Since this nine years old question was reactivated anyway, I would like to add another perspective, which was not considered by previous answers.
There are two effective techniques to deal with the calls from malicious IP addresses: drop the packet or make as if the attacker succeeded:
Drop the packet
In many cases, there is no use in wasting your resources (CPU, bandwidth) to respond to a blacklisted IP address. The most basic response is still using a lot of resources: the CPU which has to encrypt the HTTPS traffic, the disk space in terms of the server logs, and finally the actual response, with all its HTTP headers, sent through the wire. Someone who wants to annoy you can cost you money by simply sending the same request again and again: if he sends it from a zombie machine, he is not paying anything; you, on the other hand, will have to pay the hosting company.
Instead, just drop the packets coming from a blacklisted IP address. This is what firewalls are for. The attacker sends an HTTP request, and then waits, and waits, and waits. It's like your website doesn't exist any longer for him.
This has several benefits:
- You don't waste extra resources.
- You block the IP address at the topmost level, at the front gate: the request never reaches application servers, making them available to serve requests from legitimate users instead.
- The configuration is extremely easy. Virtually any firewall's most basic function is exactly that: block traffic from specific IP addresses. This also means that you don't have to write any custom code, don't have to install specific software. In many cases, you can do it at the level of the router itself.
- The malicious user cannot fallback to other attacks beyond HTTP. It doesn't matter if you have an LDAP server, a DNS service and a RADIUS machine; the attacker won't be able to reach any of them.
- An inexperienced hacker can wonder for a while why he can't reach the website any longer, including thinking that he achieved to break it. A colleague of mine helped a company to catch a hacker this way: a junior hacker was attacking the website through a proxy server. When the proxy server was blacklisted, the hacker thought that either he broke the website or the proxy server stopped working, and... went to visit the website without a proxy, revealing his real IP address.
Make him think he still does the harm
As you guessed, revealing to a malicious user that you blacklisted his IP address motivates the person to move to another proxy server, or to go annoy somebody else.
Another technique which is particularly effective against spammers is to make them think that they are still succeeding at doing harm. If they post comments, show their comments to them, but to nobody else. Technically speaking, if comments are public, indicate that such or such comment should be displayed only to a person using a given IP address. If comments are restricted to authenticated users, indicate that a comment is private, i.e. can be seen only by the user himself.
It can take a while for a spammer to figure what is happening here. If by any chance he changes the IP address (or an account) and notices that all his comments are gone, he would think that they were removed by the administration, and start all over, believing that he continues to annoy you. It would require several changes of IP address/account for him to understand what's going on.
If you know that comments are posted by a robot, you may also continue responding with success status codes, but slow down the responses, so that the robot wastes more and more time. For an attacker, it would look like your website has severe performance problems. Progressively, you can start dropping the packets randomly, making it really look like you are having technical issues. However, be very cautious with this technique: make absolutely sure you don't waste your resources beyond what is acceptable. You don't want to deny the service to a legitimate user just because all your sockets were used to respond to a blacklisted IP address.
