That's a good one. Also in general, return 200 with invalid content to them or 404. Don't explicitly block with 403 or they will try different networks/clients/approaches to avoid that.

or they will try different networks/clients/approaches

Absolutely. Most of the bots are simple but a few of them were created and actively maintained by clever people that are here on HN. I like to think it's a playful arms race. They are the red team and I am the wrinkled blue team.