> then regular IP-based rate limits should work fine right? These are also harmful to human users, who are often behind CGNAT and may be sharing a pool of IPs

> then regular IP-based rate limits should work fine right? These are also harmful to human users, who are often behind CGNAT and may be sharing a pool of IPs with many thousands of other ISP subscribers.