I would also look into some kind of blacklist, like spam/drone/proxy/etc, to compare IP addresses that are suspicious and kindly redirect them to /dev/null -C