Then where they're coming from should be exceedingly visible in logs (via splunk or whatever), so deny those requests.