Licson Lee says to 電訊台
if (pps > thres1 || bandwidth > thres2 || connections > thres3) then block(ip, 15m)