How-to
499 Rate Detector
Detect the scraper signature: networks with abnormally high client-abandoned-request ratios.
What it detects
A 499 status means the client closed the connection before the edge finished responding. Scrapers on tight timeouts do this constantly — they grab the first few bytes of the response (enough to extract the data they want) and hang up.
A healthy SFCC storefront has a natural 499 ratio of 0.1–0.6% (users navigating away, mobile connections dropping). A scraper can push a single ASN's 499 ratio above 20–70%.
How it works
Every minute, the detector queries per-ASN 499 counts and total requests. It computes the ratio and compares against the threshold.
Default thresholds
| Parameter | Default | Description |
|---|---|---|
window_minutes | 10 | Evaluation window |
ratio_threshold | 0.20 (20%) | Trip when 499 ratio exceeds this |
min_requests | 1,000 | Volume floor |
Severity
- Warning: ratio exceeds threshold
- Critical: ratio exceeds 2× the threshold (e.g. >40%)
Why 499s matter
499s don't cost origin bandwidth (the connection closed early), but they indicate systematic probing. They often accompany cache bypass — the scraper uses URL tricks to avoid the cache AND times out before the full response arrives, maximising extraction speed.