Keyword here being "nasty". You'd need some sort of trust metric to identify malicious clients. This becomes harder with botnets that lay dormant on regular users' systems.