[KenoFischer]

Doesn't help for two reasons 1) If the has has enough bits to be useful for blocking, it's trivial to reverse 2) Even if it did make the IPs anonymous, we want to be able to email the NOC at whoever is sending the abusive traffic, so they can go investigate

[j88439h84]

> we want to be able to email the NOC at whoever is sending the abusive traffic, so they can go investigate

If you block their traffic with HTTP 429 Too Many Requests, they can email you instead.

[KenoFischer]

We prefer not to break researchers' workflow because the group next door misconfigured their server. Happens all the time. We only sinkhole IPs if the traffic is malicious or on track to exceed or budget.