The IP addresses are many - the only regular IP's are the owners IP (they login and manage orders)
I already use cloudflare - it was installed about 4 months ago - it's not really doing that much to help. Even though it says it's caching a substantial amount of traffic, there is still an awful lot that is getting through.
I've implemented:
- the HackRepair bad bot list
- w3 Total Cache
- Cloudflare
I trawl the access logs and awstats for anything that looks unnatural and I really can't find much at all!