I still think ip rate limiting and banning is way less intrusive and works well. I think i can eliminate 99% of it with enough elbow grease, but will likely require active monitoring for new attacks. I can see why twitter had a bot team -_-