源于 www.aocr.org 访问流量问题

文档站这两天突然收到上千个源自于 www.aocr.org 转过来的访问，每个 ip 仅访问一个页面，怀疑 AI 爬虫。于是，去问了一些 ChatGPT。GPT 给出的答案：

Yes. Based on recent investigations, the traffic coming from www.aocr.org is very likely automated bot traffic, not real visitors. There is also evidence suggesting that it is associated with ByteDance's crawler technology.
This is particularly interesting because other website owners have reported exactly the same phenomenon recently, including:
A sudden increase in visits attributed to www.aocr.org.
Almost every visit viewing only one page.
Very high bounce rates.
Traffic appearing from different IP addresses.
No meaningful engagement or conversions.
There is a recent investigation published on October 29, 2026, that describes this exact behavior.

大体意思是，这些流量来自自动机器人爬虫，而非真实访客。有证据指向字节跳动的爬虫技术。有其他站长也报告了类似的事件。

1. What is www.aocr.org?
American Osteopathic College of Radiology
The actual website is a legitimate US professional organization for radiologists.
Website: aocr.org
However, the organization itself is probably unrelated to the traffic reaching your website.
The crawler appears to be using its domain as a fake HTTP referrer. In other words, it makes requests to your website while pretending that visitors came from aocr.org.
This does not mean aocr.org is sending visitors to you or has been hacked.

爬虫使用了 aocr.org 伪造了 HTTP referrer.

2. Is it an AI crawler?
Possibly, and there is some interesting evidence.
The October investigation found that this crawler:
Uses a browser fingerprint very similar to ByteDance's Bytespider crawler.
Appears to run on servers in a China Mobile data center.
Uses different proxy IP addresses for different visits.
Pretends to be a Windows Chrome browser.
Uses www.aocr.org as its referrer.
The investigation found a strong technical similarity to ByteDance's crawler infrastructure.
However, it has not been conclusively established that ByteDance itself operates this particular crawler.
It could be ByteDance or a third party using its technology.
So I would classify it as suspicious automated crawling, potentially related to AI data collection, rather than confirmed AI training traffic.

报告指出，爬虫使用的浏览器指纹与字节的 Bytespider 爬虫使用的指纹非常相似。像是运行在中国移动数据中心上的服务器，伪装成 Chrome 浏览器并使用了不同的代理 IP。使用了字节的技术，并不意味着一定就是字节自己在操作这些爬虫。既有可能是字节自己在用，也有可能是其他第三方使用了它的技术。可能与 AI 数据收集有关。

3. Why does it visit only one page?
This is one of the strongest clues that you're dealing with automated traffic.
A normal visitor might:
….
This crawler appears to:
Request one page.
Wait or perform some browser-like activity.
Leave without navigating to another page.
Consequently, your analytics may show thousands of visits but almost no useful engagement.
It can also distort:
Traffic reports.
Bounce rate.
Average engagement time.
Referral source statistics.
Conversion rates.

只访问一页，是爬虫的常见行为，自不用多说。

ChatGPT 提到的报告请戳这里：https://tin.computer/blog/aocr-org-referrer-bot

正如 GPT 也提到的一样，该报告确认了几点：

这些访问的网络指纹与字节的 ByteSpider 爬虫高度相似，
其浏览器所报告的内部计时字段中，包含了字节跳动资源加载器的名称。
真实服务器位于山西(或者陕西,英文使用拼音shanxi)的一个中国移动数据中心。这些服务器是运行中文系统字体的 Linux 服务器，谎称自己是 Windows 计算机。

报告不能确定的是，谁在操作这些爬虫。既有可能字节自己的团队，也有可能是字节的客户。

请求中包含 Sec-Fetch-Site: none 请求头。这个值表示请求由浏览器直接发起，与任何站点上下文无关‌，典型场景是地址栏输入、点击书签或直接打开本地文件甚至是由程序直接打开网址，而非从某个页面跳转或跨域调用。‌‌如果用户在 aocr.org 网站上进行实际点击，则会触发跨站（cross-site）请求。

因此得出的结论是，爬虫自行填写了 “引荐来源”（referrer）信息。与 aocr.org 网站无关。

报告中提到的请求指纹：

User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36

Referrer: https://www.aocr.org/

Sec-Fetch-Site: none

Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/heif,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7

Client hints: none (no Sec-CH-UA)

TLS ClientHello:1722, 1754, 1786 or 1818 bytes

HTTP/2 priority:weight 256, exclusive

Screen: 800 × 600

Time zone:Asia/Shanghai

报告指出这与真实的 Chorme 146~157 不同。真实的 Chrome 会发送客户端提示（Client Hints）、权重为 16 的 HTTP/2 优先级，以及长度为 1714、1746、1778 或 1810 字节的 ClientHello 报文。其 Accept 头部中不包含 image/heif。

aocr.org 的爬虫虽然没有自报身份，但它所使用的网络栈与 Bytespider 相同。

爬虫的会话记录中包含了页面计时数据。其中每条记录都包含了一些原生 Chrome 浏览器所没有的字段，即 extensionTiming（包含 forestResFrom 和 forestResLoadStart 子字段）以及 htmlPredictorHit。

“Forest”是字节跳动内部资源加载器的名称。字节跳动开源的 Lynx 项目代码中曾提及“类似 Forest 的定制化资源加载器”。因此，该爬虫很可能使用了字节跳动基于 Chromium 构建的浏览器版本。我们并未在任何公开代码中发现这些字段名称。

源于 www.aocr.org 访问流量问题

1. What is www.aocr.org?

2. Is it an AI crawler?

3. Why does it visit only one page?

最新文章：