I got some click-bombing attacks on my site and the bots that made the attacks have this user agent: "-" . I also have heard that empty user agent as well may be a bad boot. But I am not sure will denying access to visitors with empty user agent may as well block some legitimate users.

So I use this rewrite condition to block both users with blank and "-" user agent:
RewriteCond %{HTTP_USER_AGENT} ^-?$
RewriteRule ^ - [F]
Are there normal visitors that have the blank user agent? I guess all bots with "-" are bad.