Followup: after blocking public scraping of a #Gitlab instance we waited for a while to see if the #LLM botnet attacks would reduce; finally (after about 3 days) one of them finally realized it was getting the sign-in page instead of actual content and seems to have given up. At least one other botnet is still trying, but load is much reduced. So there is hope! Block access and they eventually go away.