I've seen Cloudflare block based on user-agent alone.