And user agent string based protections are even more easily foiled, that's why I don't believe this can be plausibly counted under DDoS protection.