I use an iptables rule like:

    # connection limit for HTTP
    -A INPUT -i eth0 -p tcp --syn --dport www -m connlimit ! --connlimit-above 128 --connlimit-mask 24 -j ACCEPT

This basically means, "only accept requests to port 80 if the /24 has fewer than 128 open connections". It is to kill things like Slowloris, but you can bring the limit down and kill scrapers. You can also block based on connection rate:

    -N RATE_CHECK
    -A INPUT -p tcp -m multiport --dports www -m state --state NEW -j RATE_CHECK
    -A RATE_CHECK -m recent --set --name RATE
    -A RATE_CHECK -m recent --update --seconds 60 --hitcount 4 --name RATE -j REJECT
    -A RATE_CHECK -p tcp -m multiport --dports www -j ACCEPT

This will deny any connection that is the 5th connection or higher in a single minute. I use this rule for ssh and smtp, but some tweaking might be adequate for a web server.

(Note: all these rules are for default deny with a rule like "-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT" to ignore established states. If your firewall setup is different, then the rules will need to be modified.)

There is also a program called fail2ban that will read logs and apply temporary bans based on what the logs say.

My solution to this problem is to just cache agressively. Hundreds of requests per second is nothing for Varnish.