Bot traffic defenses: user-agents and blocking cheap hosting proxies

Practical notes when defending sites and APIs against naive automated clients (not a complete anti-bot stack).

1. Prefer up-to-date user-agent lists

Default user-agent lists shipped with many tools and scripts are outdated. Blocking ancient UAs will not stop advanced attackers, but it can catch and discourage casual scrapers.

2. Do not rely only on cheap proxy / VPS ranges

Sophisticated operators move to harder-to-block networks, but many low-effort bots come from well-known hosting and proxy ASNs. Restricting or rate-limiting those sources can reduce noise.

Often seen as sources of automated traffic:

• DigitalOcean
• Gandi / related hosting brands (e.g. older “GegeNET”-style labels in IP databases)
• OVH SAS / OVH Hosting
• Choopa, LLC
• Amazon.com / AWS (with care — legitimate traffic lives here too)

Combine ASN/IP reputation with rate limits, CAPTCHAs, and behavior checks rather than hard-blocking cloud ranges alone.