Recently, I took a look at a certain project's anti-bot measures, and they actually have quite a few tactics.

This time, they’re making significant moves: they’ve added multi-signature transaction verification at the API level, directly replaced the presale contract with a new address wtfdJKwQG9A4ayuouBEip6Hoi1DcsAAHVxeHmG5HG7E and upgraded it, and now require users to log in to participate. This combination of measures can indeed block most scripts currently on the market.

However, that being said, these protections aren’t foolproof. If someone never intended to go purely on-chain from the start and instead mixed in off-chain operations, these measures are basically ineffective. Of course, in terms of cost and effectiveness, filtering out most low-end bots is enough to achieve their goal—after all, it’s impossible to achieve 100% defense.