Another useful classification is to get the ASN and CIDR block the attacks are coming from, allowing broader blocks or rate-limiting from high-noise / high-attack network space.
The Routeviews project (https://www.routeviews.org/) provides a reverse-lookup which returns ASN and CIDR for a given IP. For example:
That's the ASN (AS21581 -- M5HOSTING / M5 Computer Security) and CIDR block (209.216.230.0/24) for news.ycombinator.com, a/k/a 209.216.230.240.
What I've frequently found is that hostile traffic is fairly highly concentrated among bad-actor space, often datacentres with little reason to be generating end-user traffic or HTTP requests. Though that includes a surprisingly large quantity of web crawlers (few of which belong to any organisations you've heard of).
And for those individuals (or organisations) making heavy use of the resource, the zonefiles are downloadable, for local query capabilities / reduced latency.
Comments
Another useful classification is to get the ASN and CIDR block the attacks are coming from, allowing broader blocks or rate-limiting from high-noise / high-attack network space.
The Routeviews project (https://www.routeviews.org/) provides a reverse-lookup which returns ASN and CIDR for a given IP. For example:
That's the ASN (AS21581 -- M5HOSTING / M5 Computer Security) and CIDR block (209.216.230.0/24) for news.ycombinator.com, a/k/a 209.216.230.240.What I've frequently found is that hostile traffic is fairly highly concentrated among bad-actor space, often datacentres with little reason to be generating end-user traffic or HTTP requests. Though that includes a surprisingly large quantity of web crawlers (few of which belong to any organisations you've heard of).
And for those individuals (or organisations) making heavy use of the resource, the zonefiles are downloadable, for local query capabilities / reduced latency.