> ## Documentation Index
> Fetch the complete documentation index at: https://docs.recon44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Block Traffic by Country, Region, or ASN

> Use Recon44's geo and ASN blocking to drop traffic from entire countries, hosting providers, Tor exit nodes, or known-bad networks in one click.

Recon44 lets you block traffic at the edge based on where it originates — by country, by autonomous system number (ASN), by hosting provider, or by known-bad network categories like Tor exit nodes. Rules take effect globally within seconds and require no code changes. This guide walks you through setting up each type of geo block and explains the caveats to be aware of before blocking large regions.

## How geo blocking works

When a request reaches Recon44's edge, its source IP is looked up against a continuously updated geolocation and ASN database. If the IP matches a block rule you have set, the request is dropped before it reaches your origin server. The decision happens in the same sub-50ms inspection window as WAF rules.

<Info>
  Geo and ASN blocking is available on all paid plans (Pro and above). Free plan users can view geo data in the threat feed but cannot enable blocking rules.
</Info>

## Whitelist legitimate IPs before blocking a region

Before creating any broad geo or ASN block, identify IPs you want to preserve access for — your own office IP, a partner's IP range, a monitoring service — and add them to your whitelist. Whitelisted IPs bypass all blocking rules, including geo and ASN blocks.

<Steps>
  <Step title="Go to IP Rules">
    Navigate to **Security → IP Rules** in the dashboard.
  </Step>

  <Step title="Add a whitelist entry">
    Click **Add rule**, enter the IP address or CIDR range, and set the action to **Whitelist**. Add a label such as "Office IP" or "Uptime Robot" for future reference.
  </Step>

  <Step title="Save">
    Click **Save rule**. The whitelist takes effect within 30 seconds.
  </Step>
</Steps>

<Warning>
  Do this before enabling geo or ASN blocks. Once a block is active, traffic from that region is dropped immediately — including any legitimate users or services you forgot to whitelist.
</Warning>

## Block a country or region

<Steps>
  <Step title="Open Geo Blocking">
    Navigate to **Security → Geo Blocking** from the left sidebar.
  </Step>

  <Step title="Search for the country">
    Use the search box to find the country or territory you want to block. You can search by name or ISO 3166-1 alpha-2 code (for example, `RU` for Russia, `CN` for China).
  </Step>

  <Step title="Enable the block">
    Click the toggle next to the country name. The toggle turns red and the block becomes active within 30 seconds across all edge nodes.
  </Step>

  <Step title="Verify in the threat feed">
    Go to **Dashboard → Threat Feed**. Requests from the blocked country will appear with a **Geo blocked** badge.
  </Step>
</Steps>

<Tip>
  If you serve a specific set of countries, consider using an **allowlist approach** instead: block all traffic by default (under **Geo Blocking → Default action**) and then explicitly allow the countries you serve. This is stricter and simpler to maintain than a growing blocklist.
</Tip>

## Block an ASN or hosting provider

ASN blocking targets traffic from a specific network operator rather than a geographic region. This is useful for blocking cloud provider IP ranges commonly used for automated attacks (such as data center ASNs from DigitalOcean, OVH, or similar hosting providers).

<Steps>
  <Step title="Open ASN Blocking">
    Navigate to **Security → ASN Blocking** from the left sidebar.
  </Step>

  <Step title="Search for the ASN or provider">
    Enter the ASN number (for example, `AS14061` for DigitalOcean) or the provider name in the search box. Recon44 shows matching ASNs with their current traffic volume against your site to help you assess the impact.
  </Step>

  <Step title="Enable the block">
    Click the toggle next to the ASN. The block is applied within 30 seconds.
  </Step>

  <Step title="Review and repeat">
    Repeat for any additional ASNs you want to block. You can manage all active ASN blocks from the same page.
  </Step>
</Steps>

<Note>
  Blocking a hosting provider ASN may affect legitimate users who access the internet through that provider's infrastructure. Review your traffic data for the ASN before blocking.
</Note>

## Block Tor exit nodes

Recon44 maintains an automatically updated list of known Tor exit node IP addresses. Enabling this blocks all requests originating from the Tor network.

<Steps>
  <Step title="Open Geo Blocking">
    Navigate to **Security → Geo Blocking**.
  </Step>

  <Step title="Enable Tor exit node blocking">
    Scroll to the **Special categories** section and toggle on **Tor exit nodes**. Recon44 updates this list continuously — you do not need to maintain it manually.
  </Step>
</Steps>

## Block known bad ASNs

The **Known bad ASNs** category in Recon44 is a curated, continuously updated list of ASNs associated with high volumes of malicious traffic — including botnets, bulletproof hosting providers, and repeat offenders in the threat intelligence community.

<Steps>
  <Step title="Open ASN Blocking">
    Navigate to **Security → ASN Blocking**.
  </Step>

  <Step title="Enable known bad ASNs">
    Scroll to the **Managed lists** section and toggle on **Known bad ASNs**. Recon44 manages and updates this list automatically.
  </Step>
</Steps>

<Tip>
  Enabling **Known bad ASNs** is a good first step for most sites — it blocks high-risk networks with minimal false positive risk because the list is curated specifically for malicious infrastructure.
</Tip>

## Practical use cases

<AccordionGroup>
  <Accordion title="Block regions you do not serve">
    If your product is only available in certain countries (due to legal, licensing, or business constraints), blocking all other regions reduces your attack surface significantly. Use the allowlist approach: set the default action to **Block** and explicitly allow only the countries your service operates in.
  </Accordion>

  <Accordion title="Stop data center and VPS abuse">
    Most legitimate end users do not access websites from data center IP ranges. Blocking the ASNs of major VPS providers (DigitalOcean, Linode, Vultr, OVH, Hetzner) can dramatically reduce automated scanning and brute force attempts without affecting real users.
  </Accordion>

  <Accordion title="Reduce scraping and bot traffic">
    Combining Tor exit node blocking, known bad ASN blocking, and data center ASN blocking eliminates a large share of automated bot traffic and scrapers before WAF rules even need to fire.
  </Accordion>

  <Accordion title="Respond to an active attack">
    If your threat feed shows a concentrated attack from a specific country or ASN, enable a block immediately from **Security → Geo Blocking** or **Security → ASN Blocking**. You can remove the block just as quickly once the attack subsides.
  </Accordion>
</AccordionGroup>

## Caveats

**CDN and proxy IPs**: Traffic that passes through a CDN, reverse proxy, or load balancer may appear to originate from the CDN's IP range rather than the end user's country. If you are running Recon44 behind another CDN layer, verify that the correct client IP is being forwarded before relying on geo blocking.

**VPNs and proxies**: Users behind commercial VPNs will appear to originate from the VPN provider's location, not their real location. Geo blocking cannot reliably restrict determined users who use VPNs.

**Dynamic ASN routing**: Large cloud providers sometimes move IP ranges between ASNs. An ASN block is accurate at the time it is set but may drift slightly over time as providers reorganize their networks. Recon44 updates its ASN database daily to minimize this drift.