fix

internal/features/spike.go

@@ -94,10 +94,11 @@ func DetectSpikes(events []Event, at time.Time, cfg SpikeConfig) []Spike {
 	}
 	services := map[string]*svc{}
 	for _, e := range events {
+		// Bad actors (scanners, crawlers getting 4xx) are noise for alerting.
 		// A duplicate is a later hop of a request whose outermost error is
 		// already counted; counting it again multiplies every failure by the
 		// number of services it crossed.
-		if !e.IsError || e.IsDuplicate {
+		if !e.IsError || e.IsDuplicate || e.BadActor != "" {
 			continue
 		}
 		ts := e.Timestamp.UTC()