A third-party DDOS protection service like cloudflare.com may be the best place to start for typical web traffic but these won't protect you from everything. None-the-less you've raised an important question and knowing how to protect your own servers by yourself is very important.
The following will give you instructions on how to block the proxy servers but I will also point out that getting the initial list of IP's to block, or allow, can be a bit tricky.
Effectively you want to know how to implement blacklists so you can block all of the attacking IP addresses an organization may be concerned about or see during an attack (in your case the IP list of the proxy servers). That said it's important to understand how blacklists really help you. Blacklists are a great way to slow-down or temporarily block attackers and can work great when triggered appropriately. Even a 30-minute blacklisting of IP's sending malicious traffic can really have a huge impact against any type of automated attack. There are tools like fail2ban (link below) which can easily help you automate your blacklisting based on malicious behavior. Likewise there are tools like ipset (link below) which can be used with iptables to create extremely large black-lists or white-lists than can easily block or allow tens of thousands of IP's with almost no impact on performance and block millions of IP's with only a slight performance on impact.
Effectively deploying ipset and iptables combined with the list of proxies is all you need.
The following are some tips I recommend for configuring your blacklists for long-term use:
Basically because every organization has different needs and different requirements each deployment may be a little bit different but as a general rule of thumb I group who I blacklist into three categories.
1.) IP's that will never have a need to connect to these systems
2.) IP's that are doing really targeted harmful stuff to these systems
3.) IP's that are scanning or doing something less harmful but are still annoying and may include a customers infected system.
and based on these groups (yours may be different especially given your immediate concern) I set a variety of different block times. In this example I use the following block times based on the groups above.
2.) 24-168 hours
3.) 30-60 minutes with 30 minutes being the most common.
This said I would also take into context what activity you are blacklisting. If an organization has a public website but I see attacks brute-forcing secure-shell or a VPN server (something that is NOT meant to be accessible to the general public) I don't mind blocking that type activity for much longer on that port or protocol. Likewise if I see an IP address really hammering a site with tens of thousands of attacks or repeated activities for days that IP gets blocked for a longer time. From the article you linked to you may want to block things for at least 48 hours to start with and start creating your white-list of good IP's immediately.
There are always risks when blocking traffic for any period of time but I've seen that it's becoming more common to see very large organizations blocking for at least 30 minutes to disrupt the automated attacks and I highly recommend doing this anyway because it gets rid of a lot of the brute-force scanning that ultimately effects all sites.
Note: With the #2 group it is also wise to send an abuse e-mail to the bad actors ISP CC'ing the IP owner and/or domain owner. Frequently this helps resolve the problem after a few days and if not you can always promote that IP to group #1 if you have too.
Finally I would also recommend creating a white-list of your infrastructure and also of your key business partners or critical clients. Occasionally business partners do check the security of their supply chain and you may not want to auto-block these organizations if they decide to take a closer look at what you are doing.
I think it is very wise to actively blacklist bad actors especially since it's a very cost-effective defense but I wouldn't limit your blocking to a single type & time-frame if you can avoid it. That said if you do, 30-minutes seems to be the industry norm right now.
If nothing else this will allow you to get the "hooks" in place to block large numbers of IP's in the future so I'd recommend this no matter how you handle your issue in the short-term. Hope this helps.