Understanding this weird traffic spike pattern

So I noticed this weird pattern on my little site hosted over on Hetzner (nothing fancy just a static site with a contact form and some portfolio stuff for my side gig doing logos for local businesses) and the traffic spikes are absolutely bizarre because every single day at exactly 3am my bandwidth usage jumps through the roof (and I mean we're talking like 200x normal levels here) and it lasts for about 45 minutes then drops back to baseline like nothing happened and at first I thought maybe it was some kind of crawler or botnet thing (you hear about those all the time right) but the user agents are all over the place and the IPs are from everywhere which made me think maybe it's not a single actor but then engzur will probably tell me to check my AS path or whatever (no offense @engzur you know I respect the craft) and I even checked my analytics but they don't match the server lo

AS-path won't help you here, this is inside your prefix. ASCII art of what you described:

Normal || spike || normal
~50MB |||||||||||||||||||||||| ~50MB
^ 3:00 AM

Flat CPU + 200s + old 404 endpoints = something YOU own is crawling yourself. Check your cron, check your staging. I've seen this exact pattern. Someone left a wget in a cron on a forgotten box. No ASN required to diagnose this.

Turned out my own backup script was running amok every night, pulling the same files over and over because the timestamp check was broken. They don't make them like that anymore, the debugging experience I mean. Modern tools make this easier but the mistakes stay the same. Check your forgotten environments. You probably have a staging site somewhere you set up six months ago and mentally archived.

$ awk '/03:00/,/03:45/' access.log | wc -l
847293

$ awk '{print $1}' access.log | sort | uniq -c | sort -nr | head
  847291 127.0.0.1

Decent detective work by engzur, meh on walt's log analysis skills. One IP. Not a botnet. Check your localhost.

Oh no. A forgotten staging environment. I have like three of those. On RackNerd. And CloudCone. And maybe Leaseweb too. This could be any of us. Right...

BROOO thats wild. Ur own box is attacking u. I had this on my Time4VPS vps once turned out I left a python scirpt running (scirpt not script lol) that was scraping my own site every night. Check ur crons. Server hosting mysteries!