IP address is a threat

Matches when the requester’s IP address is a known malicious source.

This condition inspects the client IP address of an incoming request to determine if it is a known malicious source. It returns true if the address matches an entry in the threat database.

Configuration

  • Bot IP shield: This condition requires the Bot IP Shield add-on to be active for the application.
  • Setup: No further configurations are necessary for this condition. The underlying threat data is automatically updated via Webroot’s BrightCloud® IP Reputation Service every five minutes to reflect the latest global attack sources.

Measurement

The condition resolves the IP address from the incoming request and evaluates it against the threat reputation database.

  • Database lookup: The reputation service is queried to determine if the IP address is categorized as a known threat.
  • Error handling: If the reputation service returns an error or cannot be reached, the condition returns false.
  • Logging: The threat status of the IP address is recorded in the application logs for visibility.

The condition returns true if the IP address is successfully identified as a known threat.


Last modified March 5, 2026