This message was deleted.

I've been using a responder policy to block traffic from the IPs doing this, but sometimes we'll get a ton of syslog based alerts before the block is put into place; and while they typically dont, they obviously only need to change IPs to continue and it's just a back and forth game at that point.