i run a small browser game on a hetzner vps and for me the bots were never a load problem, it was the stats. the game shows how many people are online and every crawler that opened the live stream counted as a new player, in early october it was 28 of 61 stream opens. then a headless chromium on residential proxies, different ip every time, made 40 fake players in two days. what caught it was the Sec-CH-UA header, it said chromium 146 while the user agent said chrome 120, real browsers don't mismatch like that. i don't block them now, they just stop counting as people, which is kind of depressing too i guess