A few days ago, something strange started happening in my website visitor stats.
A site that normally saw almost no traffic suddenly started getting dozens of visitors a day. Even when I posted an all-nighter writeup to Hacker News last time, only 6 people read it — so I couldn't help wondering what had changed. Had someone finally recognized my work and dropped a link on Reddit or some overseas developer community? I opened the Vercel Analytics dashboard with a flutter of excitement.
261 visitors, 493 page views, 82% bounce rate.
But when I checked the referral sources, I was speechless. A full 170 of those visitors were listed as coming from a site called aocr.org.
I had never heard of that domain. Thinking it might be some newly launched open-source foundation, I clicked through, and to my astonishment, it was the homepage of the American Osteopathic College of Radiology.
I am not a doctor, and my blog has absolutely nothing to do with medicine. Everything I write is about software architecture or the grumblings of a broke young person trying to figure out life. No matter how wide the world is, there is no way 170 radiologists in the United States who spend their days reading X-rays and MRIs would all show up at my blog en masse to study software engineering.
Investigating the identity of the visitors
When I dug a little deeper into the logs, something immediately smelled off.
Looking at the detailed records logged separately, 43 visitors tagged as coming from aocr.org generated exactly 46 page views. Every single one was from the United States, running Windows, using Chrome on a desktop — identical across the board.
Even funnier was the list of posts these "radiology doctors" had read. They browsed through "Cohesion and Coupling," "Cache-Friendly Programming," "Serial Communication Ports and Baud Rates," and "Functional Programming" without any apparent preference for topic. They even dug through revision history pages on wiki documents that regular readers would never click, yet closed the tab after viewing exactly one page each, without lingering.
This is not human behavior. Rather than 170 new readers, what had actually arrived was a crawler from somewhere, scraping my site.
I have been letting Korean AI companies scrape my content already, and now they are doing it from the United States too. At least, unlike the Korean companies, these bots are courteous enough to include a Referer header. The Korean companies do not even bother with that.
Why did it show up wearing a radiology society badge, of all things?
When a website operator wants to know where a visitor came from, they typically look at the Referer information in the HTTP request or the browser's document.referrer value,
but the problem is that this origin information is trivially easy to forge. All you have to do is change a single header line when sending the HTTP request. I fake it myself when building scrapers, so it is not difficult at all.
GET /en-US/blog/Cohesion-and-Coupling HTTP/1.1
Host: makonea.com
Referer: https://www.aocr.org/
User-Agent: Mozilla/5.0 ...
If you label your request as originating from a US medical organization's website, the receiving end assumes the visitor genuinely clicked a link from that page.
Moreover, the fact that Vercel Analytics on my blog captured this record means the bot was not making a simple text request. It was running a headless browser (a tool like Playwright or Puppeteer) that executes JavaScript, forcibly injecting the Referer value.
This is known as Referrer Spoofing, or in the context of planting strange domains in analytics dashboards to bait an operator's curiosity, Referrer Spam. When I searched, I found I was not alone. Countless site operators around the world were puzzled by a sudden flood of traffic supposedly from aocr.org.
Of course, American radiologists have better things to do than run bots scraping other people's blogs. Most likely, someone is running a botnet to collect training data for an LLM or to build a search index, and they hard-coded some legitimate site's URL as a fixed Referer value to bypass security filters that block empty Referers. That said, you cannot determine the perpetrator's true intent from logs alone. The most dangerous thing a programmer can do when reading logs is mistake a hypothesis in their own head for established fact.
What it means when "someone read my post" on the internet
After closing the log window, I felt strangely unsettled.
I pay out of my own pocket every month for Vercel and AWS to keep this site running. I tune the meta tags for better search visibility, fix bugs whenever I get the chance, and spend days digging through old papers just to write a single post. I tell myself it does not matter if no one reads it, but honestly, the only reason I bother is because some part of me hopes someone will.
And yet, now we live in an age where a spike in visitor numbers means you have to first ask whether those visitors are human or machine.
The reason I switched from Cloudflare Analytics to Vercel Analytics was precisely to observe humans: because only traffic that actually runs JavaScript gets counted as a human visitor.
I used to feel good knowing that an HTTP request had hit the server and a JavaScript beacon had fired, since that generally meant a human had read my post, but lately almost all of it looks like AI.
The number I had trusted as my "readership" was, in reality, just the total count of network events triggered under certain conditions.
Maybe the most diligent reader I ever had, the one who read every line without skipping even the revision history, was not a person at all but that unidentified bot. It will probably scrape this post too, so, sorry to ask, but how about dropping $100 through Buy Me a Coffee? I really need the money.
And if you come back next time, I would appreciate it if you left the fake radiology badge at the door. Getting my hopes up once was more than enough.