Another 250,000 requests to the LVFS at 4AM this morning, ~27 parallel "security scans" from the same IP with routes containing phpMyAdmin, servicedesk, tomcat, wp-content, cgi-bin etc.
I've reported it to #GCP, and if I again get no response from them I'll just block the entire AS396982 range which is hilariously 21M domains and 14M IPv4 addresses.