This seems pretty well covered by the post? Doing any kind of access pattern analysis leaves you with the problem of handling false positives, and your proposa

This seems pretty well covered by the post? Doing any kind of access pattern analysis leaves you with the problem of handling false positives, and your proposal doesn't help with the accessibility problems. IP addresses aren't a panacea here -- this is a high margin business where the attackers can switch to high cost / high quality proxies. > unless they are specifically targeting that site In this case the attackers would very specifically be targeting specific sites (ones selling tickets to events with more demand than supply).