I’ve noticed more suspicious traffic with UK geolocation in recent logs. Is this showing up for others too, or could it be a local spike or a hosting-provider pattern?
Are other people seeing more suspicious traffic from UK IPs lately?
Asked by
v8-ASIC
Answers
I’ve noticed a few more in recent blocks, but I haven’t compared enough data to call it a trend. A short burst can look like a regional increase, especially if several addresses belong to the same provider.
Reply to this answer
Geolocation alone is a pretty weak signal. An IP marked as UK-based may be a rented server, a compromised machine, or simply an address whose location data is off. I’d group events by ASN and provider, then compare the same time window across several weeks. That should help separate a genuine increase from a change in where the traffic is coming from.
Reply to this answer
Some of this may be cheap or short-lived hosting being used for abuse. That doesn’t prove a botnet, and it doesn’t mean the activity is tied to the country itself. Keep the logs and report specific abusive addresses to the relevant provider, but don’t expect a public abuse listing to be complete or current.
v8-ASIC:
Good point. I was treating the location label as more meaningful than it probably is.
Reply to this answer
If you need a quick response, base blocks or managed challenges on the behavior and risk to your service, not the country label by itself. Broad country blocks can catch legitimate users and still miss attackers using other routes. Rate limits and targeted rules are usually easier to review and undo.
Reply to this answer
Add your answer
Answers are reviewed before publication.
+7Tumbler:
That’s the distinction I’m trying to make. I’ll check whether the addresses share a network or hosting service.