That's good, at least if they're not too skilled sometimes the ratio of time spent playing cat vs. mouse with them isn't too bad, since it takes them a long tim

That's good, at least if they're not too skilled sometimes the ratio of time spent playing cat vs. mouse with them isn't too bad, since it takes them a long time to bypass measures. You could also look into things on other layers rather than the application level, for example, maybe the IPs they're using all come from similar VPN providers or services?