The security benefit is likely small, but real.

My workplace deals with scans from foreign soil all the time. Mostly these come from a few notorious places like Palestine, or Russia where political and legal issues exist between the US and these countries that make them more attractive attack hosts. They also come from more friendly countries like France or The Netherlands. They're far less likely to come from inside my own country. I hazard a guess that this might be because it's easier to obtain search warrants or tap/trace devices for a source and a target within the same country. Where these people exist in meat-space is anyones guess.

These are all largely automated processes targeting large swaths of the internet. They're unsophisticated enough that the attacker isn't likely trying to target us per-se, but is just trying to find "someone" to go after.

It's certainly true that these attackers can use other means to use an IP inside my country. I've seen them do this through various other means when they're blocked by us. But this takes extra effort for the attacker, which may be better spent elsewhere and may not be worth the trouble for the attacker to go after a more hardened target.

As the saying goes, you don't have to be the fastest animal running away from the predator, you just can't be the slowest.

The security benefit is likely small, but real.

My workplace deals with scans from foreign soil all the time. Mostly these come from a few notorious places like Palestine, or Russia where political and legal issues exist between the US and these countries that make them more attractive attack hosts. They also come from more friendly countries like France or The Netherlands. They're far less likely to come from inside my own country. I hazard a guess that this might be because it's easier to obtain search warrants or tap/trace devices for a source and a target within the same country. Where these people exist in meat-space is anyone's guess.

These are all largely automated processes targeting large swaths of the Internet. They're unsophisticated enough that the attacker isn't likely trying to target us per se, but it is just trying to find "someone" to go after.

It's certainly true that these attackers can use other means to use an IP address inside my country. I've seen them do this through various other means when they're blocked by us. But this takes extra effort for the attacker, which may be better spent elsewhere and may not be worth the trouble for the attacker to go after a more hardened target.

As the saying goes, you don't have to be the fastest animal running away from the predator; you just can't be the slowest.

The security benefit is likely small, but real.

My workplace deals with scans from foreign soil all the time. Mostly these come from a few notorious places like Palestine, or Russia where political and legal issues exist between the US and these countries that make them more attractive attack hosts. But also come from more friendly countries like France or The Netherlands. They're far less likely to come from inside my own country. I hazard a guess that this might be because it's easier to obtain search warrants or tap/trace devices for a source and a target within the same country.

These are all largely automated processes targeting large swaths of the internet. They're unsophisticated enough that the attacker isn't likely trying to target us per-se, but is just trying to find "someone" to go after.

It's certainly true that these attackers can use other means to use an IP inside my country. I've seen them do this through various other means when they're blocked by us. But this takes extra effort for the attacker, which may be better spent elsewhere and may not be worth the trouble for the attacker to go after a more hardened target.

As the saying goes, you don't have to be the fastest animal running away from the predator, you just can't be the slowest.

The security benefit is likely small, but real.

My workplace deals with scans from foreign soil all the time. Mostly these come from a few notorious places like Palestine, or Russia where political and legal issues exist between the US and these countries that make them more attractive attack hosts. They also come from more friendly countries like France or The Netherlands. They're far less likely to come from inside my own country. I hazard a guess that this might be because it's easier to obtain search warrants or tap/trace devices for a source and a target within the same country. Where these people exist in meat-space is anyones guess.

These are all largely automated processes targeting large swaths of the internet. They're unsophisticated enough that the attacker isn't likely trying to target us per-se, but is just trying to find "someone" to go after.

It's certainly true that these attackers can use other means to use an IP inside my country. I've seen them do this through various other means when they're blocked by us. But this takes extra effort for the attacker, which may be better spent elsewhere and may not be worth the trouble for the attacker to go after a more hardened target.

As the saying goes, you don't have to be the fastest animal running away from the predator, you just can't be the slowest.