Threat report CR-2026-001

NarrowWindow

TLP:CLEAR · published 13 November 2026 · figures as of 13 Nov 2026, 07:00 UTC · RexOS G0DBYE Threat Research

Status: active. Last observed 13 Nov 2026, 06:58 UTC.

Executive summary

RexOS G0DBYE Threat Research has identified an automated scraping operation, tracked as NarrowWindow, targeting CraftRank since 2 November 2026. The operation systematically requests public content across the site, including server listings, vote pages, the resource catalogue and every language version, through a rotating residential proxy network.

The operation's network footprint is designed to evade reputation-based controls: requests originate from 1,267 residential and mobile addresses in 74 countries, nearly all of them used once and most with no prior abuse history. NarrowWindow was nevertheless identified with high confidence through a consistent and physically impossible browser profile: a mobile-size viewport on a large desktop display without touch input, combined with a fixed New York time zone across all source countries.

All activity was mitigated by RexOS G0DBYE. Each source address was blocked on its first page view at the latest, which prevented the operation from traversing any section of the site. No authenticated area, voting function or data store was affected. The operator remains unattributed.

We are publishing the behavioural indicators so that other operators can detect the same tooling. To our knowledge, this is the first public documentation of this profile.

Najważniejsze wnioski

• Scale. 1,272 blocked requests from 1,267 addresses across 295 networks in 74 countries.
• Address rotation. 1,262 of 1,267 addresses (99.6%) were observed exactly once, consistent with a commercial rotating residential proxy service.
• Fixed device template. Every request presented the same viewport, screen, platform, time zone and language, while the browser version and reported hardware varied, indicating an anti-detect browser running a single template with limited randomisation.
• Broad collection objective. 913 distinct URLs were requested, spanning 8 language versions, pagination and filter combinations. No individual server or page was singled out.
• Effective mitigation. Device-level detection, not address reputation, stopped the operation. Address-based blocking alone would not have been effective because each address was rarely reused.

Activity timeline

Blocked requests per day (UTC).

Outside of peaks, the operation runs continuously at a steady rate, which is characteristic of scheduled automation. During the first week the baseline was 25 to 45 requests per hour. On 11 November a single surge of 483 requests between 17:00 and 22:00 UTC, concentrated on resource pages in all languages, is consistent with a manual increase in capacity.

Behavioural indicators

The following attributes were reported by the client browser and were consistent across all observed source addresses.

Individually, each attribute is common. In combination they are not. A desktop browser window cannot be resized to a 375-pixel width, so B1 together with B2 and B3 indicates that the viewport was set programmatically, typically to obtain a lighter mobile layout. B5 is inconsistent with the geographic distribution of the source addresses: a genuine client's time zone follows its location, while NarrowWindow presents a single New York time zone on connections in Vietnam, Indonesia, France and Taiwan.

B7 and B9 change between sessions while B1 to B6 remain fixed. This pattern is characteristic of anti-detect browser software operating from a fixed profile template with selected fields randomised. We therefore assess the reported hardware values as part of the template rather than a description of the underlying systems.

Infrastructure analysis

• Source networks. Traffic originated almost exclusively from residential broadband and mobile networks. The largest shares by country were Vietnam (326), the United States (320), France (89), Indonesia (83), Taiwan (41).
• Rotation. The near-total absence of address reuse indicates per-request or per-session exit rotation, a standard feature of paid residential proxy services.
• Reputation. At the start of the operation, the majority of source addresses had no abuse reports, suggesting a fresh or lightly used proxy pool. Current reports against these addresses originate from this campaign.
• TLS. TLS client fingerprints varied evenly across sessions. Chrome randomises parts of its TLS ClientHello, so this variation is expected and does not indicate multiple tools.
• Relay latency. In the first week, application round-trip times exceeded transport round-trip times by 150 to 370 ms. The gap was independent of the exit country, which indicates that it reflects the proxy provider's relay path and cannot be used to locate the operator's systems.

Targeting analysis

1,272 blocked requests covered 913 distinct URLs. The distribution is consistent with a breadth-first crawl rather than targeted manipulation of specific listings.

Language versions requested: French, English, Polish, Russian, Spanish, German, Portuguese, Turkish. Request volume remained well below levels that affect availability; the objective was content collection, not disruption.

