I operate a relatively small website that receives approx 200-300 unique (legitimate) visitors per month. As of the last time I measured, 97% of requests my we

I operate a relatively small website that receives approx 200-300 unique (legitimate) visitors per month. As of the last time I measured, 97% of requests my web server received were malicious. I've seen empty domains that respond with a 404 on every page with all kinds of bot/scanner/crawler in the logs.