Hi Railway Support,

I'm running a service on a Hobby plan and I'm experiencing a constant flow of malicious scanners hitting my deployment 24/7.

I already have a security layer in place that blocks these requests (WordPress probes, .git exposure attempts, credential file scans, xmlrpc.php, etc.), but the volume is significant and non-stop.

I have two main concerns:

1. Resource consumption – Even though these requests are blocked at the application level, do they still count toward my Railway usage (compute, bandwidth, or request limits)? If the traffic hits my container before being dropped, I'd like to understand exactly where in the stack the billing meter starts.

2. Upstream mitigation – Is there any Railway-native way to block these scanners before they reach my service? For example:

- IP blocklists or rate limiting at the Railway edge/proxy level

- Custom firewall rules

- Cloudflare integration or similar WAF support

Here is a small sample of what my logs look like continuously:

```

[security] Blocked scanner 157.49.73.19 → /xmlrpc.php

[security] Blocked scanner 158.94.209.109 → /.git/HEAD

[security] Blocked scanner 127.0.0.1 → /wp-content/dump.sql

```

This is generating a lot of noise and potentially unnecessary resource usage. Any guidance on upstream filtering or Railway-level protections would be greatly appreciated.

Thank you,

Soro