I'm not talking about checking where the requests come from but about stop serving certain content that drives your traffic cost up. When you start serving 404 for the "bad" traffic, the spammers will stop abusing your gateway.
So my spam checking server ingests every long-form article published on nos.lol and if it contains links with domains on blocklists, pareto.space doesn't show articles for these naddr anymore.
But maybe for you it's not 30023 events, that should be investigated first.
