Block scanners by behaviour, not by list
Lists of known-bad addresses are always a day behind. How I built, on top of AWS WAF, a serverless system with Lambda, EventBridge and DynamoDB that recognises the pattern of a scanner and shuts it out by itself.