How to work with Geo-blocking

Syspeace supports a form of country blocking using “Country rules”. Here’s how it works.

1. You can define which countries should be blocked on activity using “Country rules”. By default, no countries are blocked.
2. When a login attempt is detected by Syspeace, the IP address is mapped to a country with an IP-to-country database. (We use GeoLite2 from MaxMind, Inc.)
3. Once login attempts are detected from one of these country, the IP address is blocked as usual by Syspeace. Just as if they had “earned” a block by triggering one of the other rules.

Please note the following:

• Syspeace does not preemptively block all traffic from every IP address that is mapped to belong to a blocked country.
• Syspeace does not block countries based on all network traffic, only based on login attempts that it detects. If you set up a Country rule to block Sweden on activity and have a web site with Swedish visitors, they will not trigger the block. However, if someone from an IP address that the database will determine is from Sweden triggers a login attempt, this IP address will be immediately blocked.

Country blocking is a less surgical tool than Syspeace’s regular login attempt analysis, but is a helpful complement to it. For best results, block countries that a) dominate the recorded blocks the server receives and b) do not legitimately use the server.