@Codeberg are they flooding the pipe simply with gigabits / packets per second, or are requests coming through from too many IP addresses which causes too high a cpu load in request processing?
It sounds like the latter, in which case I don't understand why not block the entire autonomous system temporarily (while this is figured out)
@luc They are distributing requests over multiple /18 to /20 networks, each single IP having only few requests so they are not detected by our automated rate-limiting.