Thanks for the detailed explanation and IP samples — that really helps narrow things down.
This seems like a classic case of incorrect GeoIP resolution by Cloudflare’s WAF, which can occasionally happen due to:
Outdated or incorrect IP-to-country mappings in Cloudflare’s GeoIP database.
VPN or ISP routing quirks, especially in Southeast Asia, where IP blocks may be reallocated or shared between neighboring countries.
Dual-stack (IPv4 + IPv6) detection mismatches, where one protocol is correctly detected and the other isn’t.
Suggestions:
Check both IPv4 and IPv6 detection in the WAF logs — sometimes the GeoIP detection differs per protocol.
Open a Cloudflare support ticket and include:
Full IPs (as you did)
WAF Event ID or Ray ID
The actual country you are accessing from
Screenshot of WAF log showing incorrect GeoIP
As a workaround, consider logging or allowing requests via IPv6 or adjusting the rule to only apply to IPv4 temporarily to test consistency.
For long-term fix: Use Cloudflare Workers to implement custom logic that cross-verifies IP geolocation using a third-party API (like ipinfo.io or ip-api.com), if precision is critical for your application.
Use Cloudflare Workers to implement custom logic that cross-verifies IP geolocation using a third-party API (like ipinfo.io or ip-api.com), if precision is critical for your application.
Guess what We will now be providing Cloudflare with their geolocation data. I will be here to address any issues we may have and push out fixes immediately. Cheers!
Suggestions:
We will now be providing Cloudflare with their geolocation data. I will be here to address any issues we may have and push out fixes immediately. Cheers!