Web server: nginx
I am looking for a technique to auto block an IP address when for example an attacker IP makes more than 100 requests per minute.
The above article mentions about rate limiting per user based on number of requests and connections. This question is not about rate limiting but denying the IP.
There is a section about Denylisting IP Addresses in the above article - it says:
If you can identify the client IP addresses being used for an attack, you can denylist them with the deny directive so that NGINX and NGINX Plus do not accept their connections or requests.
I believe this is a manual process to observe the IP address used for an attack and then add them to the deny list. Is there a simple way to automate this?