It's sort of fun to detect the unmistakable fingerprint of a crawler operating through residential IPs. In this case I could detect it because I gave its first request a HTTP bounce-for-validation redirect and it requested the (distinctive) target from a completely different second IP a couple of seconds later (and failed validation, because it was impersonating Chrome not well enough).

I knew they were out there but seeing proof is another thing. Maybe I should stick data in the redirects.