In my experience, blocking traffic by AS number is vastly superior. You can either analyze your own traffic and build a list of VPN, foreign CLOUD HOSTING provi

In my experience, blocking traffic by AS number is vastly superior. You can either analyze your own traffic and build a list of VPN, foreign CLOUD HOSTING providers, Pro/Virtual ISPs, foreign TELCOS and others over time (which I recommend), or you can just use existing lists to achieve pretty much the same thing. The beauty of it is ASNs are much more granular than GEO subnets and will allow you to block bad actors in your geo. Plus, they are by construction rather precise with few false positives. Check your traffic once in a while, if you get DDoSed or bruteforced just ban the AS and forget about the tens of thousands of IPs it could have used otherwise.