Have you checked out your logs of Nginx (or what ever you are using)? Those are bots and knockers. You don’t do anything with IPs. Those will change after few tries (IPs are useless anyway, they will always change anyway). You should start do geo-blocking (quite few sites are really true global) and ban plenty of user agent at server-level; at least all totally unnecessary and greedy SEO-scrapers, bots that identifie themselves as IE5.x etc.