Knowing my audience, I've blocked entire countries to stop the pain. Even that was a bit of whack-a-mole. Blocking China cooled off the traffic for a few days, then it came roaring back via Singapore. Blocked Singapore, had a reprieve for a while, and then it was India, with a vengeance.

Cloudflare has been a godsend for protecting my crusty old forum from this malicious, wasteful behavior.

Can you explain more about blocking malware as opposed to bots?