Hard question to answer. I'm not sure what helps that doesn't cost money. Plus cloudflare just intercepts all that traffic without the user's consent.

We have ways of tuning load balancers, but it's constant upkeep.

IP blocking kind of works (not for ddos) but it limits honest people like me with VPN IPs from low reputation blocks.

Really just lots of CPU, and many layers/balancers. Possibly javascript client-challenges, but this really hurts UX (think captchas)

There was an "open source" telemetry project at some point for this, but I think they kept their intel databases private. I've been thinking rdns lookups, but that's resource intensive and slow.