What if everyone requests from the bot has a different UA?
Success. The goal is to differentiate users and bots who are pretending to be users.
Then you can tell the bots apart from legitimate users through normal WAF rules, because browsers froze the UA a while back.
Success. The goal is to differentiate users and bots who are pretending to be users.