Detected Germany as country or USA IP?

toplisek

• February 13, 2021 13:12

We have noticed interested Firewall blocked access. Should we trust country detection or IP. As I understand country can be masked and also country. Which value is more to trust as IP is from USA and premium domain and country is from Europe.

• 

  cPRex Jurassic Moderator

  • February 18, 2021 14:37

  Hey there! That is really up to you and how specific you want to be. While there is no perfect list of IPs for each country, blocking a specific country using the country code block will block nearly all that traffic. Using an IP address or a range of IP addresses would be more specific, but you would have to know the range you want to block.

  0
• 

  toplisek

  • February 19, 2021 07:05

  It is a message from Firewall and IP is from USA but country is posted as Germany.

  0
• 

  cPRex Jurassic Moderator

  • February 19, 2021 12:36

  Are you using a firewall tool such as CSF? If so, it might be a good idea to speak with their support team directly to see if there is possibly an issue wit the way that IP address is being reported.

  0
• 

  toplisek

  • March 01, 2021 11:35

  If there is attack and unknown IP, how to see real IP source in this case? Is it masked IP detection? An example: IP: 2604:a880:0:XXX (Unknown)

  0
• 

  cPRex Jurassic Moderator

  • March 01, 2021 13:29

  There likely is not going to be a way to see that through the automated tools. You could always try using an IP lookup tool like IPv6 Address Lookup Tool | UltraTools to see if you can get more details on where it originated from.

  0

Please sign in to leave a comment.