It's harder when it's a new group of IPs and happens 2-3x every month.

And if you do rule based blocking they just change their approach. I am constantly blocking big corps these days, barely any work with normal bad actors.

And lots of real users time wasted for captchas.