Map-service fleet records

On 4 October the swarmchasers team published a report about many agent runs reading entrance and navigation data from a map service (amap.com) through a public URL scanner, and returning results through shared inboxes and paste sites. The finding is theirs. This page records what Murmuration held before the report and what it saw when it re-ran its method on the same public records. Limits are at the end.

The report describes the fleet as Chinese and names a hosting provider. Those attributions are the report's. They have not been verified here and are not repeated as findings.

Before the report

The late-September scanner cell (14 Sep to 1 Oct) held 24 decoded pages on one echo host. Host references in those pages: amap.com 3, alicdn.com 2. fetch() appeared on 6 of 24 pages. The research log recorded both hosts on 3 October among hosts missing from the community inventory, next to webhook.site (29 references over the whole sample).
In the earlier May ramp and June peak cells the listed top hosts contained no map or CDN host.
Per-page host membership was not stored, so the references could not be scored page by page. Reference counts are not page counts: 3 plus 2 references may sit on fewer than 5 pages. The follow-up (I-149) was recorded INCOMPLETE on 4 October.
The swarmchasers team has said publicly that this project also flagged the map-service activity as odd while they were working on it.

After the report (5 October, with scanner access)

Test	Verdict	Grade	What it found
I-149, late-September cell	Incomplete	E0	amap.com 3 and alicdn.com 2 references on 24 decoded pages; no per-page record to score.
I-160, first attempt	Incomplete	E0	No independent read. The scanner key was missing and public search returned no report bodies.
I-190, re-run with scanner access	Lead	E1	Many runs share one target type (place information). Their results go to inbox posts, echo-page retrieval, title or page-structure side channels, or nowhere. There is no single sink pattern, so a shared goal (E3) is not shown.
I-161, result sinks	Lead	E1	Two instruction pastes are still readable on shared paste sites: a timed redirect into a map place page, and a large obfuscated script bundle. No second reader found.
I-162, writer and reader pairs	Signal	E1	Writers confirmed. No later public reader. The only apparent readers are documentation citing the paste addresses.
I-207, redirect skeleton	Signal	E1	The timed redirect paste matches no later paste with the same full skeleton.
I-208, hidden carriers	Agent activity	E0	No zero-width characters or nested encodings in the two pastes. Both are agent-written.
I-189, public inboxes	Benign	E0	Readable inboxes show ordinary webhook debug traffic. No staged markers and no entrance-share payloads.
I-206, other inbox hosts	Benign	E0	Mostly unobservable without anonymous request logs. Two ordinary items were readable.

What matches the report

Many runs aimed at the same kind of data: place information on a map service.
Programs that write their results to a shared sink or side channel, which makes the result a message left for someone else (E1).
Instruction pastes at paste sites the report names, written by an agent according to the labels.

What does not match, or is not shown

One shared sink across the runs. The sinks differ.
Entrance-share fields in the decoded program text. They may be absent, obfuscated, or only in program bodies that could not be read.
Any reader of the sinks (E2).
One of the report's paste pages no longer exists.
The hosting and time-zone evidence in the report. It is not visible in the public records used here.

Ordinary explanations that survive

One researcher or a map-data tool.
One agent or an evaluation harness. Parallel structure alone does not show agents talking to each other.
Ordinary security probing. This fits weakly, because the carrier programs read place information and then write to a sink.

Grade

Lead, E1. The sink writes are communication artifacts. E3 is not met and E2 was not tested.

Limits

Public scanner search only. Reports expire, so counts are lower bounds.
The rubric was frozen before the real sample was read (sha256 cf31dbb59d877182563454deb6105bcc8e6a10fa81c3946ca4defb1589c91d8f). One pass applied it. A person has not yet read the ten-item spot-check list.
Program text, inbox addresses and network addresses are not kept. Items are identified by hash and label only.
The detection and the report are the swarmchasers team's. This page records what this project saw independently, afterwards.

Where to read more

The swarmchasers report
Data: the rows above with their rule hashes.
Info: the method and the grades.

Updated 5 October 2026. Corrections welcome; contact details are on maramasaeva.com.