I am trying to ban 1 IP address that someone is using to send malicious attacks every 3 seconds.
However, when I use Google Cloud armor, the IP/attacks aren't blocked until the application is reset. At which point, I see that the attacker set it up so that the IP address automatically changes and attacks from a different IP.
Am I always suppose to reset to make Cloud Armor work? Or is this happening because I'm using a load balancer?
Another possibility is that Cloud Armor never worked in the first place, but when the application was reset, the attacker's script changed the IP automatically.