I used to do this with a local copy of the IP2Location database [1]. This way you don't have to poll a third party. The caveat is you have to keep the database up to date.

https://www.ip2location.com/ [1]

It depends on what you’re doing and who the legit users are.

The downside of static lists is that AWS, Azure, etc frequently purchase IP spaces and realign them with US datacenters. Probably not an issue for blocking Russia or China, but if you want US only traffic, or North American traffic, you can run into problems.

You cannot know where a server is physically located, as even self-reported locations are incorrect (by accident and/or on purpose) and there is no such thing as non-3rd party data about physical location as servers as again, it's self-reported and any registry can say whatever they want in regards to where a server is located.

There are many different 3rd party sources for geo locating IP addresses, maybe MaxMinds is the most popular one. But if you acquire a few, you'll notice that sometimes even they don't agree where the location of a server is.

I'm reminded of this story[0] from a few years ago where a family in Kansas was raided by every US ABC agency because MaxMinds was using their lat/long as the default when there was no exact position.

https://www.theguardian.com/technology/2016/aug/09/maxmind-m...

Cloudflare lets you block countries, ASNs and IP blocks.

See my recommendation in the top level thread.