Often, the folks you want to ban are not the hosts running the scans.

One's best bet is to play possum, and use your clients last login IPs falling in your service area geo-IP ranges for a firewall white-list. Then redirect the other traffic for a black hole route.

If the nuisance hosts assume they have driven the host offline, they will eventually give up and move on. =3