Block Continuosuly changing IP's Last Three Digits

there are so much attack on my site visitors changing thier ip adresses last three digits continuously my site has vpn blocker and banned ip adresses already but there is new issue which is this
154.80.105.162
154.80.123.98
154.81.244.193
154.80.76.72
154.80.69.249
154.80.116.106
154.80.70.6
154.80.104.63
154.81.241.19
154.80.123.87
154.80
154.81
154.80.105.242
154.80.110.195
154.80.1
154.80.10
154.80.105
154.80.105.2
154.8
154.80
154.81
140.213.113.81
140.213.115.223
140.213.115.184
140.213.114.166
140.213.113.169
140.213.115.188
140.213.114.129
140.213.11
140.213.115
140.213.113
140.213.114
82.145.210.221
82.145.209.157
82.145.210.98
82.145.211.7
82.145.209.229
154.81.240.59
154.80.68.196
116.71.186.220
182.191.139.82
116.71.170.52
154.80.117.33

you can see the last digits are continously changing so how can i block them more there is also some ips that are 50% clean and 50% abbusive same person is attacking using 50% abusive ip thats why vpn blocker is unable to block it

so can anyone guide how to create a rule to block thise last digits changing ip

Block using CIDR notation in a WAF rule:

154.80.105.0 β†’ 154.80.105.0 = 154.80.105.0/24 etc
154.80.0.0 β†’ 154.80.255.255 = 154.80.0.0/16 etc

See CIDR to IPv4 Address Range Utility Tool | IPAddressGuide for a range calculator

Alternative is to block the ASNs if the traffic is from countries you dont do business with

The β€œclean” attempts are probably the same users/bots/script kiddies checking to see of they have access to your site before attacking

1 Like

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.