>>dang+(OP)
Unfortunate but very true; it's always interesting to see what other people have in their bag of tricks - but a magician should never tell.
I would guess that you have rules based on patterns of observed behaviour, and that they do 80-90% of the effective blocking.
>>dang+(OP)
I get it, thanks. Instead, Could you write about them, rather than the code? I'm picturing lessons learned, don't try ABC it's a waste of time, and so on..