Block a traffic source

A blocked source is an address or a range whose traffic DDoS Shield drops before it reaches one of your floating IPs. Block a source when one sender or one network keeps sending traffic you do not want, such as a sender you see in an attack event or a client that keeps trying passwords. A block can remove itself after a time you choose.

• The floating IP must be on your account and not cancelled.
• A block applies to one floating IP, and on a subnet to all of its hosts. To block a source on several addresses, block it on each one.
• Floating IPs are IPv4, so a source is an IPv4 address or a range from /8 to /32.
• An address can hold 100 blocks. A range counts as one block, so block the range when a sender uses many addresses in it.
• Blocks work on every profile: the platform default, a profile of the address's own and a custom profile. They do not apply while that profile is in Passthrough mode (Protection modes).

1. In the dashboard, go to Floating IPs, open the address and select the Shield tab.
2. On the Blocked sources card, select Block source….
3. In Address or range, enter the sender's address, such as 198.51.100.7, or a range, such as 198.51.100.0/24.
4. Optionally, enter a Reason, such as Repeated SSH logins. The list shows it under the source.
5. Under Expires, keep Never, or choose when we remove the block: After 1 hour, After 1 day, After 7 days or After 30 days.
6. Select Block source.

A message confirms 198.51.100.7/32 blocked., and the block appears at the top of the list. Traffic from the source stops reaching the address within a minute.

On the Profiles tab of DDoS Shield, the card of a custom profile has a Blocked sources section with the blocks on every address bound to it. Select Block source… there, and choose the address under On when more than one is bound. The block applies to that one address only, and the table shows it in an On column.

Each block in the list shows:

• Source: the address or range, with its reason under it.
• On: the address the block is on. Only a custom profile's card with more than one bound address shows this column.
• Added: when the block was made, with Added by our team under it for a block that our team made.
• Expires: when we remove the block and how long is left, or Never.

When the address has no block, the card shows No blocked sources yet. Blocks that have expired leave the list.

When the address holds 100 blocks, the card shows No room for another block and Block source… is greyed out. Unblock a source first, or replace several blocks with one range.

1. On the Blocked sources card, select Unblock… on the block's row.
2. In the dialog, select Unblock source.

A message confirms 198.51.100.7/32 unblocked. Traffic from the source reaches the address again within a minute.

A block that our team made shows Ask support to remove in place of Unblock…, and only our team can remove it. The link opens a new support conversation. Name the address and the source in it.

• We apply a block as a Drop rule for all traffic from the source to the whole address. Traffic it drops shows on the Events tab as firewall_deny (Attack types).
• The block names both the source and the address, so it outranks most of your own rules. An Allow rule can still outrank it when it names more, such as the same source, this address as its Destination prefix and a port (How rules are applied).
• A block stays with the address when you detach it, customise its profile, or bind it to a custom profile and unbind it again.

The block is on the Blocked sources list, and traffic from the source no longer reaches the address. We store a single address as its /32, and a range by its first address, so 198.51.100.7/24 becomes 198.51.100.0/24. When a block expires, we remove it, and the source's traffic reaches the address again.

Enter an address or a range, such as 203.0.113.7 or 203.0.113.0/24.

The dialog cannot read what you entered as an address. Enter an address such as 198.51.100.7, or a range with its length, such as 198.51.100.0/24.

Could not block the source with That range is too wide. Block a /8 or a narrower range.

A wider range would cut the address off from a large part of the internet. Block narrower ranges, or set When no rule matches to Drop and allow only the senders you want (When no rule matches).

Could not block the source with This address is IPv4, so block an IPv4 source.

You entered an IPv6 address or range. A floating IP receives IPv4 traffic only, so an IPv6 sender cannot reach it.

Could not block the source with 198.51.100.7/32 is already blocked on this address.

The list already holds that source, so its traffic is dropped already.

Could not block the source with This address already has 100 blocked sources. Remove one before adding another.

Unblock a source you no longer need, or replace several blocks with one range.

Could not block the source with Too many Shield changes in the last ten minutes. Wait a few minutes, then try again.

Your account made 60 changes to DDoS Shield profiles, rules and blocks in the last ten minutes. Wait, then try again.

Traffic from a blocked source still reaches the address

The address's profile is in Passthrough mode, or an Allow rule outranks the block, as How a block is applied explains. The sender may also use other addresses: block their range.

Could not load the blocked sources

Select Try again. If it keeps failing, contact support.

• Change a floating IP's DDoS protection
• Read attack events
• Get help during an attack
• Order and use a custom profile

The requests take the floating IP's service ID in the path: the ip_service_id that GET /api/v1/client/shield/status returns (With the API).

GET /api/v1/client/shield/subjects/{ip_service_id}/blocked-sources lists the blocks on the address, newest first:

curl https://api.coritan.com/api/v1/client/shield/subjects/214/blocked-sources \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "blocked_sources": [
    {
      "id": 881,
      "address": "198.51.100.0",
      "prefix_len": 24,
      "cidr": "198.51.100.0/24",
      "reason": "Repeated SSH logins",
      "source": "manual",
      "removable": true,
      "expires_at": "2026-09-27T09:12:40",
      "created_at": "2026-09-26T09:12:40"
    }
  ],
  "max_blocks": 100
}

max_blocks is the most blocks the address can hold. Blocks that have expired are left out.

POST /api/v1/client/shield/subjects/{ip_service_id}/blocked-sources blocks a source, and answers 201 with the new block in the shape above:

curl -X POST https://api.coritan.com/api/v1/client/shield/subjects/214/blocked-sources \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"address": "198.51.100.0/24", "reason": "Repeated SSH logins", "expires_minutes": 1440}'

DELETE /api/v1/client/shield/subjects/{ip_service_id}/blocked-sources/{block_id} removes a block and answers {"status": "deleted"}:

curl -X DELETE https://api.coritan.com/api/v1/client/shield/subjects/214/blocked-sources/881 \
  -H "Authorization: Bearer $CORITAN_TOKEN"

Each POST and DELETE counts towards a budget of 60 DDoS Shield changes per account in ten minutes, which changes to profiles and rules share. The answers you can act on:

The DDoS Shield API reference lists every field.