# Suspicious Traffic in Specific Countries

**Author:** DX Team

---

**Scenario**: When reviewing your site's traffic in the live monitor of your project's **Firewall** tab, you notice a traffic spike coming from Ireland, where you do not have customers and/or do not expect much traffic.

> You view the traffic by country by selecting **Allowed Requests** from the traffic grouping drop-down and **Country** for the secondary drop-down

1. Select your project from the Vercel [dashboard](/dashboard) and select the **Firewall** tab.
   
2. From the top right corner of the Firewall page, click the **Configure** button and then **\+ New Rule**.
   
3. Type "Ireland Traffic" as Name and "Understand Ireland traffic spike" as Description.
   
4. In the **Configure** section, set up the following **If** configuration:
   

- If **Country** **Equals**.
  
- Select **Ireland** in the third drop-down.
  

1. In the **Then** section, select **Log** from the dropdown. Your rule should look like this:
   
2. Select **Save Rule**.
   
3. Apply the changes:
   
   - When you make any change, you will see a **Review Changes** button appear or update on the top right with the number of changes requested
     

- Select **Review Changes** and review the changes to be applied
  
- Select **Publish** to apply the changes to your production deployment
  

1. Observe the traffic for this rule on the Firewall overview page.
   
2. Update the rule's **Then** action to Deny and select **Save Rule** and apply the changes.
   
3. Review the live monitor. The traffic from that region should now be zero.
   

## Related

- [Emergency redirect](/guides/emergency-redirect)
  
- [Limit Abuse with Rate Limiting](/guides/limit-abuse-with-rate-limiting)
  
- [WAF Examples](/docs/security/vercel-waf/examples)
  
- [WAF Custom Rules](/docs/security/vercel-waf/custom-rules)

---

[View full KB sitemap](/kb/sitemap.md)