As a concretr example, this is a common big problem for NPM, and they have to resort to blocking IPs and/or CIDR ranges.