Each time you start the custom-bouncer you get multiple time the same order.
On the restart this morning for me, I had 95 order for the exact same IP. (and you have a full list of IP with that).
Multiple time the exact same order, but with different ban time.
time="10-12-2020 07:40:04" level=info msg="custom [/usr/local/bin/ban.php] : del ban on 180.253.162.196/32 for -509410 sec (crowdsecurity/http-path-traversal-probing)"
time="10-12-2020 07:41:04" level=info msg="custom [/usr/local/bin/ban.php] : del ban on 180.253.162.196/32 for -508364 sec (crowdsecurity/http-path-traversal-probing)"
time="10-12-2020 07:41:07" level=info msg="custom [/usr/local/bin/ban.php] : del ban on 180.253.162.196/32 for -508015 sec (crowdsecurity/http-path-traversal-probing)"
time="10-12-2020 07:45:45" level=info msg="custom [/usr/local/bin/ban.php] : add ban on 180.253.162.196/32 for 14799 sec (crowdsecurity/http-path-traversal-probing)"
time="10-12-2020 07:45:53" level=info msg="custom [/usr/local/bin/ban.php] : add ban on 180.253.162.196/32 for 21999 sec (crowdsecurity/http-path-traversal-probing)"
time="10-12-2020 07:45:59" level=info msg="custom [/usr/local/bin/ban.php] : add ban on 180.253.162.196/32 for 27311 sec (crowdsecurity/http-path-traversal-probing)"
To finally remove that ban :
time="10-12-2020 07:40:04" level=info msg="custom [/usr/local/bin/ban.php] : del ban on 180.253.162.196/32 for -509410 sec (crowdsecurity/http-path-traversal-probing)"
time="10-12-2020 07:45:19" level=info msg="custom [/usr/local/bin/ban.php] : add ban on 180.253.162.196/32 for 399 sec (crowdsecurity/http-path-traversal-probing)"
time="10-12-2020 07:52:07" level=info msg="custom [/usr/local/bin/ban.php] : del ban on 180.253.162.196/32 for -323 sec (crowdsecurity/http-path-traversal-probing)"
Using a local cache to not execute the same order twice improve a lot the start time when you call some external API like cloudflare, but this should be done on the bouncer side.
This reduce the CPU usage too, but can probably be improved a lot if the bouncer don't send useless order from the begining.
Maybe make something like fail2ban.
On stop try to delete the actual active ban list.
On start only add new ban.
And maybe add some cscli decisions delete -time 48H or something like that, to force delete ban based on time to clear external ban list (like cloudflare).
log.txt