search close

Observed IPs

access_time Updated Jun 10, 2021

The Observed IPs page provides an overview of all IPs that have been—or soon will be—flagged on your site. The Observed IPs page is divided into separate tabs for Suspicious IPs, Flagged IPs, and Rate Limited IPs.

The Observed IPs page can be viewed by going to Monitor > Observed IPs in the console:

The Observed IPs page can also be viewed by clicking on the combined count of all Observed IPs on the site overview page:

Suspicious IPs

The Suspicious IPs tab shows IP addresses from which requests containing attack payloads have originated, but the volume of attack traffic from these IPs has not exceeded the decision threshold. Once the threshold is met or exceeded, an IP address will be flagged and added to the Flagged IPs list. The Suspicious IPs tab enables you to anticipate which IPs may soon be flagged.

The Suspicious IPs tab lists:

  • The IP
  • Country of origin
  • The signal for which the IP is approaching a threshold
  • The threshold being approached
  • How long ago the IP was added to the Suspicious IPs list
  • If the IP was flagged by another Signal Sciences customer

Clicking on an IP in the Suspicious IPs list will take you to a Requests page search for that IP.


Flagged IPs

The Flagged IPs tab shows all IP flagging events. IP addresses can be flagged through regular threshold-based blocking, templated rules, and site alerts.

The Flagged IPs tab lists:

  • The IP
  • Country of origin
  • The signal the IP was flagged on
  • How long ago the IP was flagged
  • If the IP is still currently flagged

Clicking on an IP in the Flagged IPs list will take you to a Requests page search for that IP.


Rate Limited IPs

Note: Rate Limit rules are only included with the Advanced plan. They are not included as part of our Standard plan.

The Rate Limited IPs tab shows all IP addresses that have been rate limited.

The Rate Limited IPs tab lists:

  • The IP address
  • When the IP will stop being rate limited

This page also provides controls for managing IP addresses that have been rate limited, including:

  • Removing all IP addresses from the Rate Limited IPs list
  • Removing specific IP addresses from the rate limited IPs list
  • Creating request rules to allow specific IP addresses
  • Creating request rules to block specific IP addresses