@jwz start by banning HTTP/1.0 agents if you haven’t already. That’s the lowest of low hanging fruit.