The only problem with this (note: I speak from no experience, just reading other comments) is that it's at the application level. For the serious DDoS stuff (A

The only problem with this (note: I speak from no experience, just reading other comments) is that it's at the application level. For the serious DDoS stuff (Anon, extortion rings), you have to filter at the TCP level (from what I know). That gets more complicated when the attacks originate from a botnet (especially if that botnet has infected IP ranges similar to what your customers use -- can't very well go off and ban Time Warner, if you're in the US)