[ggm]

Bear in mind that IP bindings to bad (or good) actors is often ephemeral, and these "taint lists" wind up creating as much damage as they repair. A classic example is the US DoD blacklisting significant parts of the pacrim economies because of applying blanket filters to IP addresses: The very economies that are under attack from cyber threats found themselves cut off from connectivity with an agency which is active in their region.

Under address rental models in cloud/service providers an address can be ephemeral to a bad actor for minutes, and then back in the pool. If you apply this kind of filter, somebody else taking service from AWS or a sub-tenancy can find themselves in the bad place.

Third party damage risks basically.

[sharphall]

I second this. Bot activity can even come from legitimate ephemeral residential or office IPs with devices temporarily (hopefully) infected with malware.

[mrg3_2013]

Interesting point! In my case, it is mostly from China. So I could do geo block