@einmad @pwm they dont hammer fast. it's 10000s of IPs requesting accounts crawling via mentions/reposts 1-2 requests every maybe 30-45 seconds sometimes up to a minute or two. but because there are so many of them it flies under the radar because it doesn't appear as a traffic anomaly

i could use something like that Nginx-LUA-Anti-DDoS maybe. I will look into it github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/blob/master/lua/anti_ddos_challenge.lua

the challenge might be enough. ideally I'd like to redirect traffic to a separate server set up as a tarpit so it keeps the request open forever just to see what it would do