In a server system providing data security, a processor monitors requests or activities of a computing device and compares the monitored requests or activities with a database of predetermined characteristics to determine whether the monitored requests or activities indicates that the computing device (i) accessed or attempted to access sequentially more than a predetermined number of data files or objects in less than a predetermined period of time, and (ii) downloaded a predetermined number of data files or objects. The monitored requests or activities is determined suspicious when the comparing determines that (i) and (ii) are true, which causes a response to hinder the monitored requests or activities.