Docs

Web Application Firewall

Ban management

View the blocked IP list

Under the protection of the Web Application Firewall, IPs that trigger protection rules will be restricted from access. For example, access IPs from blocked regions, or access IPs that have triggered rate limiting rules, etc. The WAF displays these restricted IPs in the Ban Management module, making it easy for you to view and manage them uniformly, and quickly implement response actions.

Requirements

An existing IP has triggered protection rules and access is restricted.

Steps

Select the instance region in the top menu bar.

Select Ban Management in the left navigation.

Select the domain name for which you want to view the blocked IPs.

(Optional) Filter the list of banned IPs by attack type and time range.

tip

The custom time range supports viewing data for up to 1 day in the last 6 days.

View the banned IP list information.

Parameter	Note
Source IP of attack	IPs restricted from access due to triggering WAF protection rules. Supports sorting by IP letters or numbers in ascending or descending order. Click before the IP+You can expand details to view the number of times the IP triggered the rules in detail.
Number of interceptions	The total number of all types of protection rules triggered by this IP within the currently selected time range.
IP status	The current ban status of the IP. Unprocessed: The IP has not yet been processed, and requests from this IP will be detected through WAF rules. Permanently allowlisted: The IP has been permanently added to the access allowlist, and requests from this IP will not be detected by WAF rules. Allowlisting canceled: The IP has been removed from the access allowlist, and requests from this IP will be detected through WAF rules. Permanently banned: The IP has been permanently added to the access blocklist, and requests from this IP are automatically intercepted. Ban canceled: The IP has been removed from the access blocklist, and requests from this IP will be detected through WAF rules.
Status update time	The time of the last update on the IP ban status. Not displayed in the unprocessed state.
Operation	View logs: Click to jump to the log management page to view the attack log corresponding to the attack IP. Permanent allowlist: Click to add the IP to the access allowlist, and automatically generate a allowlist rule. You can go to Protection policy > Access control > Access allowlist to view rule details. Cancel allowlist: Click to remove the IP from the access allowlist, and the original allowlist rule will also be deleted. Permanent blocklist: Click to add the IP to the access blocklist, and automatically generate a blocklist rule. You can go to Protection policy > Access control > Access blocklist to view rule details. Cancel block: Click to remove the IP from the access blocklist, and the original blocklist rule will also be deleted.

Last updated: 2025.06.30 16:22:22