Yes we use CSF on this server and it is configured quite well, the majority of the ips that are generated are from the countries that I have listed.
but when you have a few hundred thousand ips attacking from a certain region it becomes resource intensive to log and block each one. so it is much more efficient to block the originating country.
I have created an exception for your servers within our firewall allowing it's origin country access.
