Very unlikely in my opinion - if the Iranian Revolutionary Guard did want to attack something, I doubt they would do it from an IP address in their own country.

Very unlikely in my opinion - if the Iranian Revolutionary Guard did want to attack something, I doubt they would do it from an IP address in their own country. I'm sure they have a decent botnet or two somewhere else, that's like opsec 101. Similarly, although Crimea specifically is now IP-banned, the rest of the Russian Federation is not. This is exactly what it looks like: a political sanction.