[q3k]

That sounds like an app-level (D)DoS, which is generally something you can mitigate yourself.

[geerlingguy]

It's harder when it's a new group of IPs and happens 2-3x every month.

[herbst]

And if you do rule based blocking they just change their approach. I am constantly blocking big corps these days, barely any work with normal bad actors.

And lots of real users time wasted for captchas.