Managing lists of IP addresses

If a Protected resource is under attack and its traffic was redirected through a Scrubbing Center, the System analyzes all IP addresses used to contact the Protected resource. Subsequent handling of requests is determined based on whether these IP addresses have been added to a specific list.

• List of allowed IP addresses – a manually updated list of IP addresses whose requests are forwarded to the Protected resource without System verification.
• List of denied IP addresses – a manually updated list of IP addresses whose requests are always blocked.
• List of temporary IP addresses – an automatically updated list of IP addresses for which the Fines system has worked.
• List of blocked IP addresses – an automatically updated list of IP addresses whose requests are always blocked.

The System enters IP addresses into the blocklist if the actions of users communicating from these IP addresses do not satisfy specific statistical or behavioral criteria of normal users.

The Customer's administrator has the capability to check if an IP address is on a specific list (see the example in the "Searching for an IP address in lists" section). Allowlists and denylists can also be fully viewed through the interface. A list of blocked IP addresses is usually too large to view. For this reason, it is possible to find specific IP addresses on this list only using a search.

An IP address that is entered into a list of allowed or denied IP addresses by the Customer's administrator will remain on that list until it is manually deleted. An IP address entered into a blocklist remains on that list for a limited amount of time (10 minutes by default). It is then removed from the list, and requests from the specific IP address are analyzed again. If there is a more urgent need to unblock an IP address belonging to a legitimate user, the Customer's administrator should move the IP address to the allowlist (see the "Moving an IP address to another list" section). If the reason for blocking a user is known, the Customer's administrator can decide on whether to keep blocking the user depending on the significance of the particular user.