It worked fine... on a small scale But it's one thing to swat flies versus fighting swarm of yellow jackets. Serving a 1MB file a million times a day on a small digitalocean droplet is not feasible. Let's just say it didn't scale. And AI bots usually come with beefier machines, and recover faster after a bomb.
It's the content of the page, the raw html, that is replaced with a zipbomb. Example: https://example.com checks if you are a malicious bot, depending on the result, it will send you gzip html or gzipped bomb. So that can't be swapped or redirected to a CDN. The bots would simply ignore the redirect.
