Always-on clients can't be KLINE'd. If you want to DLINE them, you can't get their IP information from /whois, you have to use /ns sessions. This is all undocumented.
We should add an /NS SUSPEND command that blocks further sessions from attaching, then kills all the existing sessions. (I had imagined that operators would simply unregister the account, but this seems too drastic to cover all cases.)