This subdomain and all other subdomains, are proxied by Cloudflare. If you own a domain, you can use Cloudflare to manage your visits. Cloudflare give you part of this features for free and they can be very useful, while there are some keys that I had learned to create accurate rules against this attacks, without blocking possible visitors from the same country that are not attackers.
Knowing a bit about the basic principles of Internet Routing is important to make some decisions. For example, to understand the history of attempt attacks against this sites, you can talk about the Art subdomain which is the main site of my artistic work, that already was having some attacks against the same platform type, that this sites had as attacks. Even if these attacks cannot break my sites, I think they are annoying and therefor I wish to stop see them when I am trying to have a notion of how many visits I have today and which links have a real visitor.
The first page that was made about this attacks is is called MAR after that, Hard Decisions, Word Press Attacks, Stupid and many other posts, that were used to give a message to the attackets, against their attacks, by redirecting their attacks to this pages. I discover that, by the logic of attacks repetition, the attackers don't read the logs, that describe that they fail, because the software they use didn't find any PHP file, known by the software they use. Excited Moments is another post that describe this events and Against Patterns, Refusing to Learn and others, where new posts that serve the same purpose: send a message to the attacker, while once again, the attacks don't read the logs because after failing, he try against the same, again and again in a compulsive way.
First I start to create rules for specific Paths, then I start blocking IPs, but after some logical thinking I discover that I can filter attacks based on ASNs. Today I add the condition of "Country" AND "ASN" AND "IP", to be more accurate of that filtering, resulting is having a clean list of visitors report without attacks attempos that will fail again. Sometimes I think that is useful to informt the attacker that he him failing, motivate him to learn more, but since the majority didn't develop self discipline, they probably get more angry. LoL (like children)
Inspired by the publication Stupid Mastodon Laws, I figure out that I could do the same, but I see it unfair and therefor, adding the IPs that come from the two main sources + their IPs, don't ask me to add complicate rules that describe the paths used on attacks, but filter attacks from the main routers that ISPs control and redirect them to the police site from their origins.
Attackers don't read the logs and the question is: Does the Police read the logs of their site activity? If they do, I can report attacks by redirecting these attacks to police site, if the police don't read the logs, then the main purpose of the rule are lost, but at least they don't disturbe me anymore.