The Day I Logged 1 in Every 2000 Public IPv4: Visualizing the AI Scraper DDoS
On April 24, 2026, the author's small personal infrastructure experienced an intense and sustained wave of web scraping, receiving approximately one in every 2,000 public IPv4 addresses over 24 hours. The attack involved over 2 million unique IPv4 addresses, with traffic peaking at 50 requests per second, overwhelming a modest VPS. Visualizations show the geographic and network distribution of the attack, highlighting its scale and decentralized nature.
- ▪The attack generated over 5 million bot-classified requests across two websites in 24 hours.
- ▪Approximately 2,035,978 unique IPv4 addresses, or 1 in every 2,000 public IPv4 addresses, accessed the author's services that day.
- ▪202 out of 256 IPv4 /8 blocks had at least one address involved in the scraping activity.
- ▪The top source IP belonged to Microsoft (AS8075), while others were from Google's network (AS15169).
- ▪The author blocked entire autonomous systems including Alibaba, Huawei Cloud, and Zenlayer due to sustained scraping attempts.
Opening excerpt (first ~120 words) tap to expand
The Day I Logged 1 In Every 2000 Public IPv4: Visualizing The AI Scraper DDoS 2026-04-28 (Tue) ; by ~lux ; 1167 words ; about 6 minutes ; #ai scrapers; #ddos; #dataviz; #iocaine; In an attempt to grasp the magnitude of web scraper attacks against my websites, i went the way of visualizing. i don’t think i need to explain to you, dear reader, why web massive web scraping is a pain in the ass. This is not going to be a post as researched or informational as that first one. i’ve been fighting web scrapers as much as i could for almost two years now, and the battle is getting tough. Some tools, like Iocaine (thanks Algernon for the work you put into it) help a lot by at least sparing my backend from gratuitous amounts of requests (sometimes multiple dozens per second, each completely random).
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at VulpineCitrus.