hotlink from dalvik agent user

Question

I'm having some punctual problems with hotlink related to dalvik user agents. A couple of times last month and one more time tonight, I have had a lot of hits to images from my site from this agents users... Always dalvik ones.

I don't know exactly who is the thief (probably some ilegal streaming service who use the image from one of my serie/cinema news) but if I am not looking at the server and blocking or just changing the image for another with 2kbs size, my bandwidth is killed in minutes (2'5gb in 10 minutes). Normally this hits dissapear hour laters, but there could be thousands in this period of time...

I don't mind a little web use my images but this could kill my bandwidth easily. Fortunately I have noticed it fast.

Any way to avoid hotlinking just from this agent users, always related to dalvik (different versions). And also, maybe blocking this is not a good idea...

Here an image from my visit logs (as you can see I have changed the image for one of 2kb as I said before)

I HAVE LOOK MORE DEEPLY TO LOG AND I SEE THAT SECONDS BEFORE THIS CRAZY VISITS START THIS HAPPENS:

189.214.6.164 - - [06/Apr/2022:00:20:48 +0200] "GET /wp-content/uploads/2022/01/south-park-temporada-25.jpg HTTP/2" 200 93569 "https://console.firebase.google.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36"

Maybe blocking this referrer that seeems to be related to an app....