> When 80% of traffic from an IP is malicious and the other 20% is regular traffic, but both sources look like the same traffic (impersonating browser headers, sometimes running headless chromium), what else can you do?
Accept the traffic, taking the bad with the good. We all know the ills of visitor profiling regardless of effectiveness.
