[bombcar]

This is the correct answer, and basically you have to setup round-robin DDOS protection that provides these "wrong" answers.

While still trying to allow valid traffic through.