> If any client requests /wp-admin, flag their IP ASN as bot.

Sounds brutal. A whole ISP typically is a single ASN and any of their subscribers can be running bots while others don't - isn't this so?