24363a1713
When 5+ IPs perform same attack type (RCE, SQL_INJECTION, XSS, PATH_TRAVERSAL, BRUTEFORCE) within 2 minutes: - Block all individual attacking IPs immediately via IPset - If 25+ IPs from same /24 subnet, block entire subnet Uses batch_block_ips() for efficient IPset operations. All blocking is kernel-level via IPset (no CSF commands).