@Vaghrad @RustyCrab @cassidyclown Yeah, especially since they seemed to probe it, like they'd hit an account that got banned, then immediately go to the registration page. For a while, there were so many of them searching for a specific Pawoo account that I killed off any IP that searched for that account (only one post had federated to FSE, picture of a child and a mega.nz link from an account that had already been banned from Pawoo, so I made an educated guess; I killed that account and anyone that had interacted with the post). I think the only time I ever *automatically* killed IPs just for a search term, usually it would ping me and I'd look.

The nice thing about them is they can be analyzed after the fact for diagnostics. The bad thing about them is they can be analyzed after the fact for feds. The compromise was I'd keep just two days and change around usually, enough that I could spot problems but not enough that I was creating an incentive to send me a subpoena or show up with a warrant. Sometimes I'd keep around aggregates (mostly performance stuff, or when I was trying to figure out why I got a $500 bandwidth overage bill) or excerpts (e.g., if something weird was going on, I'd grep the file for the weirdness and squirrel it away so if it happened again, I could check if it was the same thing or something else).