All legitimate points. FYI I didn't say RIPE was USSR, I said most attacks came from RIPE and the other non-ARIN which I listed. I don't understand your point about bots. I was agreeing that most people are intelligent and well intentioned but some people created and use bots, and that's what the traffic is.
I agree with server host thing as you mention and include them under the broad category of ARIN proxies. It is irrelevant to me whther they are actually a proxy or not, servers accessing my web site are not people and I block them. I used to have a ton of legitimate traffic from education networks but I am changing my focus and at this point schools are idiots downloading the worst of the internet, so they are blocked.
Based on the business the criteria would be different but I said legitimate business accessing the site from the beginning.
Businesses often block outgoing overseas phone calls for same reason. There's only one reason these communications with overseas are taking place, and it's not good.
I also said earlier that if there were legitimate traffic I would compartmentalize the traffic to separate servers. There is no reasin for all these servers being cracked to be exposed to the Chinese and Russians, but businesses and government are being raped by them every day. I attribute it to Chinese and Russians being smarter than the clowns running these servers.
I don't have to be one of them.