[ErroraBorealis]

Only filter out a /26 subnet, and remove then when done. Prevents abuse of dynamic IPs( for the most part ) with minimal impact on legitimate users, as even those caught in the subnet are only disallowed during the attack.

Makes sense. I like that better than what cloudflare does, then your whole site is down and it's pointless anyway.