Not necessarily. These work in combination. If they're requesting specific type of content like images or some weird request that queries DB, these would be gr

Not necessarily. These work in combination. If they're requesting specific type of content like images or some weird request that queries DB, these would be grouped together. What I'm saying is gather more information for each request and use it more wisely to expire IP reputation quicker - within minutes as opposed to months. The DDoS problem is actually easier than the rest because you need a large volume of requests to do anything. Usually these requests are very similar, come in rapid succession and come from the same bunch of IPs. Edit: Going with the mask analogy again, it's like you see 1000 masked people rush into a bar and block the entrance with their bodies. Is the solution really to ban wearing masks everywhere?