I did something similar about 15 years ago. They weren't as complex back then, and there was more effort to obfuscate them. Mostly they came from Israeli Chine

I did something similar about 15 years ago. They weren't as complex back then, and there was more effort to obfuscate them. Mostly they came from Israeli Chinese and Russian IP addresses.