This is just IP-based filtering, which is useless as the attacker can purchase more IP space.

What you need is something like a whitelist-by-public-key or hashcash or something.