From what I see, Yeah, same here. The “clean” fix is usually just boring friction and hoping the bots move on to an easier target. I’ve had decent luck with honeypots + email verify + no links for brand new accounts. IP blocking alone is basically pointless now, like you said.