Limit declined credit card transactions

We got hit by a user/bot that attempted over one hundred credit card transactions via a contribution page. Our payment processor said that this is a common way that malicious persons test whether credit cards numbers are valid. All attempts were from the same IP address.

It would be helpful to set a configurable threshold for maximum declined card attempts in a 1-30 day period from the same IP address. It seems that 3-5 attempts should be sufficient for legitimate cardholder transactions.