diff --git a/rc-auth/src/main/java/com/red/circle/auth/common/LoginAccessValidationService.java b/rc-auth/src/main/java/com/red/circle/auth/common/LoginAccessValidationService.java
index 77f1d624..13e1a2b7 100644
--- a/rc-auth/src/main/java/com/red/circle/auth/common/LoginAccessValidationService.java
+++ b/rc-auth/src/main/java/com/red/circle/auth/common/LoginAccessValidationService.java
@@ -273,7 +273,12 @@ public class LoginAccessValidationService {
     }
     String country = dataObject.getString("country");
     String region = dataObject.getString("region");
-    return BLOCKED_COUNTRY_NAMES.contains(country) || BLOCKED_COUNTRY_NAMES.contains(region);
+    return isBlockedCountryName(country) || isBlockedCountryName(region);
+  }
+
+  private static boolean isBlockedCountryName(String value) {
+    // 第三方 IP 定位可能缺少 country/region；先过滤空值，避免 List.of().contains(null) 抛异常。
+    return StringUtils.isNotBlank(value) && BLOCKED_COUNTRY_NAMES.contains(value.trim());
   }
 
   private static JSONObject normalizeIpNcGy(String provider, JSONObject jsonObject) {