Geographic rate limiting: tighter for some countries, but never a wall

Geographic rate limiting: tighter for some countries, but never a wall

Blocking a whole country is the loudest tool in the panel and almost always the wrong one. Real customers travel, use VPNs and roaming SIMs. Bots rent servers in whatever country you left open.

A more useful pattern is graduated limits:
— baseline limit for everyone;
— a lower threshold for countries where you have no customers but see scanning traffic;
— a managed challenge instead of a block when the lower threshold is exceeded.

This way a real person from an unexpected location gets a quick check, not a closed door, while automated traffic from the same region has to solve something every few requests.

One more thing: check what "country" actually means in your logs. Data-center ranges are geolocated to where the facility is, not where the operator sits. A spike "from Germany" is often a hosting provider, and that's a different rule altogether.

—
Соседний канал в сети: @PulsePolicyDesk