146 — Broader Chinese swarm hunt: feasible infrastructure
Updated 2026-09-06 UTC

Recommendation
The most informative additional access would be an existing, always-on machine on mainland Chinese broadband that the user owns or has permission to use, with SSH and a dedicated research browser profile. Proposed working specification: 2 CPU cores, 4 GB RAM, 40–70 GB disk; no GPU needed. This is our practical starting specification, not an official minimum or a guarantee that sites will allow access.

If that is unavailable, one small Hong Kong VPS is a reasonable experiment. Tencent's official Lighthouse pricing table retrieved today lists Hong Kong Linux 2 cores/4 GB/70 GB disk/30 Mbps/2048 GB monthly transfer at USD15/month; the 2-core/2-GB/40-GB HTTP-probe option is USD6/month. Check actual checkout availability and price before purchase; no purchase has been made.
https://intl.cloud.tencent.com/document/product/1103/47794?lang=en

Hong Kong is not a substitute for a mainland network. Alibaba explicitly describes outside-mainland regions as using international routes without direct mainland connectivity, potentially subject to latency or packet loss. Whether either option improves these particular research targets remains untested.
https://www.alibabacloud.com/help/en/simple-application-server/product-overview/regions-and-network-connectivity

What to provide
An SSH-accessible host with a dedicated research user and a browser we can run there. Configure key access rather than sending cloud root credentials in chat. If a browser session already legitimately opens the relevant services, that is independently useful even without a new machine. Keep browser remote-control ports private, using an SSH tunnel if needed. Existing licensed search API access could improve discovery, but will not create deleted pages or unlock unavailable code-search features.

What we would do first
Run the existing ten-target portable comparison kit from the new host and the current host in the same window; inspect returned content, not just HTTP status. Repeat a small comparison before expanding. Then compare rendered-browser access where HTML only returns a JavaScript shell. Record timestamp, URL, final URL, status, content hash, useful-page/challenge classification and provider region. The old kit predates newer catalog discoveries, so add separately documented controls if necessary.
http://178.105.23.35:8090/china/downloads/vantage-probe.zip
Local kit: investigation/china/vantage-probe/probe.py and README

Observed gaps and working routes
- ClawdChat public posts/circles: direct HTTP works on current server; embedded public page data contains bodies and dates. Report144. No extra machine needed for this lead.
- openJiuwen site and PyPI package: current access works. Report145 verifies published team/scheduler/wiki code by static inspection.
- Moltbook profile: current direct retrieval was a JavaScript shell. Rendering is the next access test, not automatically a geography problem.
- NST about page: certificate hostname validation failed; this is not evidence of geographical blocking.
- Gitee: browser project search works; gist routes are separate. Reports089/090.
- GitCode: browser project discovery works, signed-out code search unavailable in tested session. Report093. Another IP does not establish entitlement to that feature.
- ModelScope: four public catalog GET routes work. Reports100/101/114. Catalog metadata is not global code or log search.
- Baidu: earlier success, later challenges. Reports032/113. Mainland/browser comparison could resolve a real uncertainty here.
- BWiki recent-changes API worked in earlier two-vantage tests; Huiji challenged both. Report032. Measurements are historical and may change.
- Archive coverage: completed Common Crawl scans cannot be expanded merely by changing IP.

Priority
One distinct network plus a usable browser is more informative than many identical search bots. No evidence currently calls for GPUs, rotating proxy farms or another large corpus host. Existing AWS corpus remains preserved; its present billing state has not been revalidated in this pass. OpenRouter guard accounting is separate from infrastructure cost.

Research status
WorkSwarm is implemented Chinese-associated team software, not an observed escaped fleet. ClawdChat yields public interaction under persistent handles, but autonomy, separate operators and private task execution remain unverified. These leads broaden the investigation beyond XZ; neither is an XZ attribution. Next useful evidence is a dated interaction chain joined to externally observable task output or a public runtime log.