Support

You got two batches of 6 to 9 emails each, one at 1:44 AM and one at 2:03 AM. This means that the attacker was using multiple concurrent requests to attack / scan your site. Since all these requests arrive and get handled at the same time, and because PHP is a stateless, share-nothing language, each thread handling this request did not know about the other threads. Eventually, the database reads caught up with the database writes, therefore the seventh thread could now see enough requests to temporarily block the attacker's IP. When the temporary IP block expired, you got a repeat of the same.

This is perfectly normal behavior. The alternative – using a database table lock on the blocked requests log in each request – would see your server only being able to handle one request at a time. This would mean that when your site is busy, page load times would be in the tens of seconds to minutes. Your bounce rate would approach 100%. That would be a case of the cure being worse than the disease, so to speak.

No worries! It is not exactly very obvious unless you have seen it a few times and done the troubleshooting against the server access log. I am very happy replying to tickets like this. It's not exactly something I can put in the documentation in a way that it will resonate with someone who hasn't experienced that, meaning nobody would read it and remember it when it happens. Well, that's why I am here!