Anti-spam teardown · Gate
Geo-blocking
If you only sell in one country, refusing everywhere else is the fastest volume reduction available. It is also the defense that most reliably rejects the traveller, the VPN user, and the distributed team — and never tells you it did.
Corey Haines · San Diego · Aug 2026
One of 12 anti-spam teardowns. Bypass techniques change; this page states its date so you can judge how stale it is.
The short answer
Done at the CDN it is a legitimate blunt instrument that cuts commodity spam volume hard. Done in a script on the form it is unreliable. Either way it stops an origin rather than an operator, and a residential proxy in your own market costs cents.
What it stops
- Scripted botsMass submitters that never render your page.
- Yes
- Targeted automationHeadless browsers, solver services, residential proxies — aimed at you.
- No
- Paid humansPeople doing it by hand, cheaply.
- Partly
- Real people, bad leadsGenuine humans who were never going to buy.
- No
- Cost to the real buyerWhat it asks of the person you actually wanted.
- Low
How it works
Map the request IP to a country or an ASN and refuse the ones you do not serve. In practice this happens in one of three places: your DNS or CDN provider, a WAF rule, or a script on the page that hides or disables the form. It is the bluntest instrument here short of removing the form entirely.
Those three are not equivalent and the difference matters more than the policy does. The first two refuse before your application sees the request. The third asks the client to please not submit.
What it actually stops
A large share of indiscriminate spam volume, quickly, if your buyers are concentrated in one market. The practitioner in our corpus who tried everything else landed on it as the only thing that moved the number:
“Aside from using Cloudflare name servers to geo-block, there’s no real successful way to stop spam bots from just constantly submitting spam entries. Most of my clients deal with this. Captcha feels worthless. Honeypot traps don’t always work. Geoblocking scripts on just the form are buggy.”
Read that as two findings, because it contains both. Geo-blocking at the name servers: the best of a bad set. Geo-blocking in a script on the form: buggy.
How it’s defeated
By moving. A residential proxy in your target country costs a few cents an hour and is indistinguishable from a customer’s home broadband, because it is a customer’s home broadband. Geo-blocking relocates the attacker; it does not remove them, and anyone running a campaign against you specifically will relocate within a day.
The buggy part is worth spelling out, because it is a class of bug rather than one implementation. A form-level geo script fails open when the geo lookup is slow, when the page is served from cache, when the script is blocked, or when the visitor has JavaScript disabled — all of which describe an attacker more often than a customer. And it fails closed on stale geo data, which describes your customer more often than an attacker.
Then the false positives, which are the reason this method deserves more suspicion than it gets. Blocked: the buyer travelling, the buyer on a corporate VPN that egresses through Frankfurt, the buyer whose ISP is misattributed, the agency evaluating you from a client’s office abroad, the acquisition target doing diligence. Every one of them sees a form that will not submit, not one of them writes to tell you, and the loss never appears in your cost per lead.
When it’s still worth using
When your servable market is genuinely national — a trades business, a licensed practice, anything with a physical service area — and you are under active volume pressure. Then it is a reasonable trade honestly made.
- Do it at the CDN or WAF, never in a script on the form.
- Block the smallest set that solves the problem. Country-level bans are crude; ASN and datacentre-range bans get most of the benefit with far fewer false positives.
- Log every block. A monthly count of what you refused, by country, is the only way the decision stays reviewable.
- Give blocked visitors a route through — an email address or a phone number on the error — so the traveller is inconvenienced rather than lost.
- Put a review date on it. Geo-blocks outlive the attack that caused them by years.
What to pair it with
No single method on this site is sufficient. These are the ones that fail differently enough to be worth running alongside it.
- IP reputation and rate limiting
- Same layer, same dashboard, and rate limits catch what relocates into your allowed region.
- Cloudflare Turnstile
- Handles the traffic you have decided you must accept, which after a geo-block is all of it.