The IP banning engine watches every sign-in attempt, password reset request and API call. When it sees a pattern that looks abusive — too many failures from a single source in a short time — it adds the source IP to a temporary block list.
The Three Knobs
IP banning is controlled by three settings working together:
- Attempts — how many failures from one IP trigger a ban (e.g. 10).
- Monitoring period — the time window over which attempts are counted (e.g. 5 minutes).
- Ban duration — how long the IP stays blocked once triggered (e.g. 1 hour).
So with the example numbers: 10 failures from the same IP in any 5-minute window = banned for 1 hour. After expiry the counter resets.
What Counts as a Failure
- Wrong password on sign-in.
- Wrong 2FA code.
- Invalid password reset token.
- API request with invalid credentials.
- Submissions to anti-bot honeypots.
Examples
- Brute force: A scanner tries 1,000 password combinations. After 10 failures it's banned for 1 hour. By the time the ban lifts the attacker has moved on.
- Office NAT: 20 people behind one IP — if one mistypes a password 5 times, the others still have 5 attempts before the IP is banned. Tune monitoring period higher (e.g. 60 mins) for shared NATs.
- Mobile carriers: Many users share a small pool of carrier IPs. Set thresholds higher and consider geo-aware exceptions.
Note: IP banning is one layer in defence-in-depth. Use it together with account banning (per user), 2FA and breach-list password checks. Each layer catches a different category of attack.