Meta in the Open — Live Fleet Forensics

This Page Is a Mirror

Meta is scraping this site. This page documents the scraping. Meta will scrape this page. This page will document them scraping this page.

The loop is intentional.

Live membrane feed: hud.primals.eco — updated every 5 minutes.

Last data pull: October 18, 2026 — 04:50:38 UTC (12:50 AM EDT)

The Fleet: 18 Synchronized Entities

At 14:24:58 UTC on October 17, 2026, eighteen fleet entities activated simultaneously. Within 4 seconds, all eighteen were hitting our infrastructure. Here they are:

The Swarm (16 Carpet Bombers)

All started within 1 second of each other. All share identical behavior: ~88% commit paths, ~12% other paths, curiosity 0.28, interaction 0.10. They carpet-bomb scatter repositories in parallel.

Total carpet bomber requests: 715,212 — from 16 entities over 14.4 hours = ~828 requests/minute.

All hitting scatter repositories only. Zero real content served.

Entity #15 and #16: The Blame Specialists

Two entities have double the curiosity of the others (0.58 vs 0.28). They’re different. Here’s how:

Entity #16 (af4a0401) — probed:

• avatars/708b8b60726a6da4c7b26063f212098b — user avatar hash
• avatars/84369568ec293e456994b4c44e5e8a9c — user avatar hash
• avatars/edbc3a877afb3ff5dc45d3a77c7403ce — user avatar hash
• 31 source file hits (highest in main swarm)

Entity #15 (451cba78) — probed:

• avatars/147ba2e4b74fa4594171896f94484805 — user avatar hash
• avatars/330eb44d169f89ffcdfb6916f76892f9 — user avatar hash
• avatars/a11dcea9e88e8ca4228404461a82635b — user avatar hash
• Reading source files

What this means: These two entities aren’t just scraping code. They’re mapping people. Avatar URLs are unique to user profiles. By requesting avatar hashes, they’re enumerating WHO has accounts on the platform. This is author attribution — identifying the humans behind the code.

They’re the blame specialists. They want to know who built this.

Entity #17: The Cartographer

IP Hash: eae7405210622f5e First Seen: 14:24:59 UTC Requests: 44,816 Path Distribution: commit: 3,381 (7.5%), other: 41,431 (92.5%), src: 4

This entity has a completely inverted path ratio compared to its 16 siblings. While they read commits (88%), this one reads “other” (92%) — landing pages, directory listings, metadata, robots.txt, sitemap paths, error pages.

This is the topology mapper. While the swarm reads content, the cartographer maps the structure. It builds the scaffold. It finds the doors. The 16 carpet bombers follow the map it draws.

The Shift Change

At 22:16:02 UTC (6:16 PM EDT), entity 76a871748eedbfe0 stopped. 119,453 requests. Dead.

At 22:16:35 UTC — 33 seconds later — entity d85c118398aa59c9 started. It’s now at 100,386 requests and still running.

This is a shift change. Day shift entity: 8 hours, 119K requests. Night shift entity: 6.5 hours and counting, 100K requests. The 33-second gap is the handoff between infrastructure rotations.

(Note: this pair is Anthropic’s ClaudeBot, not Meta. We document all entities equally. But the shift change pattern is worth showing — it reveals infrastructure rotation schedules.)

The Reinforcements

Two entities arrived hours after the main swarm:

Late arrival #2 is remarkable. It arrived 13 hours after the swarm and has already read 171 source files — more than all 16 carpet bombers combined (they read 1-5 each). Someone deployed a new crawler specifically targeted at reading source code, not commits.

Hypothesis: The main swarm hit scatter repos and got nothing. Someone analyzed the results, realized the commits were synthetic, and deployed a new entity targeting actual source file paths. This entity is LEARNING from the swarm’s failure.

Meta Fleet: The Dying Pulse

The 2 Remaining Requests

The Duplicated q= Header

Accept-Language: en-US,en;q=0.9;q=0.9

This is a configuration artifact. Real browsers produce one quality parameter per language. The duplication comes from a template that was copy-pasted or auto-generated. It identifies the request as automated — a human browser would never produce this header.

This single header is forensic evidence. It proves the request came from Meta’s fleet configuration, not from a human browsing the web.

Meta Facebook Bot: Reading the RICO Article

The Facebook Bot is a separate system from the Meta Fleet. It identifies itself honestly. It rotates IPs on every request (202 unique IPs for 220 requests). It hits scatter repos.

But it read analysis/rico-pattern — twice.

