How does Cloudflare WAF identify a user's country for blocking purposes?

Cloudflare identifies a user's country primarily through their IP address using geo-IP databases. When a request comes to Cloudflare, Cloudflare looks up the source IP address in its extensive and frequently updated geo-IP database. This database maps IP ranges to specific countries (and often cities/regions, though WAF country blocking uses the country level). The accuracy of this method is generally very high but not 100%, as IP addresses can sometimes be misclassified, or users might be using VPNs or proxies that intentionally obscure their true geographic location, making them appear to originate from a different country.