AH Perhaps consider the free tier of cloudlare. It can also be combined with XF BOTGUARD or HUMAN VERIFICATION to stop much of that nonsense in its tracks.
I battled the same thing a month ago, had up to 88,000 of them for an extended period of weeks. They were crashing the sql server about 3x daily. It's no longer a problem with the above combo.
My fear was that the ISP would kick us off the server, because of the additional stress it was causing for them.