IP blocks don't work, because they're using proxy networks so that you see an ip address 1 or 2 times within 10 minutes. They have effectively infinite ip addresses. (actually, looking at my data from today, I think this relationship holds over ~3 hours, where we're seeing ip address cardinality at about 1/2 of the hits.)

  * Sometimes there's a pattern to the country. Oftentimes, not. 
  * User-agent, rotated between common, valid, current web browsers.
  * Other headers, sec-*, accept, etc, generally valid and rotating. 
  * Bots will load the site to saturation in a denial of wallet attack.

The only thing that's specific is:

  * urls have a pattern.
  * it's obviously invalid traffic. 

(non-bot traffic on my sites does not go from 0 to 200r/sec on the search interface in seconds. It does not go away that fast either)