When I dug into auth logs I noticed a weird pattern hitting our server at odd hours. It just kept tryed outdated API endpoints like it had a vendetta. The fingerprint was off and session headers kept flipping between random values. Feels like someone testing our ratelimits before going all in. Has anyone else seen something like this in their logs lately