[ItsBob]

> If a client has an IP in this set, they get a simple UTF8 constant string in the response body "You have exceeded resource limits, please try again later".

Would a simple 429 not do the same thing? You could log repeated 429's and banish accordingly.

[immibis]

Both are important - the response code for well-behaved machines, as many tools intrinsically know that 429 means to slow down (also send a Retry-After header if you want more customization), and the text message for humans, as they don't see the response code and would otherwise see a blank page.

Reddit is guilty of sending 429 with no message - try browsing it through Tor and you'll see.