I disagree. But regardless of our philosophical difference, it still won't enable you to accurately determine a disruptor from IP address since IP address is not an accurate indicator of identity. You'll still ultimately have to make a decision based on behavior which you can already do.