> I decided to redirect all requests back to their own IP addresses.
I think this one is something to avoid. What happens if you have a false positive? You've just redirected one of your legitimate users to the attacker.
I think this one is something to avoid. What happens if you have a false positive? You've just redirected one of your legitimate users to the attacker.
I interpreterd it as being redirect back to your own address. E.g if I'm an attacker and my IP is [FE80::2], then I'd be redirected to [FE80::2]. Same for an user. And if you've got attackers from 10k IPs, then I'd think it'd be unlikely that you'd single out a single attacker IP.