Thanks for the suggestion! CrowdSec looks interesting, and I'll definitely take a look. In our case, though, the attackers are rotating IP addresses and continuously changing their query patterns, so IP-based blocking alone hasn't been very effective On Wed, Jul 22, 2026 at 6:18 PM Frédéric Nass <frederic.nass@clyso.com> wrote:

Hi Adam,

Just in case you're looking for a security solution to protect our infrastructure — CrowdSec is a beast ( https://github.com/crowdsecurity/crowdsec).

It parses your logs to detect malicious behavior locally, and shares/receives anonymized threat data with the community — so you also block IPs flagged elsewhere before they ever hit you. It's open source and has a great community (because it's french ;-)).

Cheers, Frédéric.

-- Frédéric Nass Ceph Ambassador France | Senior Ceph Engineer @ CLYSO

Le mer. 22 juil. 2026 à 16:20, Adam Kraitman via dev <dev@ceph.io> a écrit :

...

Looks like we're getting hit by another bot attack. The bots keep adapting and changing their queries, which makes them harder to block, but I'm doing my best to keep up and minimize the impact.

-- Adam Kraitman Systems Administrator Ceph Engineering IRC: akraitma