but the traffic is _clearly coming from Germany_, the issue is that cloudflare/google have tagged certain ip addresses as Iranian no matter where the traffic actually originates from

> but the traffic is _clearly coming from Germany_

How do you know that if the only thing you see on the receiving side is an IP address, which is marked as Iranian?

Marked where? With the assigning authority of the IP address which has been granted the legal right to manage the IP space (a common good)? Or in the database of some arbitrary company?

BGP full view and traceroutes? It's pretty hard to fake the path that a packet takes to that IP address.