Great points! IPv6 address rotation makes per-address limits much easier to bypass, so aggregating requests by a /64 prefix is a useful additional safeguard. On the other hand, carrier-grade NAT shows why strict IP-based limits can unfairly affect legitimate users sharing the same IPv4 address.

I’d treat IP-based throttling as one layer in a broader strategy, combining it with account-level limits, API keys where applicable, and endpoint-specific quotas. The challenge is balancing abuse prevention with avoiding false positives for legitimate users. Thanks for highlighting both sides!