Engineer identifies web scraper in 50 seconds by spotting missing asset requests in logs

A series of four overnight alarms — including database contention and collapsed read-replicas — prompted an engineer to investigate a sudden fivefold spike in traffic that began at 01:00 UTC. Analysis of live request logs revealed 155 of 187 requests originated from a single hosting provider's VPS range, all targeting just two URL families in sequential ID order. Despite rotating Chrome user agents designed to mimic human browsing, the scraper made no requests for CSS, JavaScript, fonts, or favicons — assets any real browser would fetch. The absence of these asset requests, already present in existing logs, was the key diagnostic signal that confirmed automated enumeration rather than legitimate user traffic. The engineer concluded that rate-limiting by ASN or IP prefix, rather than user agent, is the most effective mitigation, since user agents are attacker-controlled while network paths are not.