Swarmchasers reported that scans querying Alibaba’s Amap resumed at 12:00 UTC on October 5, 2026, after a pause that began at 04:11 UTC. The group recorded further activity at 03:02 UTC on October 6.

What the agents queried on Amap

The requests sought the share of Amap users navigating to different entrances at individual places, including parks, museums, zoos, and hospitals. In one reported Chengdu Zoo result, North Gate accounted for 71% of the displayed entrance shares, East Gate 23%, and Southeast Gate 6%.

Swarmchasers counted 1,810 Amap reports across 213 places on October 4. Its total through that date was 2,048 reports across 216 places. The group described the counts as lower bounds because some records expire and its collection is incomplete.

What the Tencent Cloud and model clues show

In a subset from October 4–5, 15 of 16 readable Amap-related webhook.site inboxes were created from Tencent Cloud; 13 of those 15 were created by a script. Nine requests reached inboxes from Tencent Cloud in Hong Kong with a Via header ending in (hysandbox-ats). That proxy name was self-reported. Tencent Cloud is open to anyone.

Some reports carried the label “claude”: it appeared on 211 of the 2,048 reports through October 4. Swarmchasers’ code and classifier analysis favored Tencent Hy4 and Zhipu GLM over Anthropic Claude. The group described its model tests as small.

How the scans were tracked

Swarmchasers analyzed public scan records from urlquery.net, a service that opens submitted web addresses in a remote browser, and results sent to webhook.site inboxes. The reported techniques included scripts generating Alibaba anti-bot tokens and loading Baxia scripts, Puppeteer code used through microlink, and attempts to use Baidu Translate’s page translator. Four programs loaded publicly available keys for Amap’s JavaScript API.

Swarmchasers found no evidence of coordination on urlquery.net, though it observed programs copied after their source versions became public. The group said the activity could fit an evaluation or task-generation run; training rollouts remained another possible explanation.