added all my other relays to te lot (wot.girino.org, nostr.girino.org, memrelay.girino.org). All of them were suffering attacks from this address. Cloudflare is very good at blocking external attacks, but not so much for internal ones.
Discussion
Yeah. This is a bizarre one. And it has increased substantially. I had like 500k hits the very first day. Yesterday it was over 10m.
If you can keep a list of CF-Worker headers, the more people reporting the script kiddies the better. Some traffic may be legitimate like Semisol stuff above. But on my relay the vast majority of traffic are WordPress, router and admin panel attack attempts. The more people reporting those folks the better. At some point CF will have to connect the dots.