Thanks for the suggestion!
I actually started trying out AWS WAF today, and so far it's working really well. It's successfully blocking what appears to be the vast majority of the malicious bot traffic before it even reaches the application, which has made a noticeable difference.
I'm going to let it run for a while and see how it performs as the bots adapt, but the initial results are very promising.
Hi Adam,Any invariants in the logs like a user-agent or something? AI could help to identify a pattern in the logs. AppSec (CrowdSec's WAF) could detect that pattern and redirect malicious requests to some captcha or just ban the IPs for some time. Let me know if you want me to dig into this.Cheers,Frédéric.--
Frédéric Nass
Ceph Ambassador France | Senior Ceph Engineer @ CLYSOLe jeu. 23 juil. 2026 à 14:40, Adam Kraitman <akraitma@redhat.com> a écrit :Thanks for the suggestion! CrowdSec looks interesting, and I'll definitely take a look.
In our case, though, the attackers are rotating IP addresses and continuously changing their query patterns, so IP-based blocking alone hasn't been very effective
On Wed, Jul 22, 2026 at 6:18 PM Frédéric Nass <frederic.nass@clyso.com> wrote:Hi Adam,Just in case you're looking for a security solution to protect our infrastructure — CrowdSec is a beast (https://github.com/crowdsecurity/crowdsec).It parses your logs to detect malicious behavior locally, and shares/receives anonymized threat data with the community — so you also block IPs flagged elsewhere before they ever hit you. It's open source and has a great community (because it's french ;-)).Cheers,Frédéric.--
Frédéric NassCeph Ambassador France | Senior Ceph Engineer @ CLYSOLe mer. 22 juil. 2026 à 16:20, Adam Kraitman via dev <dev@ceph.io> a écrit :Looks like we're getting hit by another bot attack. The bots keep adapting and changing their queries, which makes them harder to block, but I'm doing my best to keep up and minimize the impact.
--Adam KraitmanSystems Administrator
Ceph Engineering
IRC: akraitma