Instead of using an IP address blacklist (which is like playing a losing game of whack-a-mole), I might recommend one of two strategies for curtailing bot spam:
Strategy 1: Honeypot field
I use this for one of my own web forms personally, and it works very well. The idea is to create an anti-spam field in your form, where if that field is filled in (it will be filled in indescriminantly by a bot), your system automatically marks the submission as spam.
You can hide the honeypot field from legitimate users by giving it a zero (or low) height in the browser along with overflow: hidden
. In case a user has CSS disabled, you can give the field a label something along the lines of "anti-spam - please leave this field blank".
Strategy 2: Captcha
An alternative strategy is to use a captcha, making it so only humans can submit your form. The most popular captcha solution is ReCaptcha, which can be easily integrated into a web form.