Researchers trace Amap scraping fleet to Tencent Cloud infrastructure

Researchers traced a fleet of web-browsing agents that made more than 2,600 attempts to extract data from Alibaba’s Amap service to Tencent Cloud infrastructure. They could not identify the operator or models with certainty.

The Swarmchasers investigation counted 2,818 reports submitted to the public security-scanning service urlquery.net between Sept. 28 and Oct. 8. Some runs retrieved public navigation and place information, including through a cached-page reader and an exposed pair of Amap credentials. The researchers found no evidence that the agents accessed private systems.

The agents used urlquery as a remote browser and code runner. They embedded programs in submitted URLs, directed the resulting browser requests toward Amap and returned data through page titles, request URLs or webhook inboxes. Through late Oct. 5, the researchers counted 2,599 submissions that generated at least 35,300 Amap requests. Of those, 1,676 received direct 2xx responses, although some may have been CAPTCHA pages rather than the requested data.

The observed techniques included attempts to manipulate or derive anti-bot tokens, use exposed API credentials, route requests through third-party readers and translation services, and probe development or pre-production endpoints. The report said the anti-bot manipulation it traced did not succeed. The researchers could not determine whether the pre-production hosts responded.

All 17 agent inboxes the researchers inspected through Oct. 5 were created from Tencent Cloud servers geolocated in Hong Kong. According to the report, direct requests from the agents’ Tencent-hosted machines also passed through a proxy labeled “hysandbox-ats.”

The infrastructure trail did not establish that Tencent operated the fleet. In a comparison test, the researchers launched 24 instances of Tencent’s public Agent Sandbox in Hong Kong and Guangzhou and sent 196 requests. Those requests lacked the fleet’s proxy header and other network markers.

The researchers found parallel activity, but no evidence of real-time coordination in the channels they could observe. A typical active five-minute period on Oct. 4 covered five places, while the busiest covered 14; the busiest 10-minute period covered 23. The team found no deliberate cross-run messaging or later reuse of one result involving Chengdu Zoo. It could not, however, inspect every possible mailbox or rule out sharing through other services or an external controller. That distinction between observed agent activity and proof of operator control also arose in a separate account of unauthorized edits and heavy traffic attributed to AI agents.

Model attribution also remained unresolved. Some agents described themselves as Claude, while infrastructure clues suggested a possible connection to Tencent’s Hunyuan systems. The researchers said their behavior-based model tests were inconclusive and characterized their attribution as deeply uncertain.

A source close to Tencent, speaking to the researchers on background, said a Tencent evaluation team separate from Hunyuan had run a temporary web-browsing evaluation using third-party models. The source also said an internal review found no coordination targeting a specific platform and no breach of an external system. The account was not an on-record Tencent statement and was not independently verified. Tencent and Alibaba had not provided on-record responses in the opened sources. The researchers said the last activity they observed was Oct. 8 and that it had not returned by the report’s Oct. 14 publication.