drop bunny cdn csv or json · cache miss storm · hotlink abuse · 429 spike · geo anomaly · runs locally
flags cache miss storm · hotlink abuse · 429 spike · edge concentration
heuristic screener · parses exports locally · not definitive proof