> The easiest way to deal with the usual suspects is to just block the entire countries network range(s).

Keep in mind that this should be paired with an ASN blacklist - MaxMind also has an ASN mmdb for convenience - because IP address to country maps are almost entirely self-declared[0].

For example, Tencent (AS132203), which you almost certainly want to block, has ranges in 73 different countries per [1].

[0]: https://datatracker.ietf.org/doc/html/rfc8805

[1]: https://bgp.tools/as/132203#prefixes

I, temporarly, banned some ip range. I didn't find a source for pinpointing countries; though I am interested. Could you point me to some sources which, deterministically, resolve to some countries? To my knowledge you can not reliably identify countries by ip since this would be dependent on DNS servers. Though I am just a application programmer!

Thanks in advance.

Your router doesn't care about their DNS settings. IP addresses are very easy to tie back to countries. The reason they say it's not reliable is because it's trivial to spoof the country, but even so, a lot of attackers don't even bother. It's sort of like the Nigerian prince scam calls: if you're wise enough to block Russia, you're not worth their time.

Your firewall vendor should supply you with country lists, just select the known bad ones and drop their traffic. If you have a consumer grade router, you will probably have to configure the blocklists manually.

> The reason they say it's not reliable is because it's trivial to spoof the country

ISPs sometimes do trade IPv4 blocks and countries to which it belongs do change occasionally. That can become a problem if you were like literally Netflix and someone few nation states over started an ISP.

I wonder if adding the US is now sensible.

Unless you're serving something, you should probably drop all incoming requests. If you are serving something, the US is a pretty big market to lock yourself out of.

FWIW, I blocked the US for a while.

Eventually, my lets encrypt cert expired and it turns out certbot is run from USA, so the auto renewal failed me.

Almost all spam traffic comes from the US, it's not even close. But for many people so does much of their human traffic.

Getting it directly from IANA is always the best approach.

Here is a "simplified" version in various formats.

https://github.com/HotCakeX/Official-IANA-IP-blocks

Gross - you're going to block countries just because the US government doesn't like those countries?

I'm happy to unblock China from accessing my website, once China does something about the millions of daily hack attempts originating from that country.

But you pointed to a list of OFAC sanctioned countries, not China.

Do you think you get excluded from mass scans for disagreeing with your government?

Routers got such a thing build in nowadays, just gotta enable it (not the ones from your ISP of course)