@Gargron Ahh yeah, hard to just nginx cache that away...
I guess the standard solution is to just catch em all and throw them into an ipset and iptables -j DROP the traffic...