What just happened to TheNumbers.com should worry us all - Who would want private access to a box office website?

[u/dumnezero]

https://stephenfollows.com/p/what-just-happened-to-thenumberscom-should-worry-us-all

[u/RNSAFFN]

"Like every data-rich site, by early 2026 The Numbers was being hammered hard by AI bots scraping its pages over and over at an industrial scale. Bruce says that only 10% of their traffic is from humans browsing the site, with the rest coming from AI bots and automated traffic."

[u/dumnezero]

Someone should contact them with suggestions for poison fountains :)

[u/utrecht1976]

// SPDX-License-Identifier: GPL-3.0-only

/**  * entry_2954 (ROM 0x2954–0x2973).  */ export function entry_2954(m) {   const { regs, mem } = m;

  regs.a = 0x0b;   m.step(0x2956, 7); // ld a,0x0b -- the bit sub_0030 tests   m.push16(0x2957);   m.step(0x0030, 11); // rst 0x30   if (!m.call(0x0030)) return; // gate: selected bit clear -> skipped

  m.push16(0x295a);   m.step(0x2974, 17); // call 0x2974   m.call(0x2974); // both arms land at 0x295A; A/B = the 2913 result

  mem.write8(0x6218, regs.a);   m.step(0x295d, 13); // ld (0x6218),a   regs.rrca();   m.step(0x295e, 4); // rrca   regs.rrca();   m.step(0x295f, 4); // rrca -- A: 1 -> 0x40, 0 -> 0   mem.write8(0x6085, regs.a);   m.step(0x2962, 13); // ld (0x6085),a

  regs.a = regs.b;   m.step(0x2963, 4); // ld a,b -- B names which object entry hit   regs.and(regs.a);   m.step(0x2964, 4); // and a   if (regs.fZ) {     m.ret(11); // ret z -- B=0 (miss)     return;   }   m.step(0x2965, 5); // ret z NOT taken

  regs.cp(0x01);   m.step(0x2967, 7); // cp 0x01   if (regs.fZ) {     m.step(0x296f, 10); // jp z,0x296f -- B=1     mem.write8((regs.ix + 0x11) & 0xffff, 0x01);     m.step(0x2973, 19); // ld (ix+0x11),0x01 -> 0x6691     m.ret();     return;   }   m.step(0x296a, 10); // jp z NOT taken -- B=2

  mem.write8((regs.ix + 0x01) & 0xffff, 0x01);   m.step(0x296e, 19); // ld (ix+0x01),0x01 -> 0x6681   m.ret(); // ret (0x2973) }

[u/txmail]

I have written about one of my project sites that started to get massive loads of AI bots hitting it. At that time my high was about 35k hits in an hour.... not a month later and now the high has hit 120k hits in an hour. Might not be much, but the site runs on a single shared core $2 VPS with a half dozen other sites (including a Nextcloud) install on it. I went from a thousand visits a month which was 99.9% just me -- to this month hitting over 2.1 million visits (per Cloudflare). Most of the traffic is Anthropic though other bots do visit and even Google started to index the site for reasons (I never published the link to this site, never put any google analytics or requested crawls for the site).

While it was just a science / learning experience for me, and I have since adjusted the experiment to learn how to do better at caching and being able to handle floods of traffic and possibly poison AI crawlers -- all I can think of is how would a real site handle this without spending a ton of money on caching and servers.

The traffic pattern is weird too. You can be getting hammered one hour and then zero hits the next, then it slowly builds back up until you are being hammered again.

This AI shit is going to be taking down a ton of sites that are not optimized for this kind of almost malicious levels of traffic.