IP based blocking is complicated once you are big enough

It’s literally as simple as importing an ipset into iptables and refreshing it from time to time. There is even predefined tools for that.

While AI crawlers are a problem I’m also kind of astonished why so many projects don’t use tools like ratelimiters or IP-blocklists. These are pretty simple to setup, cause no/very little additional load and don’t cause collateral damage for legitimate users that just happend to use a different browser.