I am currently outside the US trying to log in to my health care provider's website and the connection just times out. I reached out to them on Twitter and they told me that as a security measure they block connections from outside of the US and suggest I use a VPN.

So great, I can use a VPN to solve my problem. But I am curious, is there any real security advantage to this sort of IP address blocking? I am a geek (web developer), but not a security specialist so I am sure I am missing something, but it seems to me that if I can use a VPN to connect from Europe then any reasonable hacker would just do the same thing.


4 Answers 4


The concept is "reducing the threat surface". If there is an expectation that no connections will be made from a certain geographic area, then it makes sense to block that area, because, by definition, it is not legitimate. In theory. (For a health provider, it's a weird choice since customers might want to manage their health while traveling, but this is a side issue.)

For one company I worked for, there was a list of countries that listed the Top 12 worst offenders for cybercrime, and we did not have any customers in those countries. So, it made sense to block them.

  • Could attackers use proxies/VPNs to attack from an allowed IP? You bet.
  • Did they? Who knows.
  • Did we experience high volumes of attacks from those 12 counties anyway? Oh yes.

We saw an immediate 80% drop in traffic to our webservers when we started the geo-IP ban.

  • 60
    OK great so there is at least some utility. Whether it is worth the inconvenience to actual customers is as you acknowledge a separate issue.Thanks. Commented Sep 16, 2019 at 17:03
  • 6
    @MatthewNichols you got it
    – schroeder
    Commented Sep 16, 2019 at 18:37
  • 4
    My company kept getting pings by random overseas "users" where we didn't have any clients, so we banned those countries as well. Basically, it makes it harder to be picked up by a random pickpocket, but it's not going to stop a targeted attack (the cynic in me says nothing has been found yet to stop a targeted attack).
    – user41376
    Commented Sep 17, 2019 at 1:39
  • 2
    @Hosch250 Seems like a strange way to operate. Why not get on the front foot and just ban all countries where you don't have users? Why do you have to wait to be pinged? Commented Sep 17, 2019 at 8:02
  • 6
    @Hosch250 It can also increase the cost of a targeted attack, now the attackers need to make sure they get IPs in the target country. Not that hard, but takes effort, likely more than setting the block up. And it reduces the fallback-IPs they can use once you block the ones they have in the country. As most of security, it's a numbers game of how much you want to invest and how costly you want to make attacks to someone. Commented Sep 17, 2019 at 8:16

One thing to consider: there are many countries in which the state, or maybe shady Internet providers, snoop on Internet traffic.

Even if your health care provider's website uses TLS (which I assume), PCs in those countries might have a fake root certificate installed to intercept your traffic. So when Joe average becomes sick and goes to an Internet cafe to check his coverage on the health provider's website, no one can be sure that their data - and login credentials - are safe.

Blocking foreign IP addresses and requiring a VPN mitigates at least some of this - you can't install the VPN client on some public computer, so you need to use your own laptop; this helps against keyloggers as well, and MITM attacks against a VPN are way harder than MITM against HTTPS, because the VPN client knows which certificates to expect, so you can't just use a fake CA.

  • I think you have to insert compromised HTTPS certificates in the OS for that kind of snooping to work, which can work on places like North Korea
    – lurscher
    Commented Sep 18, 2019 at 2:29
  • 1
    Most companies blocking IPs by geolocation probably aren't concerned for the end user's sake but rather their own data/network security.
    – TylerH
    Commented Sep 18, 2019 at 14:40
  • 4
    "there are many countries in which the state, or maybe shady internet providers, snoop on internet traffic" You mean like, say, the US and Canada? (Indeed among many others.)
    – user
    Commented Sep 19, 2019 at 8:28

The security benefit is likely small, but real.

My workplace deals with scans from foreign soil all the time. Mostly these come from a few notorious places like Palestine, or Russia where political and legal issues exist between the US and these countries that make them more attractive attack hosts. They also come from more friendly countries like France or The Netherlands. They're far less likely to come from inside my own country. I hazard a guess that this might be because it's easier to obtain search warrants or tap/trace devices for a source and a target within the same country. Where these people exist in meat-space is anyone's guess.

These are all largely automated processes targeting large swaths of the Internet. They're unsophisticated enough that the attacker isn't likely trying to target us per se, but it is just trying to find "someone" to go after.

It's certainly true that these attackers can use other means to use an IP address inside my country. I've seen them do this through various other means when they're blocked by us. But this takes extra effort for the attacker, which may be better spent elsewhere and may not be worth the trouble for the attacker to go after a more hardened target.

As the saying goes, you don't have to be the fastest animal running away from the predator; you just can't be the slowest.

  • 1
    Geo-blockers are trivial to circumvent, but there is a population who don't bother and run their scripts from their home IP. Blocking certain countries saves the noise (and work checking the noise) of these "intrusions". Some sites also block known VPNs and hosting services, but for many this is turning away valuable trade.
    – Rich
    Commented Sep 17, 2019 at 21:31
  • 2
    It's always a balance. I would say most doors are trivial to defeat (one swift kick with some heavy boots), but I still wouldn't recommend removing them.
    – Nelson
    Commented Sep 18, 2019 at 4:59
  • 2
    "notorious places like Palestine"? I hear about scans and attacks from Russia and China all the time, but Palestine? Is that actually common? Commented Sep 18, 2019 at 8:24
  • @JustinLardinois For us it is. Oddly we don't get scanned by China. I don't think I've seen one scan from that country. Quite a lot of other countries however. I'd be curious to know more than my limited scope on where scans come from though. Commented Sep 18, 2019 at 21:14
  • 1
    @Rich They are trivial to circumvent for single users. But if you're running a botnet with infected PCs from China, it's far from trivial to mask all those IPs I imagine (at least I'm not aware of a simple way to do this).
    – Voo
    Commented Sep 19, 2019 at 8:54

The official Apple website blocks IP addresses from Ghana (interestingly enough not from Nigeria though), and they openly state this is because of fraud concerns. Straight away, the fact a big company is doing this goes to show there is likely some benefit.

I suppose the logic is that your adversary could still use a proxy, VPN, Tor, or other anonymisation software. However, since those IP addresses are shared by many users they are on IP black lists.

If an IP address has been black listed it will be automatically rejected for suspected fraud during online ecommerce payments, and from experience those annoying CAPTCHAs seem to appear more often with significantly more annoying puzzles to solve. This is a significant hurdle for a malicious threat actor in a third world country, with limited resources and time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .