I think we have a new "fan" in town, and this one is persistent. I’ve had multiple similar attacks on my own relays over the past few months. (Cloudflare function IPs are still blocked from everything I’m running, as they’re being exploited by the attacker.)