First of all, report whoever is doing it.
You obviously could block anything with a query-string that contains screw-you, but that’ll only help in this case.
Maybe Drop any requests with HTTP/1.0 (browser don’t use it, and “good” bots like google don’t either, but if you need to provide access to special tools, you might not want to do this), but you should keep a close watch over what requests get dropped by this to make sure that you don’t lose any legitimate traffic.
And of course, there are technical solutions that try to automatically discover this kind of traffic and block it. Have a look at CloudFlare, Incapsula, StackPath etc.