Wasn't there a better technical way to block the scraper? Like blocking IPs/domains at ingress instead of serving requests? Probably you do still pay for request traffic though...

Isn't there a market for anti-DDOS third-party services for API endpoints (Cloudflare etc) — through probably for "Free Speech Extremist" that wouldn't be suitable solution, and there are charges too (though presumably when facing a situation like this you actually save money).