Instead of blocking a whole country I personally would like to see just blocking several IPs based on an already filled blacklist form AbuseIPDB.
They even have an ip which you could use to generate a server.malicious_ips nginx file on every server.

Thanks!