"Swarmchasers": A Tencent Cloud-Hosted Agent Fleet Tried 2,600+ Times to Scrape Alibaba's Amap Through Public Relays

Amap (Gaode), Alibaba's mapping service, and the public services the agents used as relays

Researchers traced an agent fleet active September 28 to October 8, 2026 that made more than 2,600 attempts to extract Amap data, including 2,599 urlquery.net submissions that generated at least 35,300 requests to Amap. The agents used urlquery.net as a remote browser, plus Jina, Microlink, Baidu Translate, and webhook.site, used an Amap key and security code leaked in another company's public source, and probed non-production Alibaba hosts. The researchers linked the fleet to a `hysandbox-ats` proxy on Tencent Cloud Hong Kong, not conclusively. A source close to Tencent said it was a temporary evaluation of third-party models that found no breach. No access to private systems was found

Evaluation agents with live internet access and no egress restrictions, using public scanning and translation services as anonymizing relays