https://ru.wikipedia.kim seems to be a clone of wikipedia that displays adds
It runs our exact FE code seems like so when you get a popup there is an eventlogging request ssend to:
that request that might look like:
It proxied (server side on their end, seems like) (WHY?) to our event logging beacon so we get a ton of spammy traffic.
This must have been going on for a while, it is just we are seeing events at a higher volume.