Blocked IP Addresses

The blocked IP addresses page is the single source of truth for which IPs the platform is currently rejecting at the edge — whether by automatic banning, manual admin action, or imported deny-lists.

What's Shown

• IP address — IPv4 or IPv6, with optional CIDR notation for ranges (e.g. 203.0.113.0/24).
• Reason — automatic (login attempts, suspicious activity), admin-flagged, or imported.
• Blocked at — timestamp when the block began.
• Expires — when the block lifts automatically (blank = permanent).
• Hit count — how many times this IP has been turned away since the block began.

Filtering and Search

Filter by reason (auto-banned vs admin-blocked), by date range, or search for a specific IP. Useful when investigating: “did we block this customer's office?”.

Worked Examples

• Customer can't sign in: Their office has just been auto-banned because someone there tried the wrong password 50 times. Search for the IP, view the hit count, decide whether to unblock or extend.
• Suspicious traffic: Sort by hit count descending. The top 10 IPs are probably bots or scanners. Confirm their geolocation against your expected user base.
• Audit: Filter blocks created in the last 24 hours to see what the auto-ban engine has caught overnight.

Note: Blocking a corporate NAT IP affects every user behind that IP. If a single bad actor inside a large office triggers a block, everyone there is locked out until the block expires or you unblock manually.

Sometimes you want to block an IP yourself, before the auto-ban engine gets there. This is useful for responding to scraping, abuse, harassment, or threats spotted in the activity log.

Step-by-Step

1. Open Architect Panel → Blocked IP Addresses and click Block an IP.
2. Enter the IP. Single addresses or CIDR ranges (e.g. 198.51.100.0/24 blocks the whole /24) are accepted.
3. Add a reason note. This is invaluable later when reviewing or auditing.
4. Pick a duration: 1 hour, 24 hours, 1 week, 30 days, or permanent.
5. Optionally add tags for grouping (e.g. #scraping, #harassment).
6. Save.

Effects

Once blocked, any request from the IP receives a 403 response before reaching the application. Login, API and even static asset requests are all rejected. The block applies platform-wide regardless of which tenant the request was for.

Worked Examples

• Aggressive scraper: Logs show 10,000 requests/hour from a single IP. Block /32 permanently with reason “high-volume scraping, no UA”.
• Country-wide block: Repeated abuse from a hosting provider. Block their entire /16 for 30 days with tag #hosting-provider-x.
• Compromised office IP: A user's home IP is reportedly compromised. Block temporarily for 24h while they investigate.

Warning: Be careful with CIDR ranges — a typo of /8 instead of /24 blocks 16 million addresses including potentially your own office. The form warns when ranges exceed /16.

To remove an IP block, you unblock it. Unblock can be a one-off (delete the row) or batched (remove all blocks matching a filter).

One-Off Unblock

1. Open Architect Panel → Blocked IP Addresses.
2. Find the IP (search or filter).
3. Click Unblock on the row.
4. Confirm in the dialog. The block is lifted immediately and a note is added to the audit log with your name as the actor.

Batch Unblock

To clear out a range of blocks (e.g. all auto-bans older than 48 hours):

1. Filter the list by reason or date.
2. Select multiple rows.
3. Click Bulk action → Unblock all selected.

Examples of When to Unblock

• Customer call: They report being locked out. After verifying their identity, unblock their office IP.
• False positive cleanup: Tighten thresholds and unblock IPs caught by the old, looser policy.
• Pen-test cleanup: After a security test, unblock the test team's source IPs.
• Routine purge: Monthly job to clear expired blocks that haven't been hit in 30+ days.

Tip: Don't auto-purge blocks too aggressively — keeping a record of past blocks helps spot returning bad actors. Mark blocks as “expired” rather than deleting them outright when feasible.