here are a few things you can do: 1. instead of blocking, throttle the IPs. Rate limit them to making no more than 1 request every 30 seconds or so. Most scr

here are a few things you can do: 1. instead of blocking, throttle the IPs. Rate limit them to making no more than 1 request every 30 seconds or so. Most script kiddies get fed up if their attack gets painfully slow. 2. if you see a high rate of traffic coming from an IP, quarantine it for say 2-5 minutes (ie, block all traffic from it) and after that time throttle it. 3. If you notice patterns in the IPs, eg, they all come from the same block, then redirect those IPs to a different box (you can set up a VIP to do this). You can do what you want on this box (eg: don't bother opening database connections here), but the main thing is that your primary web server has all its resources available to serving legitimate customers. 4. Never give an attacker any indication that you've noticed their attack. It only makes it more fun for them and they'll persist longer. So, if you see abusive traffic, don't return a 404 or a 403. Just return a regular 200 with a cached version of your regular page.