www.aocr.org referral traffic is a bot, not visitors
Since late September 2026, many websites show visits from www.aocr.org. On one of our sites, these visits were 112 of 189 visitors in one day. A headless browser makes them. It uses rented proxy addresses and a false referrer.
What you seein your analytics.
The referrer is www.aocr.org. This is the website of the American Osteopathic College of Radiology. Each visit opens one page. Then the visit stops. Most analytics tools show a bounce rate near 100% and almost no engagement.
We found the bot on four sites that we monitor:
| Site | Visits | Dates (UTC) |
|---|---|---|
| clawmessenger.com | 165 | 27 Oct to 29 Oct, still active |
| tin.computer | 3 | 26 Oct to 29 Oct |
| Two other sites we monitor | 74 | 28 Sep to 28 Oct |
Other site owners report the same visits since about 24 September. One forum got 3,135 sessions in one day. The targets include GitHub repositories, forums, documentation sites and large company sites. Thus, the bot does not target one type of site.
The referrer is false.Nobody clicked a link.
Other site owners published the full request headers of these visits. The requests contain Sec-Fetch-Site: none. A browser sends this value when the user types an address or a program opens it. A real click from aocr.org sends cross-site.
Thus, the bot writes the referrer itself. aocr.org does not link to your pages. We found no sign of a hack on aocr.org. Do not contact AOCR about this traffic. They do not cause it.
The fingerprintis the same on every visit.
- User agent
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
- Screen
- 800 × 600
- Viewport
- 800 × 600
- Time zone
- Asia/Shanghai
- Language
- en-US
- Referrer
- https://www.aocr.org/
- Sec-Fetch-Site
- none
800 × 600 is the default window of headless Chrome. Puppeteer also uses 800 × 600 as its default viewport. Chrome 146 is from March 2026. In October 2026, the current version is 157.
The time zone is Asia/Shanghai, but the addresses are in the United States and Europe. Anti-detect browsers set the time zone to agree with the proxy. This bot does not. Thus, the operator probably uses a script on a computer set to China time.
Session recordings show the same steps on each visit. The page loads. The bot waits approximately 28 seconds. It scrolls one time and closes the page. It does not move the pointer or click. Each visit uses a new browser profile.
The IP addressesare rented proxies.
On clawmessenger.com, 163 visits came from 163 different addresses. They came from these networks:
| Network | ASN | Visits |
|---|---|---|
| Datacamp (CDN77) | AS212238 | 54 |
| Web2Objects | AS62874 | 32 |
| Ace Data Centers | AS11798 | 17 |
| EGIHosting | AS18779 | 13 |
| M247 | AS9009 | 10 |
| NET3 (Contact Consumers) | AS46635 | 10 |
| FDCservers | AS30058 | 9 |
| RCN | AS6079 | 6 |
| Leaseweb USA | AS19148, AS7203 | 6 |
| Other networks | 6 |
Most of these networks sell server and proxy capacity. Some address blocks have Brazilian or old IBM registrations, but geolocation shows them in US cities. This is usual for rented proxy addresses.
We used public data to examine 36 of the addresses. 35 had only ports 1180, 40000 or 60000 open, on nine different networks. Oxylabs documents port 60000 for its dedicated proxies. Some of the address blocks are registered to Code200 UAB. Court records connect Code200 to Oxylabs.
Thus, the bot probably uses a commercial proxy service. A proxy service has many customers. This data does not identify the operator of the bot.
What the bot wantsis probably text.
The bot opens text pages: blog posts, documentation and forum threads. It does not submit forms. It does not try login pages.
It also opens old addresses and pages that do not exist. Thus, it gets its list of pages from an old crawl, not from your sitemap. On our sites, it chose pages about AI agents, MCP and agent frameworks. It did not open the pricing page.
These facts agree with a scraper that collects text, for example for AI training. We cannot confirm this.
How to remove itfrom your reports.
- Google Analytics 4. Make a segment that excludes the session source aocr.org. If you have no real visitors at 800 × 600, exclude that screen resolution too.
- PostHog. Exclude events where
$referring_domainiswww.aocr.org. To find the bot after it changes the referrer, filter$timezone=Asia/Shanghaitogether with$screen_width=800. - Plausible, Umami and Fathom. Exclude the referrer www.aocr.org in your filters or block it in the site settings.
- Cloudflare. Make a WAF custom rule with
http.referer contains "aocr.org". Set the action to Managed Challenge.
Do not block the IP addresses. The bot uses a new address for each visit. Also expect changes. Other bots of this type changed their screen size after people filtered them.
Questions.
Is www.aocr.org traffic real?
No. A headless browser makes these visits and sends www.aocr.org as a false referrer. The requests show that nobody clicked a link.
Is aocr.org hacked?
We found no sign of a hack. aocr.org is the website of the American Osteopathic College of Radiology. The bot only uses its name.
Is the bot dangerous?
On our sites it only read public pages. It did not submit forms or try login pages. It changes your analytics data and uses some of your bandwidth.
Can I block it by IP address?
No. The bot uses a new proxy address for each visit. Filter the referrer and the fingerprint, or use a challenge rule at your CDN.
See which visits are AI agents.Sign up for Tin.
Tin Analytics records each visit to your site on its own service. It shows people, AI agents that use a real browser, crawlers and visits from AI assistant answers as separate groups. Tin is an open-source marketing system. It runs in your coding agent or in the browser.