title: How accurate is the AWS WAF Geographic match rule?
body: <p>I enabled the AWS WAF and added a <a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-geo-match.html" rel="nofollow noreferrer">geo match rule</a> to block all requests from a specific country. The rule does not use the <em>Forwarded IP header</em> but the <em>IP address in the web request origin</em>, which is also the AWS-recommended configuration.</p>
  <p>I noticed that this rule blocked a request from an IP address of range <code>94.26.208.0 - 94.26.215.255</code> which according to WHOIS belongs to <em>Yemen Telecom Networking Team</em> and is apparently situated in Yemen. WAF blocked the IP associating it with the specific country that should be blocked, which is not Yemen, not a neighboring country and not even in that region.</p>
  <p>Why was that request blocked?</p>