My employer is really big on blocking IP addresses, it is their primary solution to everything. I’ve been trying to educate them and I think the message is starting to resonate - anyone nefarious can switch IP addresses faster and easier then we can block them - they don’t need peer review, change approvals, or to wait for a pipeline to run - they just do it. Likewise strict IP based rate limiting will only keep honest people honest, I can send one request per second from a couple thousand IPs and it’s completely invisible to all their monitoring and WAF rules. The world has moved on - you need different strategies that consider more then IP now.