To my knowledge there are three somewhat used rules that can have an impact on these types of services. 1. Only allow known/cleared bot traffic from any non-co

To my knowledge there are three somewhat used rules that can have an impact on these types of services. 1. Only allow known/cleared bot traffic from any non-consumer ISP. 2. Block any ASN where bad traffic comes from especially if there is no good traffic. 3. Block any VPN services. I don’t know if Mullvad have their own ASNs or if they are hosted at services with ASNs that is classified as consumer ISPs or not. It is probably a mix. I know for instance that OVPN have servers at some shady non-consumer ISPs. So, it sometimes gets blocked. It is also, unfortunately, not uncommon that VPN connections are used for attacks. And if the VPN uses a smaller service provider, then that whole ISP may get blocked. If the VPN uses a shady service provider. The VPN may fall victim to other user activity from that ISP. I have not worked with any site that blocks VPN all together. Tor is often blocked along with some countries. Some streaming services blocks VPN though. Most sites do not, I think. The way things are going right now is that these types of services will become more difficult to use on legal commercial sites over time.