All DDoS Definitions
DDoS Testing Definition

Geo-Blocking

Geo-blocking is a defensive control, one of the protections a thorough DDoS test is built to exercise. It drops or challenges traffic based on the source country or region inferred from the client IP, shrinking the attack surface when an application serves only certain geographies. Enforcement usually sits at the CDN edge or WAF, keyed off a GeoIP database that maps address ranges to locations.

Geo-blocking: what it stops and what it misses Flood from an excluded region: dropped Source in blocked region GeoIP check not allowed dropped at the edge Proxied through an allowed region: passes Attacker via allowed-region proxy / VPN GeoIP check allowed country reaches the origin Stale GeoIP data also misclassifies legitimate users, blocking real customers mid-incident. A test confirms whether floods sourced from or proxied through allowed regions still reach the origin. BlackNeuron™
Geo-blocking drops a flood from an excluded region at the edge, but the same attacker proxied through an allowed region is classed as an allowed country and reaches the origin

Why it matters in DDoS testing

Geo-blocking is a blunt instrument that attackers route around. A test confirms whether a flood sourced from allowed regions (or proxied through them) still reaches the origin, how stale GeoIP data misclassifies legitimate users, and whether the rule degrades gracefully rather than blocking an entire region of customers during an incident. The control reduces noise; it rarely stops a determined distributed attack on its own.

For how geo controls fit a broader defensive posture, see DDoS resilience testing.