They absolutely dwarf real traffic if left unchecked (I blocked all countries outside my target area).
I don’t particularly trust anyone at this point, and I assume AI traffic on my web servers are all malicious actors, and never bothered to consider what country the malicious bots came from. Mostly because I couldn’t possibly care less, but it kept happening even with geofencing and rate limits, so some American companies who own domestic IP blocks are facilitating them.
Why not just block the requests based on those headers then, instead of inconveniencing everyone?
I don't think the inconvenience is that big though few secs loading page per session. The ridiculousness though kinda is, we've had years and years of all manner of crawlers that managed to behave, i've even used site rippers in the dial-up days that avoided hammering servers and fetching dupes, now the ai-bros come along and tear the internet apart, replacing it with their chats systems and generic slop.