Skip to main content
Recon44 lets you block traffic at the edge based on where it originates — by country, by autonomous system number (ASN), by hosting provider, or by known-bad network categories like Tor exit nodes. Rules take effect globally within seconds and require no code changes. This guide walks you through setting up each type of geo block and explains the caveats to be aware of before blocking large regions.

​
How geo blocking works

When a request reaches Recon44’s edge, its source IP is looked up against a continuously updated geolocation and ASN database. If the IP matches a block rule you have set, the request is dropped before it reaches your origin server. The decision happens in the same sub-50ms inspection window as WAF rules.
Geo and ASN blocking is available on all paid plans (Pro and above). Free plan users can view geo data in the threat feed but cannot enable blocking rules.

​
Whitelist legitimate IPs before blocking a region

Before creating any broad geo or ASN block, identify IPs you want to preserve access for — your own office IP, a partner’s IP range, a monitoring service — and add them to your whitelist. Whitelisted IPs bypass all blocking rules, including geo and ASN blocks.
1

Go to IP Rules

Navigate to Security → IP Rules in the dashboard.
2

Add a whitelist entry

Click Add rule, enter the IP address or CIDR range, and set the action to Whitelist. Add a label such as “Office IP” or “Uptime Robot” for future reference.
3

Save

Click Save rule. The whitelist takes effect within 30 seconds.
Do this before enabling geo or ASN blocks. Once a block is active, traffic from that region is dropped immediately — including any legitimate users or services you forgot to whitelist.

​
Block a country or region

1

Open Geo Blocking

Navigate to Security → Geo Blocking from the left sidebar.
2

Search for the country

Use the search box to find the country or territory you want to block. You can search by name or ISO 3166-1 alpha-2 code (for example, RU for Russia, CN for China).
3

Enable the block

Click the toggle next to the country name. The toggle turns red and the block becomes active within 30 seconds across all edge nodes.
4

Verify in the threat feed

Go to Dashboard → Threat Feed. Requests from the blocked country will appear with a Geo blocked badge.
If you serve a specific set of countries, consider using an allowlist approach instead: block all traffic by default (under Geo Blocking → Default action) and then explicitly allow the countries you serve. This is stricter and simpler to maintain than a growing blocklist.

​
Block an ASN or hosting provider

ASN blocking targets traffic from a specific network operator rather than a geographic region. This is useful for blocking cloud provider IP ranges commonly used for automated attacks (such as data center ASNs from DigitalOcean, OVH, or similar hosting providers).
1

Open ASN Blocking

Navigate to Security → ASN Blocking from the left sidebar.
2

Search for the ASN or provider

Enter the ASN number (for example, AS14061 for DigitalOcean) or the provider name in the search box. Recon44 shows matching ASNs with their current traffic volume against your site to help you assess the impact.
3

Enable the block

Click the toggle next to the ASN. The block is applied within 30 seconds.
4

Review and repeat

Repeat for any additional ASNs you want to block. You can manage all active ASN blocks from the same page.
Blocking a hosting provider ASN may affect legitimate users who access the internet through that provider’s infrastructure. Review your traffic data for the ASN before blocking.

​
Block Tor exit nodes

Recon44 maintains an automatically updated list of known Tor exit node IP addresses. Enabling this blocks all requests originating from the Tor network.
1

Open Geo Blocking

Navigate to Security → Geo Blocking.
2

Enable Tor exit node blocking

Scroll to the Special categories section and toggle on Tor exit nodes. Recon44 updates this list continuously — you do not need to maintain it manually.

​
Block known bad ASNs

The Known bad ASNs category in Recon44 is a curated, continuously updated list of ASNs associated with high volumes of malicious traffic — including botnets, bulletproof hosting providers, and repeat offenders in the threat intelligence community.
1

Open ASN Blocking

Navigate to Security → ASN Blocking.
2

Enable known bad ASNs

Scroll to the Managed lists section and toggle on Known bad ASNs. Recon44 manages and updates this list automatically.
Enabling Known bad ASNs is a good first step for most sites — it blocks high-risk networks with minimal false positive risk because the list is curated specifically for malicious infrastructure.

​
Practical use cases

If your product is only available in certain countries (due to legal, licensing, or business constraints), blocking all other regions reduces your attack surface significantly. Use the allowlist approach: set the default action to Block and explicitly allow only the countries your service operates in.
Most legitimate end users do not access websites from data center IP ranges. Blocking the ASNs of major VPS providers (DigitalOcean, Linode, Vultr, OVH, Hetzner) can dramatically reduce automated scanning and brute force attempts without affecting real users.
Combining Tor exit node blocking, known bad ASN blocking, and data center ASN blocking eliminates a large share of automated bot traffic and scrapers before WAF rules even need to fire.
If your threat feed shows a concentrated attack from a specific country or ASN, enable a block immediately from Security → Geo Blocking or Security → ASN Blocking. You can remove the block just as quickly once the attack subsides.

​
Caveats

CDN and proxy IPs: Traffic that passes through a CDN, reverse proxy, or load balancer may appear to originate from the CDN’s IP range rather than the end user’s country. If you are running Recon44 behind another CDN layer, verify that the correct client IP is being forwarded before relying on geo blocking. VPNs and proxies: Users behind commercial VPNs will appear to originate from the VPN provider’s location, not their real location. Geo blocking cannot reliably restrict determined users who use VPNs. Dynamic ASN routing: Large cloud providers sometimes move IP ranges between ASNs. An ASN block is accurate at the time it is set but may drift slightly over time as providers reorganize their networks. Recon44 updates its ASN database daily to minimize this drift.