Only tangentially related, but I've recently realized that unless you're some sort of business with a valid requirement of that, you can just block incoming traffic from all of AWS, DigitalOcean, Azure, etc.

I think the spark came from some other HN comment I saw? So thank you for that, whoever wrote that.

That alone is not a sufficient strategy of course, but you can get rid of a lot of bots by just refusing to talk to where they tend to live.

Of course, if everyone were to do that, they'd eventually pivot to residential proxies. But I don't see that happening.