I don't think blocking hits based upon referer will sort any effect on these bad guys, cause they are going to circumvent your protection in a thousand ways. You can easily put up a Perl script that change HTTP Referrer, you can use a redirect to a script on another domain before loading your redirect.cgi, etc...
Maybe counting the accesses to your redirect.cgi based upon ID is not the best way to obtain a popularity score.