Most of the time these malicious attacks will come from a data center, where someone is no doubt leasing some hardware until they get shut down.

When I get any number of malicious known attack vectors, I have a process that runs a few services against the IP for geolocation and server info. If it's a known data center, its block is immediately blocked, otherwise just the IP.

For whatever reason, they tend not to get new ips easily, so shutting down the IP will usually buy a few days before they have a new instance on qualys or whatever.

In our environment, blocking all traffics from data centers are effective to prevent malicious attacks. You can get the data center ranges from IP2Proxy database.

We need to whitelist a few important servers that we are working with to prevent lock-down of good traffics.

Correct, blocking a IP block based on that malicious traffic comes from there might be a worthwhile strategy (although I'd argue that it's less important than properly configuring your stuff anyways, getting a new IP is trivial), and also a strategy which is different than what fuzzy2 was describing, which is what I was arguing against.