Disclaimer - I am not a security expert, so this may just be a dumb question. My security knowledge is focused strictly on development. When it comes to configuration and networking, I know only enough to get me by. I'm trying to change that.
First, I'm not even sure if this is a good idea or even something worth giving a lot of consideration to. If it's a bad idea, please say so in the answer (or a comment), and give an explanation of why.
We've got a publicly accessible website, and portions of it allow customers to access some sensitive data. We've already followed all of the OWASP guidelines in our applications, we have a Web Application Firewall, and we're already taking every precaution we can think of to lock it down. However, our site is constantly being scanned from sites overseas. China, Germany, North Korea, you name it.
Our business is restricted to a very small geographical area. We operate in three states in the United States. In our shopping cart, we sell items that can only be used at our stores - gift cards, for example. With very few exceptions there is absolutely no reason that anyone in another country would need to have access to this portion of our site. (I can see a soldier wanting to buy gift cards for their families back home, but not much else.)
I'm just curious about whether it would be possible to lock down the portion of the website by restricting IP addresses to IP addresses that come from the United States. To clarify, I know how to set IP restrictions in IIS, but I don't know if there are known ranges that are verifiably from the United States.
I do know about IP spoofing, and anonymizers, and I realize that we may lock out people using such tools, and that it's going to be possible for those outside the US to use such tools to bypass even this. I haven't thought through what that would do to the feasibility.