We built a real-time traffic defense system for a public Nextcloud instance that could detect abnormal request behavior, block abusive clients in seconds, and keep the service available under unpredictable attack traffic.

The Problem

A public Nextcloud instance is always exposed. It accepts traffic continuously, stores user files, and presents a login surface to the internet at all times. That makes it a natural target for abuse: credential stuffing, path scanning, burst traffic, and opportunistic denial-of-service attempts.

The challenge was to keep the service live and responsive without knowing what attack traffic would look like in advance. We did not know when traffic would spike, how many source IPs would be involved, or whether the traffic would arrive as a flood, a scan, or a distributed burst. Any defensive system had to be deployed before the attack, adapt to live traffic patterns, and respond automatically in real time.

Static defenses were not enough.…