Help Center/ Content Delivery Network/ Best Practices/ Preventing Traffic Theft/ Preventing Traffic Theft by Blocking IP Addresses
Updated on 2026-05-20 GMT+08:00
View PDF
Share

Preventing Traffic Theft by Blocking IP Addresses

If traffic theft comes from one or more known IP addresses, you can block these IP addresses to prevent traffic theft.

Identifying Malicious IP Addresses

Use logging and reporting provided by CDN to analyze and identify IP addresses that are generating suspicious or excessive traffic in the following ways:

  1. Analyze offline logs in the attack period, check HTTP request information, identify abnormal IP addresses and anti-leeching information, and set protection rules accordingly. For details, see Analyzing Malicious Access Addresses Through Logs.
  2. Download and analyze custom operations reports such as popular URL, referer, UA, and client IP address reports. These reports are available if you have customized them for the domain name before an attack. For details, see Operations Reports.

    Set operations reports beforehand. If attacks cause a high bill before you configure them, you have to rely on offline logs for past data analysis.

Blocking IP Addresses

After identifying malicious IP addresses, you can configure the following rules to block access from these IP addresses based on your service requirements:

  1. Set an IP blacklist and add the IP addresses to it to filter them out.
    1. Log in to the CDN console.
    2. In the navigation pane, choose Domains.
    3. Click the Access Control tab.
    4. In the IP ACL area, enable the function. The Edit IP ACL dialog box is displayed.

    Type: Select IP address blacklist.

    Rule: Enter the identified IP address or IP address segment.

    Figure 1 Editing an IP ACL
  2. Configure the rules engine to block access from the IP addresses.
    1. Log in to the CDN console.
    2. In the navigation pane, choose Domains.
    3. Click the Rules Engine tab and click Create Rule.

      Condition: Select Client IP address.

      Name: Select Connecting IP.

      Operator: Select Include any value.

      Value: Enter the identified IP address or IP address segment.

      Actions: Select Access Control, with Type set to Reject.
      Figure 2 Rules engine
  3. Configure IP access frequency control. You can limit the IP access frequency to restrict the number of queries per second (QPS) that a single IP address can send to a specific URL at a single PoP. This helps you defend against CC attacks and malicious theft, reducing the risk of high bills.
  4. Enable edge security protection. You can use the IP address-based rate limiting feature provided by EdgeSec to control the access frequency of specific IP addresses, preventing malicious traffic theft.
Parent topic: Preventing Traffic Theft