Matching the country code¶
Note
GeoIP blocking via fingerprinting is still possible, but is no longer recommended. Instead, select Country or Continent directly ias condition to block specific countries or continents.
Note
The country code comes from a GeoIP database and is not always 100% accurate.
A WAF rule with the Fingerprint condition allows you to match requests based on the country of origin (GeoIP blocking). The country code is evaluated via the iso: prefix. This allows you to specifically block or allow traffic from specific countries.
Condition for a single country code
For example, proceed as follows to match a single country:
- ► Select Request as the request method.
- ► Add the Fingerprint condition.
- ► Select the EXACT operator from the drop-down list.
- ► Enter
iso:DEas the value.
Condition for multiple country codes via REGEX
For example, proceed as follows to match multiple countries:
- ► Select Request as the request method.
- ► Add the Fingerprint condition.
- ► Select the REGEX operator from the drop-down list.
- ► Enter
iso:(DE|AT)as the value.

