Just thought I'd share an idea I had regarding botnets with my fellow sysadmins.

If you have fail2ban, edit the action files the reject rules (actually copy the conf to a .local file by the same name and edit it, that way it won't be overwritten in an update), then change REJECT ... to DROP. This way when your site is attacked by a botnet, instead of getting an instant REJECT, the bot hangs waiting for a TCP ACK or NAK until it times out, then retries several times before moving on. If enough of us did this we'd tie them up. Same for firewall rules.
3