Even if you block the user-agent, the traffic returns under a fake browser user-agent. No way to keep the bad ones out.