@Clive Robinson
If as many claim the criminal element that frequents the Internet outside of Russia but are from Russia, are sanctioned by the Russian Government. Then it is highly unlikely that the Russian Government will "bottle them up".
And? Just because a defense isn't perfect doesn't mean it isn't worth doing, especially if it forces the attacker to be more exposed on the "outside". It's not like, for example, foreign meddling in the 2016 election got a free pass simply because it used Facebook as a puppet.
As the old saying has it, if you have to have them in the boat you would rather they [spit] out of the boat than [spit] in...
Minor edit, just in case the mods take offense. :-)
The problem is that the Internet is not a vast, empty ocean. It is crowded with boats, and you're surrounded by 100 baddies looking to spit in for every one you have looking to spit out. The right solution is not an arms race, but to stop all the spitting.
@SpaceLifeForm
Remember, attribution is hard.
No, it isn't. That's the same tired excuse war criminals and sociopathic cloud providers always trot out when they want to use innocents as human shields. "Hey, careful, you don't want to blame this on me and the company I keep, because we're just following orders!" If I'm attacked by 3.130.4.179 (and I just was as I'm making this reply), it is easy to attribute that to Amazon's 3.128.0.0/9, and act accordingly.
Are you certain that those packets really originated from where you think they did?
Yes, I am. It's not individual packets that trigger action, but traffic at layers after handshakes have connected both ends. If you're going to attempt to trot out some "behind 7 proxies" nonsense, understand that my job is to secure my servers, not track down any root geopolitical factions that pull the strings of vast global criminal organizations. Or, put another way, I leave it to Amazon to police their own network; if they have no interest in doing that, then they too should be bounced off the Internet.
99535d726496ec743be9fcc149eef81c9da3ac21dbcfed05793c13cd7d8ea91b