turns out it was a bot: https://mj12bot.com/

they did try to read robots.txt, which I didn't have. that's fixed now.

strange behavior though, they were walking through events ids in lexical order calling the thread endpoint nostr.io/t/, and it turns out I left out a critical index in my events table, so that was causing multiple table scans on each route served.