For years, restricting access to internet-facing services based on geographic location has been a relatively straightforward way for New Zealand and Australian organisations to reduce their exposure to unwanted internet traffic.
However, that assumption is becoming increasingly difficult to rely on.
We are seeing more unusual and potentially malicious activity originating from New Zealand and Australian IP addresses, making it harder to distinguish legitimate local users from scanners, automated services and threat actors operating through residential and commercial internet connections.
Australian IP addresses increasingly appearing in suspicious activity
One example is the numerous internet scanning services such as modat.io, which have been observed aggressively scanning and cataloguing geographically restricted services from Australian IP addresses.
We are also seeing a change in the source of malicious login attempts. Previously, suspicious activity often originated from IP addresses associated with less reputable hosting providers and infrastructure such as Host Universal and M247.
Increasingly, however, Australian-based malicious login attempts are now more likely to appear from IP ranges associated with legitimate, mainstream internet service providers, including:
- aussiebroadband.com.au
- exetel.com.au
- iinet.net.au
- leaptel.com.au
- optus.net.au
- spacex.com
- spintel.net.au
- superloop.com
- telstra.net
- tpg.com.au
This makes traditional IP reputation and geographic filtering considerably less reliable.
New Zealand isn’t faring much better
While we generally observe fewer malicious login attempts originating from New Zealand IP addresses when examining services intended for standard New Zealand users, the traffic patterns are still unusual.
Rather than seeing the expected concentration of connections from providers such as 2degrees, Spark and One NZ, we are seeing Cloudflare WARP and Akamai IP addresses frequently occupy many of the top positions in our traffic observations.
It is not immediately clear what all of this activity represents, but it is certainly not the traffic patterns we would expect or particularly welcome.
Unusual browsing patterns from local IP addresses
Website owners may also recognise another interesting pattern.
Even after filtering out the roughly 90% of website traffic that can consist of non-human activity, including scanners, spiders, scrapers and AI-driven crawlers, we occasionally observe unusual bursts of New Zealand-based traffic.
For example, multiple requests for the exact same page arriving at precisely the same second, from different local ISP IP addresses and reporting different browsers:
- Chrome browser from a One NZ IP address.
- Edge browser from a Spark mobile IP address.
- Firefox browser from a One NZ IP address.
- Chrome browser from a 2degrees IP address.
- Another Chrome browser from a different 2degrees IP address.
These patterns are usually preceded by a HEAD python request to the exact same page from an overseas IP which is usually tagged as an aggressive crawler.
Individually, these connections might appear relatively ordinary. Collectively, however, the timing and consistency of the requests raise questions about whether the activity is genuinely human-driven.
Geofencing is still worthwhile, but don’t rely on it alone
None of this means organisations should abandon geographic restrictions.
If your organisation only provides services to customers in New Zealand and Australia, restricting access from other parts of the world can still significantly reduce (think 90%+ reduction) your attack surface and unwanted internet traffic.
However, geofencing should be treated as one layer of defence, not a security boundary.
Our recommendations:
- Keep geofencing enabled: Restrict access to countries where your services have no legitimate business requirement.
- Monitor local traffic: Don’t automatically trust connections simply because they originate from a New Zealand or Australian IP address.
- Use behavioural detection: Look for unusual request patterns, repeated login attempts, automation and suspicious browsing behaviour.
- Implement MFA: Especially for administrative interfaces, remote access and externally accessible authentication services.
- Apply rate limiting: Reduce the effectiveness of automated scanning, credential stuffing and brute-force attempts.
- Review IP reputation: Consider ASN, hosting provider, proxy and VPN intelligence alongside geographic information.
The basic takeaway is simple: geofencing your services can reduce your exposure, but it does not eliminate the risk.
The days of assuming that traffic originating from a New Zealand or Australian IP address is inherently trustworthy are well and truly behind us.
