I also face the same and I have set policy to ban such traffic by IP. Qq: How do you know the IP is forged?