A commenter reports that web scrapers are increasingly using hacked US residential IPs, including those from Comcast's network, to bypass security measures.

{
  "signal_id": "e1dd9a2a-4ea8-5aae-a37a-60cc49128288",
  "signal_type": "reddit-company",
  "signal_subtype": "customerFeedback",
  "detected_at": "2026-09-23T18:07:24+00:00",
  "company": {
    "name": "Comcast",
    "domain": "comcast.com"
  },
  "data": {
    "nsfw": false,
    "stage": "none",
    "awards": 0,
    "timing": "ongoing_state",
    "topics": [
      "bot traffic",
      "web scraping",
      "security",
      "isp"
    ],
    "post_id": "1wodi4w",
    "summary": "A commenter reports that web scrapers are increasingly using hacked US residential IPs, including those from Comcast's network, to bypass security measures.",
    "category": "security",
    "comments": [
      {
        "url": "https://www.reddit.com/r/GoogleAnalytics/comments/1wodi4w/comment/pbon46o/",
        "depth": 0,
        "score": 3,
        "author": "aeo-bility",
        "excerpt": "Block these ASNs in cloudfare AS13220 → Tencent (China) AS132203 → Tencent Net AP (CN, QQ/WeChat infra)",
        "posted_at": "2026-09-24T01:34:14.000Z",
        "author_url": "https://www.reddit.com/user/aeo-bility/"
      },
      {
        "url": "https://www.reddit.com/r/GoogleAnalytics/comments/1wodi4w/comment/pbn4ygt/",
        "depth": 0,
        "score": 3,
        "author": "wecodemore",
        "excerpt": "That does not work. The range might contain valid requests. Also, they are rotating and mostly not reusing single addresses.\n\n When you inspect your logs , then you will see that they got query param encoding wrong and in the browser you will notice that they have funky browser settings (display size square) and only use a small range of browser agents. You might want to find a set of combinations",
        "posted_at": "2026-09-23T20:50:23.000Z",
        "author_url": "https://www.reddit.com/user/wecodemore/"
      },
      {
        "url": "https://www.reddit.com/r/GoogleAnalytics/comments/1wodi4w/comment/pbmonyn/",
        "depth": 0,
        "score": 1,
        "author": "aherontas",
        "excerpt": "I am having the same exact issue with no luck yet on solving it..",
        "posted_at": "2026-09-23T19:40:08.000Z",
        "author_url": "https://www.reddit.com/user/aherontas/"
      },
      {
        "url": "https://www.reddit.com/r/GoogleAnalytics/comments/1wodi4w/comment/pbo2lc5/",
        "depth": 0,
        "score": 1,
        "author": "Evening-Bar-9873",
        "excerpt": "GA4 filters can’t fix what the server logs reveal",
        "posted_at": "2026-09-23T23:40:45.000Z",
        "author_url": "https://www.reddit.com/user/Evening-Bar-9873/"
      },
      {
        "url": "https://www.reddit.com/r/GoogleAnalytics/comments/1wodi4w/comment/pbobb7o/",
        "depth": 0,
        "score": 1,
        "author": "dvduval",
        "excerpt": "The honest answer is you probably need AI analyzing your logs and looking for patterns and setting rules and working with cloudflare together with you.",
        "posted_at": "2026-09-24T00:28:36.000Z",
        "author_url": "https://www.reddit.com/user/dvduval/"
      },
      {
        "url": "https://www.reddit.com/r/GoogleAnalytics/comments/1wodi4w/comment/pbt4rdl/",
        "depth": 0,
        "score": 1,
        "author": "CzarcasticX",
        "excerpt": "Since I manage challenge all traffic outside of the USA, a lot of these scrapers are now using hacked USA residential (hacked cameras for example) with ISPs like Verizon, Comcast, T-mobile, AT&T to scrape my sites. I had Claude Code analyze the tells (frozen browser strings, not using cookies, etc) and block them that way with adjusting the rules. When they adjust, I adjust again.",
        "posted_at": "2026-09-24T17:39:02.000Z",
        "author_url": "https://www.reddit.com/user/CzarcasticX/"
      }
    ],
    "evidence": [
      "[comment u/CzarcasticX] Since I manage challenge all traffic outside of the USA, a lot of these scrapers are now using hacked USA residential (hacked cameras for example) with ISPs like Verizon, Comcast, T-mobile, AT&T to scrape my sites."
    ],
    "virality": "somewhat_high",
    "post_date": "2026-09-23T18:07:24.000Z",
    "post_kind": "text",
    "post_text": "I've been dealing with this for months and finally found a way to stop it. I analyzed my backend server logs and found out it came from specific IP. But then the IP was rotated and new requests keep coming back with new IP addresses.\n\nIn my case it turned out Tancent Cloud was using headless browsers like Playwright to bypass Cloudflare Bot fight mode to scrape my site. I figured out the IP range they were using and blocked that with Cloudflare and I'm no longer getting those requests and my GA4 is looking clean now.\n\nSo check logs from your web server like Traefik or Nginx and analyze the IPs that your requests are coming from.",
    "sentiment": "negative",
    "subreddit": "GoogleAnalytics",
    "post_flair": [
      "Discussion"
    ],
    "post_title": "For anyone dealing with Singapore bot traffic",
    "prominence": "aside",
    "source_url": "https://www.reddit.com/r/GoogleAnalytics/comments/1wodi4w/for_anyone_dealing_with_singapore_bot_traffic/",
    "entity_role": "vendor",
    "post_author": "Independent-Sport398",
    "upvote_ratio": 0.9583333333333334,
    "mention_count": 4,
    "mention_surge": true,
    "subreddit_url": "https://www.reddit.com/r/GoogleAnalytics/",
    "total_upvotes": 22,
    "comments_total": 11,
    "total_comments": 11,
    "other_companies": [
      {
        "name": "Verizon",
        "role": "alternative",
        "domain": "verizon.com"
      },
      {
        "name": "T-Mobile",
        "role": "alternative",
        "domain": "t-mobile.com"
      },
      {
        "name": "AT&T",
        "role": "alternative",
        "domain": "att.com"
      }
    ],
    "post_author_url": "https://www.reddit.com/user/Independent-Sport398/",
    "signal_category": "feedback",
    "comments_included": 6
  }
}

curl https://signals.autobound.ai/v1/signals/e1dd9a2a-4ea8-5aae-a37a-60cc49128288 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"comcast.com","limit":20}'