blocking ip's and bots used to work to some extent, but now all they do is change their ip addresses and hit you again. You might stop or block a few, but there are so many that just change their ip's or use a proxy that it isn't really that efficient anymore. You could spend all day blocking ip's, come back tomorrow and do it all again. You could literally update this list by the day and maybe by the hour. I don't know if there is a perfect solution especially for shared hosting, but I have seen see more and used a few .htacces mods that block what they are targeting rather than their ip addresses. It's not perfect either, but going solely with an ip block usually is near worthless for the majority of the spam and bots. You will block a few human spammers if you are lucky, but not bots in the long term.