Detected Germany as country or USA IP?

[toplisek]

We have noticed interested Firewall blocked access.
Should we trust country detection or IP. As I understand country can be masked and also country. Which value is more to trust as IP is from USA and premium domain and country is from Europe.

 

[cPRex]

Hey there! That is really up to you and how specific you want to be. While there is no perfect list of IPs for each country, blocking a specific country using the country code block will block nearly all that traffic. Using an IP address or a range of IP addresses would be more specific, but you would have to know the range you want to block.

 

[toplisek]

It is a message from Firewall and IP is from USA but country is posted as Germany.

 

[cPRex]

Are you using a firewall tool such as CSF? If so, it might be a good idea to speak with their support team directly to see if there is possibly an issue wit the way that IP address is being reported.

 

[toplisek]

If there is attack and unknown IP, how to see real IP source in this case? Is it masked IP detection?
An example: IP: 2604:a880:0:XXX (Unknown)

 

[cPRex]

There likely is not going to be a way to see that through the automated tools. You could always try using an IP lookup tool like IPv6 Address Lookup Tool | UltraTools to see if you can get more details on where it originated from.