fingerprinting software can identify suspicious traffic without an IP address or cookie:
Computer make and model
Operating system version
Browser version
Browser extensions
Timezone
Language settings
Adblocker used
Screen size and resolution
Tech specs (CPU, GPU, hard disk, etc.)
This method is surprisingly accurate when done well. FingerprintJS is 99.5% accurate at identifying users and assigning them a unique visitorID.
https://fingerprintjs.com/blog/browser-fingerprinting-privacy/