L3/4 Banned IPs
Last update：2026-08-20 15:00:22
Reading time: About 3 minutes
In a Layer 7 DDoS Protection policy, when the action is set to Deny Connection, built-in rules automatically protect the scrubbing node infrastructure during extremely large-scale L7 DDoS attacks. The platform automatically bans IPs that repeatedly launch attacks and records each ban in the L3/4 Banned IPs log.
Use this page to check whether a legitimate user’s connection timeout errors were caused by this policy.
Note: Because the Deny Connection action takes effect at the network layer, its protection granularity is scrubbing node IP + attacker IP, rather than hostname. An L3/4 Banned IPs log for an Exclusive IP is generated only if you have purchased the Exclusive IP value-added service. This page is not enabled by default; if you have purchased an Exclusive IP, contact technical support to have it enabled.
Path: Analysis & Logs > L3/4 Banned IPs
Query Logs Using Filters
| Query Condition | Description |
|---|---|
| Time Range | Required. You can query logs from the most recent month; the time range for a single query cannot exceed 24 hours |
| Client IP | Optional. Separate multiple IPs with a semicolon (;) |
| Node IP | Optional. Separate multiple IPs with a semicolon (;). This refers to the edge node IP of the full-site security platform that received the client request |
View Log Details
The table below lists the fields currently supported by L3/4 Banned IPs logs:
| Field | Description |
|---|---|
| Time | The time the ban was triggered |
| Client IP | The banned attacker’s client IP |
| Node IP | The scrubbing node IP that received the client request |
| Policy Name | The name of the DDoS Protection policy that triggered the ban |
| Rule Name | The name of the specific built-in rule that triggered the ban |
| Final Security Action | Deny Connection |
| Exception Details | Expand to view a detailed description of why the IP was banned |
| Request Information | Expand to view the details of the request that triggered the ban |
Use Case
If a legitimate user reports connection timeouts, you can investigate as follows:
- In L3/4 Banned IPs, query using that user’s client IP
- If a matching record is found, the IP was banned because it triggered the Deny Connection rule
- If you confirm the ban was a false positive, contact technical support to have the IP manually unbanned, and evaluate whether the DDoS protection policy needs adjustment