and after 1 day - APIBan=17 and AbuseIPDB=1346 and GeoFW=35000±
First I tried the APIBAN but noticed a lot of SIP specific hacks still coming in, so I added the AbuseIPDB and with both in place it seems to block 99% of them.
So all running perfectly and I actually sketched out a full installation plan if anyone gets stuck.
In 1hrs of running - the image attached shows how many attacks have been blocked.
Custom coded a security defence monitor to go with this upgrade!