Should my web site block access by user agent "feroxbuster", on the grounds that it's not a real person wanting to do something real, and then blacklist the IP address to block the follow-up probes for weird files with a different user agent, or isn't it worth the effort because they'll soon fix their user agent string?

What's with probing for <valid URL>/.env anyway?