diff --git a/include/client.h b/include/client.h
index 2c3597f75..620c6e6ea 100644
--- a/include/client.h
+++ b/include/client.h
@@ -401,6 +401,7 @@ struct ListClient
 #define FLAGS_SERVICE	   0x200000	/* network service */
 #define FLAGS_TGCHANGE     0x400000	/* we're allowed to clear something */
 #define FLAGS_DYNSPOOF     0x800000	/* dynamic spoof, only opers see ip */
+#define FLAGS_TGEXCESSIVE  0x1000000	/* whether the client has attemped to change targets excessively fast */
 
 /* flags for local clients, this needs stuff moved from above to here at some point */
 #define LFLAGS_SSL		0x00000001
@@ -477,6 +478,9 @@ struct ListClient
 #define IsDynSpoof(x)		((x)->flags & FLAGS_DYNSPOOF)
 #define SetDynSpoof(x)		((x)->flags |= FLAGS_DYNSPOOF)
 #define ClearDynSpoof(x)	((x)->flags &= ~FLAGS_DYNSPOOF)
+#define IsTGExcessive(x)	((x)->flags & FLAGS_TGEXCESSIVE)
+#define SetTGExcessive(x)	((x)->flags |= FLAGS_TGEXCESSIVE)
+#define ClearTGExcessive(x)	((x)->flags &= ~FLAGS_TGEXCESSIVE)
 
 /* local flags */
 
diff --git a/src/tgchange.c b/src/tgchange.c
index d06ad41f5..7059a287c 100644
--- a/src/tgchange.c
+++ b/src/tgchange.c
@@ -122,6 +122,16 @@ add_hashed_target(struct Client *source_p, uint32_t hashv)
 		{
 			ServerStats.is_tgch++;
 			add_tgchange(source_p->sockhost);
+
+			if (!IsTGExcessive(source_p))
+			{
+				SetTGExcessive(source_p);
+				sendto_realops_snomask(SNO_BOTS, L_NETWIDE,
+					"Excessive target change from %s (%s@%s)",
+					source_p->name, source_p->username,
+					source_p->orighost);
+			}
+
 			return 0;
 		}
 	}