TrackingSpamPrevention - block ISP / ASN by name

Knowledge base
1

Hello,
in my bot blocking experiences I see a option in the TrackingSpamPrevention, that is better than IP or CIDR blocking.

The Matomo PlugIn “TrackingSpamPrevention” has an option to block ISP via the DP IP to ASN database in the GeoIP settings.

  1. activate GeoIP
    go to matomo Settings → System → Geolocation
  • Location provider
    • DBIP / GeoIP 2 (Php) - activate
      ↓
  • Setup automatic updates of geolocation databases
    • ISP Database
      • https://download.db-ip.com/free/dbip-asn-lite-2026-07.mmdb.gz
    • Update databases every:
      • month
  1. set ISP names for blocking
  • open on the server the file config/config.ini.php
    • go to the section
      • [TrackingSpamPrevention]
    • expand the array:
      • block_geoip_organisations

like:

block_geoip_organisations[] = "twitter"
block_geoip_organisations[] = "deutsche telekom global business solutions"
block_geoip_organisations[] = "fastly"
block_geoip_organisations[] = "logicweb"
block_geoip_organisations[] = "dataport"
block_geoip_organisations[] = "cityfibre"
block_geoip_organisations[] = "cox communications"
block_geoip_organisations[] = "vodafone germany business"
block_geoip_organisations[] = "terratransit"
block_geoip_organisations[] = "gtt communications inc"
block_geoip_organisations[] = "amazon.com"
block_geoip_organisations[] = "vultr"
block_geoip_organisations[] = "bell canada business"
block_geoip_organisations[] = "fiber optical network"
block_geoip_organisations[] = "google virtual private cloud"
block_geoip_organisations[] = "asadov ruslan rafaelevich"
block_geoip_organisations[] = "contact consumers"
block_geoip_organisations[] = "spectrum networks"
block_geoip_organisations[] = "cisco opendns"
block_geoip_organisations[] = "zayo bandwidth"
block_geoip_organisations[] = "ace data centers"
block_geoip_organisations[] = "bite lietuva"
block_geoip_organisations[] = "oculus networks"
block_geoip_organisations[] = "ovh sas"
block_geoip_organisations[] = "sprious"
block_geoip_organisations[] = "web2objects"
block_geoip_organisations[] = "zayo bandwidth"

consider: The names are compared case insensitive. The names are saved in lower case to preserve CPU load by the comparing.
Save the edit.

2

append:

block_geoip_organisations[] = "db systel"
block_geoip_organisations[] = "gsl networks"
3

append:


block_geoip_organisations[] = "ecotel communication"
block_geoip_organisations[] = "uk-2 limited"
block_geoip_organisations[] = "informacines sistemos ir technologijos"
block_geoip_organisations[] = "glesys ab"

consider:
Maxmind: UK2.NET
DP-IP: UK-2 Limited

missing in DP-IP
UK-2 Limited:
37.130.229.0/24
107.182.232.0/24

4

append:

block_geoip_organisations[] = "BWI GmbH"

consider: in MaxMind database only “BWI”, but there are more ASN included this string.

missing in DP-IP
Cisco OpenDNS:
146.112.162.0/23

Corporate (not recognizable in DP-IP lite DB)
1&1 Versatel:
61.8.150.0/24

5

Thanks for sharing this. Blocking by ISP/ASN can be much more practical than maintaining long IP or CIDR block lists, especially when dealing with traffic from cloud providers or known bot networks.

One thing I’d suggest is being a bit careful with broader entries like amazon.com, Fastly, or Google Virtual Private Cloud. They host plenty of legitimate services as well, so blocking them outright could filter out valid visitors depending on your audience.

For anyone trying this, I’d recommend monitoring the logs for a while after adding new organizations to make sure you’re not accidentally blocking legitimate traffic. Overall, it’s a useful approach for reducing unwanted bot traffic with much less maintenance than IP-based blocking.

6

Thanks for pointing these out. That’s helpful information.

7

Blocking unwanted traffic by ISP or ASN name could be useful for sites dealing with recurring spam or bot activity. It would be even better if Matomo allowed administrators to create flexible rules based on ASN, IP ranges, or other traffic characteristics without accidentally blocking legitimate visitors. A clear logging or preview option would also make these rules safer to manage.

8

Good approach. ASN/ISP blocking can be much more effective than maintaining huge IP lists, but start with clearly abusive hosting providers and monitor for false positives before blocking large networks like Google or Amazon.

9

Changelog

Attention!
The option via the config.ini.php is obsolete:

Tracking Spam Prevention

5.2.0 - 2026-08-10

  • Added an “Organisation block list” setting to the UI (General Settings, shown while “Block tracking requests from the cloud” is enabled) to manage the organisations blocked by that feature. Existing block_geoip_organisations config values are migrated to the new organisation_block_list system setting and removed from the config file; an emptied config list is migrated as an empty list, keeping organisation blocking disabled, while a removed config key results in the default block list applying again

The list is yet here:
→ Settings → System → General settings → TrackingSpamPrevention → Organisation block list

10

ASN/ISP blocking is a solid alternative to maintaining huge IP lists. Just be cautious with broad providers, since legitimate users may share those networks too. Start with obvious spam sources and monitor the results before adding more.

11

Blocking an ISP or ASN by name sounds useful, especially when the same sources keep generating tracking spam. It would be helpful if the feature could support clear matching rules so legitimate visitors from the same provider aren’t accidentally blocked.