I guess you could use group counts with the second number being the resource name.
Have you considered that you will also rate limit toll fraudsters, so that the service provider’s protection system will not trigger and you will bear the cost of an extended attack.