Hmm, for some (other) attacks on my server, my backend actually grabs the WHOIS information and tries to extract the network range, which then gets iptabled.

Of course, for my private server i can be a lot more aggresive in blocking large swathes of the internet.