288,493 Requests in 24 Hours — How I Spotted an XML-RPC Brute Force via Cache Rate

A 0.8% Cloudflare cache ratio led me to a single Singapore IP flooding a WordPress site with 288k xmlrpc.php requests. Detection, vector, and two-layer mitigation.