Given the current implementation, the delay will keep a thread busy for its duration. Your server, under attack, would quickly become unresponsive for any user. Probably, your case should be handled separately, e.g. by writing an overlay that registers a delay for a given connection and quicly releases the operation, and a background thread that wakes up when it's time to return errors after the delay. Nothing dramatic, but definitely needs some development.