True. We use 12 rounds of bcrypt, though, so they should be at least moderately secure. It's the best solution we've found so far... we'd be happy to hear alternatives that allow us to generate secure hashes for the IPs and allow us to ban people by IP if necessary.
And yes, I know that 12 rounds of bcrypt doesn't mean much. It will delay brute force attacks, though.
If the only purpose is for IP blacklists (bans, dos, etc), then doing 12 rounds of bcrypt would be counter productive. It'd be a lot of CPU usage on your end. Especially if its done for every request.
A better approach would be something quicker to compute but that you can destroy equally easily. Generate a random token that cycles every X minutes/hours. The HMAC the remote IP and this secret. Use the result for bans/rolling rate limiting. If you keep the token only in memory then you don't have to worry about the IP lists being leaked as they won't be recoverable.
They are certainly capable of paying for it... the facts show though that they are typically not good at shielding their source IP. The wikipedia edit from the senate IP, the tracking of the SAIC IP to NSA etc...
And yes, I know that 12 rounds of bcrypt doesn't mean much. It will delay brute force attacks, though.