We have noticed interested Firewall blocked access.
Should we trust country detection or IP. As I understand country can be masked and also country. Which value is more to trust as IP is from USA and premium domain and country is from Europe.
Hey there! That is really up to you and how specific you want to be. While there is no perfect list of IPs for each country, blocking a specific country using the country code block will block nearly all that traffic. Using an IP address or a range of IP addresses would be more specific, but you would have to know the range you want to block.
There likely is not going to be a way to see that through the automated tools. You could always try using an IP lookup tool like IPv6 Address Lookup Tool | UltraTools to see if you can get more details on where it originated from.