You can use a service that pings (or traceroutes) a given address with multiple probes. Round-trip lightspeed is 150 km/msec. So if you see a probe location with minimum rtt on the order of 1 msec, that's about where the address is. And conversely, if you see probes at the claimed location with minimum rtt over 20 msec, be suspicious.
Also, you can also have your attack derive from Russia. Russia (the government or a Russian hacker group) doesn't have to be behind the attack for it to look like its sourced from Russian internet space.
Ping services with many probes:
https://asm.ca.com/en/ping.php
https://www.maplatency.com/
https://ping.pe/