Detection and mitigation

We recommend the following controls to organisations that want to detect NarrowWindow or comparable tooling. None of them depends on address reputation.

1. Viewport and display consistency. Flag clients that report a viewport narrower than about 480 pixels on a desktop-class screen with zero touch points (B1–B3).
2. Time zone and geolocation consistency. Compare the client time zone with the country of the connecting address (B5). A single time zone across many countries indicates one system behind proxies.
3. Cross-address profile correlation. Count identical combinations of B1–B6 across unrelated residential networks within 24 hours. Genuine user populations do not align at this level across dozens of countries.
4. WebRTC behaviour. Treat the absence of any ICE candidate (B8) as a supporting signal only, in combination with the checks above.
5. Device-level enforcement. Apply blocks to the matched profile rather than to the source address. Address blocklists built from this traffic consist of third-party residential connections and have little preventive value.

Assessment

We assess with high confidence that the observed traffic is controlled by a single operation. This is based on the impossible device profile (B1–B3), a single time zone across 74 countries, a continuous automated schedule and a small set of hardware presets.

We assess with moderate confidence that the operation relies on a commercial scraping or browser-automation service that bundles residential proxies with anti-detect browser profiles. The fixed United States template, per-session randomisation and clean proxy pool are typical of such services.

We are unable to assess the identity or purpose of the end customer. Plausible categories include AI training-data collection, SEO tooling and content replication. Network telemetry did not expose the operator's own infrastructure, and relay timing reflects the proxy provider only. NarrowWindow remains unattributed.

Note on network indicators

This report intentionally does not publish source IP addresses. The 1,267 addresses belong to residential subscribers whose routers, computers or mobile devices relay proxy traffic, frequently without their knowledge through bundled applications or malware. Publishing them would expose victims rather than the operator, and their indicator value expires within minutes. Each blocked address was reported to AbuseIPDB with a neutral description of the observed behaviour. Full evidence, including UTC timestamps, request metadata and SHA-256 hashes of the source logs, is retained and available to network operators and law enforcement on request.

Methodology

Findings are derived from RexOS G0DBYE telemetry on CraftRank: per-request decision logs, browser sensor results, edge TLS fingerprints and WebRTC responses. Campaign membership is established by exact matches on the device template (B1–B6). Geographic attribution of addresses uses an IP-to-ASN and country database and is approximate. Figures in this report refresh hourly from live telemetry and are retained beyond the 14-day log window. No external system was probed or contacted during the investigation.

Revision history

Legal notice to operators

This notice is addressed to the operator of NarrowWindow and to anyone running comparable tooling against CraftRank. It summarises legal risks; it is not legal advice, and the outcome in any case depends on the jurisdiction and the facts.

• Terms of use. Our terms allow automated collection of content only through the API public or with written permission, and prohibit using proxies, many addresses or other means to get around our limits and security checks.
• Circumventing security measures. Deliberately evading access controls, for example by rotating residential addresses and disguising the browser after being blocked, can amount to unauthorised access to an information system under computer misuse laws such as Article 243 of the Turkish Penal Code, the national laws implementing EU Directive 2013/40/EU, the UK Computer Misuse Act 1990 and the US Computer Fraud and Abuse Act.
• Intent. Ordinary crawling can be done in good faith. Rotating proxy networks and anti-detect browsers serve one purpose, to defeat blocking, and are evidence of deliberate circumvention in civil claims such as breach of contract, unfair competition and damages.
• Database and content rights. Systematic extraction of a substantial part of a database can infringe the database maker's rights under EU Directive 96/9/EC, and copying texts such as guides and descriptions can infringe copyright, regardless of the addresses used.
• Personal data. Player names and profiles are personal data. Collecting them brings obligations under the GDPR, the Turkish KVKK and similar laws. Routing the collection through proxies does not change who is responsible for it.
• Proxy infrastructure. Residential proxy networks are often built on devices enrolled without their owners' informed consent, through bundled SDKs or malware. Knowingly relying on such infrastructure can create further liability for its users.

We retain the evidence for this operation, including UTC timestamps, request metadata and SHA-256 hashes of the source logs, and make it available to network operators and law enforcement on request. We reserve the right to pursue all available legal remedies. Legitimate access to CraftRank data is available through the API public.

How CraftRank is protected: craftrank.org/pl/security