It's quite well known that if an attacker wanted to, they could spoof their IP address by using a proxy server or some other means.
Whilst that's possible, whenever I perform a geo-location lookup on the IP addresses that conduct automated brute force attacks, probing, port scanning etc. against my servers, almost always the IP addresses do resolve to countries associated with cyber crime, like:
- China
- USA
- Russia
- Turkey
- Italy
- etc.
Knowing that the Internet is very independent of geography, for example it's possible to sign up with server hosts anywhere in the world and in fact it would be desirable - from an attackers point of view - that their IP was not associated with a country with a bad reputation.
Also, because servers are sometimes added to a botnet when compromised, I always assumed remote servers were the preferred "weapon of choice" for attackers.
However, I'm now wondering - are the people conducting this activity forced to use local ISP's in countries with more lax laws and that don't crack down on malicious activity (I'm assuming they can't get access to all the big name reputable providers - because their accounts would be shut down quite quicky)?
And does this also then mean that they generally have to supply their own machines? I know there are lots of ways to setup a computer and connect to the Internet - but what is the typical setup for these automated bots regarding whether they are remote rented servers or local physical machines and how do they get Internet access?