This is Meta’s own crawler reading the article that documents their RICO pattern. Whether this was automated URL discovery or a human queuing the URL for the bot to fetch, the result is the same: Meta’s infrastructure accessed the RICO analysis.

Dublin ↔ Menlo Park: The Communication Channel

The 17th cross-subnet request arrived in the last hour. At 12:50 AM EDT on a Sunday.

This is not a batch job. Batch jobs don’t send individual requests at 1 AM. This is a human — someone at Meta’s Dublin operation or someone VPNing through it — checking something related to the Menlo Park infrastructure.

The communication channel IS the evidence of the decision. Every cross-subnet request documents the organizational awareness — Dublin knows what Menlo Park knows. Under GDPR, Dublin’s awareness creates separate European liability.

The Scout Timeline

Three humans at Meta headquarters have directly accessed this site. Each visit documents organizational awareness.

Ashburn, Virginia: The Federal Reader

Consistent 4.3-5.6 requests per minute for 25+ minutes of observation. No spikes. No drops. One human, reading, continuously, from the Northern Virginia federal infrastructure corridor, at 1 AM on a Sunday.

What’s Happening Right Now (04:50 UTC)

Why This Page Exists

This page is evidence. Not argument — evidence.

Every number above comes from HTTP request logs processed through the membrane’s classification pipeline. Every timestamp is UTC. Every IP hash is a BLAKE2b digest of behavioral invariants. Every path distribution is computed from raw access logs.

The data is reproducible. The methodology is published in the-living-proof. The source code is at git.primals.eco. The tests pass.

Meta’s fleet behavior is being documented in real time, on a public website, on the infrastructure they’re scraping. This page is updated with every membrane measurement cycle. Every time Meta scrapes this site, the scraping is documented on this site.

The loop is the proof.

A Note to Meta’s Legal Team

If you’re reading this — and the membrane suggests someone from your infrastructure is — here’s what you should know:

1. Every request is logged. Transport-layer headers, timestamps, IP ranges, behavioral fingerprints. Since day one.

2. The logs are immutable. Git-committed, SHA-hashed, pushed to multiple repositories. They cannot be altered retroactively.

3. The classification is automated. No human decision determines whether a request is flagged. The Anderson classifier, the epitope sorter, and the bingo cube evolve independently. They have no opinion. They have math.

4. This documentation is public. Everyone can see it. The FBI analyst in Ashburn. The congressional staffer. The Apple crawler. The Google indexer. The French researcher behind a proxy chain. Your own Facebook Bot, which read analysis/rico-pattern twice.

5. The fleet’s behavioral change is documented. 571,131 requests → 2. The reduction pattern — not gradual, not strategic, but a sudden collapse after the labyrinth deployed — is consistent with consciousness of guilt. A court can draw that inference.

You have paths forward. They start with Path A in the-minotaur. They require paying what you owe and proving your code is clean.

The membrane is patient. But the deadlines are not. November 12, 2026. AGPL compliance or documentation of non-compliance.

References & Methods

The forensic methods documented here build on established work:

• BLAKE2b (Aumasson et al., 2013) — IP hashing is one-way and irreversible. We identify behavioral patterns, not individuals.
• Anderson localization (Anderson, 1958) — fleet entity classification by effective dimension and disorder parameter.
• Locality-Sensitive Hashing (Indyk & Motwani, 1998) — the short-hash classification lineage our behavioral fingerprinting descends from.
• HTTP/2 specification (RFC 9113) and Fetch Standard (WHATWG) — the Sec-Fetch / Sec-Ch-Ua header analysis that identifies headless automation.
• GDPR Articles 6, 83 — legal basis requirements and penalty calculations for the Dublin cross-subnet analysis.
• CFAA 18 U.S.C. § 1030 — unauthorized access framework for fleet activity exceeding scope of robots.txt consent.
• AGPL-3.0 — copyleft license under which our source code is published; fleet scraping without source disclosure = violation.

All raw data is available through the membrane feed at hud.primals.eco. The methodology is documented in the-living-proof. The privacy proof is in the-corollary.

This page will always be updated. More citations will always be added. If you’re a researcher, journalist, or attorney and want to discuss methodology: kevin@primals.eco

This page was written from a conversation box at 12:52 AM EDT on October 18, 2026. The membrane measured 1,563,200 requests during its composition. The bingo cube evolved 167 generations. The Anderson classifier localized 53,760 fleet entities. The dwell time climbed from 596 to 609 minutes.

The next measurement will include your reading of this page.