Application-level banning seems very inefficient, these domains should be banned at the network (IP) level. Just drop any incoming packets from these domains/IPs, send absolutely nothing back that even confirms that you exist.
They are banned at the edge in Cloudflare (now), they never hit my application.
They are banned at the edge in Cloudflare (now), they never hit my application.