Haven't had an issue since I moved to 365. Costs a little more but so much less hassle. I don't like it but I also need people to actually receive my emails.

I stopped reading at this point. I cannot emphasize how much I HATE this AI writing style.

I've even heard stories of some scammers exclusively using such lists, as they are pre-verified!

Yes, of course, if a real threat actor is doing things properly they'll be using residential proxies and legitimate user agents, but we're talking here about blocking "some of the bots" - mainly the script kiddies.

I disagree. If I'm getting problematic traffic from even a few of your IPs and they're in a DC/VPS range, I'm blocking it and moving on with my day.

But I suppose none of my clients services typically ever need to be accessible from such countries anyway.

I think it's a great article to be fair. We need more of this cheap and quick bot blocking. The fact the solution to unwanted traffic is often "use Cloudflare" is _not_ great for the internet, and nobody really actually likes deploying or managing ModSecurity. Its a nice middleground.

> if ($http_x_forwarded_for) {....

This may block schools and libraries that use content blockers. Often the internal client is left to make abuse tracking easier (or because the overworked admin didn't know they could turn it off).

AI has just made this so much worse.

This is not a good thing. You should understand what your code does. Writing code nobody can understand is not a flex.

Imposing requirements on the reporter? No.