You are welcome. And thanks for reaching out to me.
FYI, I have blocked close to100,000 IPs many of which are in EMEA (Europe), Russia, and South Africa. There are more to block, so I'm still working on them as they come in. I also notice a vast slowness with the site, but I don't see it on the hosting provider, so that's tell me someone is nailing this site with a DDOS attack. My guess is it's Russian or Chinese. If I can figure out the source, I can stop it, but it's hitting the hosting provider IP for this site, and I don't have access to that.
I looked into blocking the whole IP range for both, but their IP blocks are intermingled with legit countries, so it's difficult, and besides this site admin pages won't take the list (it's huge). For example, attached is the current, as of today's date, the list of IPs just for Russia. This system wouldn't take it due to the numerous entries, so it leaves me to block by IP block.
For example:
2.16.53.0/24 means 2.16.53.1 to 2.16.53.254 (256 IPs)
2.16.103.0/24 means 2.16.103.1 to 2.16.103.254 (256 IPs)
there are more in the list that start with 2.16.x.x
I can combine them in one big IP range, such as 2.16.0.0/16 (means everything between 2.16.0.1 to 2.16.255.254 or 65,536 IPs)
So checking
https://www.ip2location.com/demo/2.16.0.0 I found that that range belongs to Brazil So I can be safe to block the range. To make it easier for me would be to block 16,000,000 addresses by blocking 2.0.0.0/8. I looked that up, and much of it is in UK and Ireland. Yep, they traverse different parts of the world. And I found some of the other ranges also have some in the US, not this one, but others. So I had to take a step back to figure this out a little better.
I still need to migrate this to the new platform, but even they don't have a good solution. I may move this off InMotion hosting and go with Microsoft's Office 365 hosting. Still studying which direction is best.
