Always appreciate you, thanks for the answers. Seems like you have a pretty good solution going at least. So temp IP blocks only when many fresh pubkeys coming from one address. Could still cause issues for VPN users as you pointed out but at least better targeted. 

Our problem is we don’t have any IP/network info on our aggregator so we have to make decisions based on only the events. I think the new system will work though. 

 yes aggregators may benefit from that but banning an ip in an aggregator does not make sense.  the note is coming from somewhere else! 🤔  

 Yes we don’t have IPs at all! It’s all event based analysis.