2.4.1.2.6. Suspicious IPs

When a request has not been explicitly allowed or denied by bot protection and country access restrictions, an additional check is performed for suspicious IPs using JavaScript or captcha. IP suspicion is determined by internal hosting algorithms based on various rules, formulas, and coefficients (details are not disclosed). The analysis system is constantly changing and improving. If necessary, the check can be disabled.

In the chain of all protection stages, suspicious IP checking comes after restricted access mode, IP blacklist, Firewall, bot protection and country access restrictions before I'm Under Attack.

Checking is configured individually for each site in the "Site protection" section on the "Main settings" tab using the "Suspicious IPs" parameter:

Checking can be in one of two modes:

• Check additionally using JS/Captcha — suspicious IP checking is enabled:
  • If the IP is suspicious:
    • To access the site in a browser, JavaScript must be enabled, or the visitor will need to complete our numeric captcha.
    • If successful, the request will be sent to the site; if unsuccessful, an error 429 will occur.
  • If the IP is not suspicious, the request will be passed further down the chain without additional checking.
• Do not restrict — suspicious IP checking is disabled, the request will be passed further down the chain without additional checking.