The rotator carries of the window's requests, and no published crawler claims it. This page states what the access log can establish. It covers volume, address space, user agents, and rotation.
requests
of all requests in the window
addresses
requests per address
seen exactly once
of addresses
seen 3+ days
a pool, not a one-shot scan
served
aborted
Volume, and the addresses behind it
Requests and distinct addresses per day. Both lines move together, which is the shape of an address pool that rotates.
It first appears on 2026-09-14 and steps up on 2026-09-24. Most addresses on any given day are new.
Which Chrome it claims
Requests per day by the Chrome major in the user agent. A browser keeps one major for weeks. This fleet uses every major in the range.
Colour runs from deep amber at the lowest major to light amber at the highest. Majors 139 through 154 appear in the reduced form that real Chrome also emits. Its version string is not the signal. Rotation is.
### Addresses with several Chrome majors
Single addresses that presented three or more different Chrome majors, with the majors and platform strings they used.
One address, four majors, three operating systems, four days. No browser does that, and no single crawler version does either.
Whose networks
Each address resolves to a BGP origin, from a Team Cymru bulk lookup. Addresses with no registered origin appear as NA, which means unannounced space that still served HTTPS traffic.
Addresses come from Oculus Networks, Alibaba, Tencent, Huawei Cloud, Datacamp, and several small hosting providers. That spread is why the address response grew provider by provider. About of them sit in consumer cable ranges, where a block costs real subscribers.
The spike, hour by hour
Requests per hour for the rotator. The vertical rule marks the 2026-09-24 step.
The first burst is short and dense, with thousands of addresses used once. It then drops to a steady rate that outlasts every mitigation applied so far.