In short we have some public facing services that we have users connect to externally. These users predominantly are connecting from various means and locations within the country. Geo filters are about as effective as a screen door on a submarine. I'm seeing alot of inbound scans from the following domains and quite frankly would like to make it go away.
stretchoid.com, leakix.org, shadowserver.org. I've also seen instances of these scans coming from AWS EC2 instances. Because these are likely load balanced/cloud based services the IP can change at any moment and pop up someplace else so filtering by IP is also a dubious approach.
I've attempted using the URL filter policy and haven't had any luck getting that to work being that's seemingly a destination only filter. I want to filter based on the source domain.
Is there a way to do this without negatively impacting the performance of the box?
