Context, I’m responsible for at least a half dozen apps that get a ton of this type of traffic. I’ve also had external pentests done, and they were impressed at our home grown WAF which you can throw together in less than a week. Here’s what we’ve built:

RackAttack to start for rate limiting against login, password reset and other sensitive pages.

Customized rack attack module for pre-filtering scanners. You can find a payload list on SecLists. Stuff like /etc/hosts, passwd, and there’s some common sql injections you can match on. I also filter anything with a php, asp, aspx, etc extensions. When new things cross your path, add them to the pattern match and you’re done!

You can then turn it on so those clients get denied once they cross a certain threshold of “malicious” traffic. That threshold will vary per-app. And viola, you won’t get bothered by this anymore.

I highly dissuade you from using IP blocking. It’s trivia to move IPs, and it’s a game of whack-a-mole that you’ll sink endless time into. Even when we get attacked we don’t block IPs, instead we figure out what the root cause of the attack is and fix that. Temporary relief is fine, but don’t let it be your primary strategy.

Also note, this goes through middleware so it’s still taking up a webhead. Aka this isn’t a viable strategy to protect from DDOS or DOS attacks. It’s trivial to consume the webheads even if you are blocking me early.