If the attackers are using botnets to distribute the load across IPs, then perhaps we need to distribute the detection across IPs: https://www.abuseipdb.com/fail2ban.html
I used to manage VoIP systems and VoIPBL[0] was amazing.
"VoIPBL is a distributed VoIP blacklist that is aimed to protects against VoIP Fraud and minimizing abuse for network that have publicly accessible PBX's"
It's very similar to what you linked but is targeted to catching VoIP abuse.
