Thanks for the suggestion! CrowdSec looks interesting, and I'll definitely take a look.
In our case, though, the attackers are rotating IP addresses and continuously changing their query patterns, so IP-based blocking alone hasn't been very effective
Hi Adam,Just in case you're looking for a security solution to protect our infrastructure — CrowdSec is a beast (https://github.com/crowdsecurity/crowdsec).It parses your logs to detect malicious behavior locally, and shares/receives anonymized threat data with the community — so you also block IPs flagged elsewhere before they ever hit you. It's open source and has a great community (because it's french ;-)).Cheers,Frédéric.--
Frédéric NassCeph Ambassador France | Senior Ceph Engineer @ CLYSOLe mer. 22 juil. 2026 à 16:20, Adam Kraitman via dev <dev@ceph.io> a écrit :Looks like we're getting hit by another bot attack. The bots keep adapting and changing their queries, which makes them harder to block, but I'm doing my best to keep up and minimize the impact.
--Adam KraitmanSystems Administrator
Ceph Engineering
IRC: akraitma