Nice post! I'm kinda curious about the "badness score", what metrics have you found to be the most effective? Geolocation, browser, screen resolution? Something else entirely?
Most of the fraudulent requests originated from less wealthy regions and were performed manually, which is not surprising I guess.
I'll be honest, I didn't expect people to manually farm testnet faucets. And there I was thinking the existence of Captcha farms is depressing.
Regarding people accumulating testnet coins rather than using regtest -- Might also be that they're being used for scamming people, occasionally threads pop up with people being sold tBTC rather than the real thing. Probably not that common though.