I know it's not what you're looking for, but for enterprise users we've seen that in many environments the customer is pretty aware of where their users connect and we just setup Geo fencing (sth similar to https://norz.at/?p=1245) ... this has drastically lowered the amount of source IPs that hammer our IPs. There's just that "but" that even that NS Console supports using MaxMind DB's directly, the licensing side-of-things is somewhat of a mystery for me. Should we have a subscription for these...?

The free one is what I use, I usually only update the DB when a subnet no longer works as it is assigned to a new country/provider. I didn't think of adding these as custom entries to a country that doesn't exist to geo-fence them out. That is a good idea.

We've even built a setup in one environment where some countries are blacklisted since from the beginning and then added another policy post-authentication that checks if the specific user is allowed to use the services from outside our accepted are. Ofc then log everything, especially the anomalities

I am already doing geo location blocking. Thinking about adding these vpn and vps subnets to a blockable geo-location. I just need to see if custom static entries override entries from the built in location db.

oh, gotcha

So first powershell script worked. But took about 8 hours to process the whole ipv4.txt and the maxmind csv. Copilot is helping with cut that time down. But the initial run looks good. Any subnets tagged as commercial vpn or vps get a special continent of VPN. Though one of my fellow NetScaler Engineer mentioned "Isle of Misfit Toys."