Filtering by client IP address for Web App Sessions

["Evans, Arian" <Arian.Evans () fishnetsecurity com>]

Question for those outside of the US of A:

In Europe, Asia, etc. do you have:

1. Any significant user population of your web applications
comprised of AOL (America online) users?

2. Are there many ISPs or large organizations using megaproxies
that swap client source IPs across entire classes of netblock (e.g.
-like AOL does)?

I've been telling people for years that you can't filter by source or
even last octet netblocks and lately have been wondering if I'm dense
and this is a US-centric bias of mine thanks to the ISP behaviors
I've had to deal with over the years.

Feedback appreciated,

Arian