(untitled)

This hints at the scope of their scraping. Of the last 1M requests, 10.56.12.{109,110,113} seem to be responsible for 93k (based on X-Forwarded-For) but these 3 private IPs have used the 400 public IPs I mentioned previously. IOW, 3 private IPs -> 400 public IPs -> my server It certainly smells like an attempt to make the traffic look more legit by using a large pool of public IPs.