[w00t]

This seems the most logical so far, but what about a botnet DDoSing from all around the world? How would the system handle those IP ranges without ill effects on legitimate users?

Only filter out a /26 subnet, and remove then when done. Prevents abuse of dynamic IPs( for the most part ) with minimal impact on legitimate users, as even those caught in the subnet are only disallowed during the attack.