because you have to parse the http request to do that, while blocking the IP can be done at the firewall