I finally decided to try checking against IP ranges rather than individual addresses in my 'login blocking' feature.
As a test, I am using a MySQL query to check against the first three octets in already blocked addresses:
SUBSTRING_INDEX(IP, '.', 3)
If this works I might try reducing it to two octets as the majority of spam login attempts seem to come from similar ranges. I should then have to actively block significantly less addresses.