It wouldn’t stop against volumetric attacks…

They’d still fully consume the WAN bearer regardless of Crowdsec protecting the endpoint. For that you need a scrubbing centre to dump the traffic onto.

I don’t know, but my electric bill is certainly painful.