy pool.

What is not proven

It is not established whether a ByteDance team runs this or a customer of a ByteDance service (for example, Volcano Engine) using the same browser. Tin asked ByteDance for comment on 29 Oct 2026.

Say "likely ByteDance crawler stack", not "ByteDance did this".

Why now

The stack is old: Bytespider has existed since 2024. What is new since late Sep 2026 is a Windows Chrome 146 disguise, a US proxy pool, and the forged referrer. The referrer made previously invisible traffic visible.

There is precedent. In 2025, Cloudflare found that Perplexity ran undeclared stealth crawlers.

What to do

Do not block IPs. There is a new one per visit, so a blocklist is useless. Do not contact AOCR either.

Cloudflare WAF

  1. Create a rule with action Managed Challenge (start in Log mode) when the Accept header contains image/heif,image/avif and there is no sec-ch-ua header.
  2. Add a second rule where referer contains aocr.org.


Analytics exclusions


  • GA4: exclude session source aocr.org.


  • PostHog: exclude $referring_domain = www.aocr.org. The durable filter is $timezone = Asia/Shanghai with $screen_width = 800.


  • Plausible, Umami, Fathom: exclude the referrer.


Expect it to change

Expect the referrer to change; the fingerprint probably will not. That is why the Accept/sec-ch-ua rule and the Asia/Shanghai + 800 screen-width filter matter more than the aocr.org referrer rule.

Summary


  • The aocr.org referrer is forged; AOCR is not involved.


  • The fingerprint matches Bytespider in 199 of 199 requests, versus 0.08% of other traffic.


  • Attribution is "likely ByteDance crawler stack", not proven.


  • Challenge on the fingerprint (Log mode first), filter in analytics, and skip IP blocking.