[dboreham]

>Wouldn't that just be rate limiting by client IP though?

This won't defeat an adversary with a botnet.

[heavenlyblue]

But this is not something you deal with a rate-limiter. By your logic, then a sufficiently large botnet would dwarf any live traffic whatsoever, implying you’d probably want to filter them on network level instead.