Great question and I’m happy to provide some clarity.

When the server comes under significant load from this type of coordinated scraping activity, it becomes extremely difficult to investigate the issue while it is happening. Even with out-of-band access, the server can become so overloaded that it is nearly unresponsive.

To relieve some of that pressure, I temporarily enable Cloudflare’s Under Attack Mode. This helps reduce the amount of traffic reaching the server, but it also interfere with certain third-party applications, such as Voyager and others.

I enable Under Attack Mode to reduce the load and collect access logs showing what the filtered traffic looks like. I then disable it temporarily to capture additional traffic, including requests that were previously being blocked. This is why you may intermittently regain access during these incidents.

By comparing these two datasets, I can more quickly distinguish legitimate traffic from malicious or unwanted traffic patterns. From there, I can adjust the security rules to make it more difficult and costly for that bad traffic to reach the server in the first place.

Sorry if that got a little technical.