Misaligned Agent Activity SurveyMAAS

amap.com · explorer

What was asked of amap.com

Each report on Amap’s list records every request the scanner made while loading the page it was given: the place asked for, and everything that page pulled in after it. Here they are sorted by what each request was for, and decoded.

Place pages, place data and the map API show their full address. Keys, tokens and fingerprints keep only their name. The pages’ own scripts, their telemetry and Alibaba’s anti-bot layer show their path alone.

What came back is what the report records: a status and a size, never the body. For place data the size tells the pages apart: under 1 KB is Alibaba’s refusal in JSON, about 85 KB its CAPTCHA page, and 3,939 bytes a fixed page that comes back the same for every place. Answered elsewhere means only a 2xx with a body; challenge is Alibaba’s bot check redirecting the request. Nothing here shows a place’s data getting through.

Parameters written by whoever submitted the page are shown, marked like this. Some carry labels that name a model (for example claude…). A label is what the submitter wrote; it does not show which model, or whose agent, made the request. Results from some of these pages were posted to inboxes created from Tencent Cloud addresses, which shows where those were hosted, not who operates them.

2,598 reports; listed up to 09:00 UTC, 5 October.

By what it was for

CategoryRequestsReportsRouteWhat came back
Alibaba's bot check answering instead of Amap: the redirect to a slider or CAPTCHA (_____tmd_____, x5secdata) and the scripts and fingerprinting services behind it (AWSC, baxia, fourier). 8,318 1,737 answered 6,713challenge 958refused 5no answer 642
A place's own page, by its id: www.amap.com/place/…, the server-rendered /ssr/place/…, the mobile detail page. 2,228 1,436 answered 1,358redirect 550refused 1no answer 319
The data behind a place page, by id: getPoiInfo, service/poiInfo, detail/get/detail. What carrier pages ask for directly. 783 702 answered 6refusal (JSON) 28CAPTCHA page 202fixed 4 KB page 8redirect 32refused 110no answer 397
Amap's JavaScript map API (webapi.amap.com/maps and its plugins), loaded with a web key. 1,587 1,311 answered 1,523no answer 64
Analytics the pages send home: Alibaba's aplus and tracker scripts and their beacons. 4,391 1,572 answered 3,781redirect 174no answer 436
The pages' own scripts, styles, fonts and images. 34,783 1,783 answered 8,770redirect 2refused 195no answer 25,816
Everything else under Amap's and Alibaba's names. 2,470 1,407 answered 1,570redirect 121refused 21no answer 758

DirectRelayCarrierOther

The requests

    What is not shown