CDN.com.tr Help

Home Management Help Center Cache, security, WAF, and purge Block traffic by ASN and by country

Block traffic by ASN and by country

Two account-wide blacklists on the same panel: block whole countries by country code, or block whole networks by autonomous system number. A blocked visitor gets the branded 403 page with a Reference ID.

Cache, security, WAF, and purge

Block traffic by ASN and by country

Where the evidence and the softer tools are

A blacklist is the last step of a triage that starts in the logs, and it is not always the right answer.

Evidence

Security events and WAF logs

Where the AS number, country and Reference ID of each blocked request come from.

Open the topic

Softer tool

Bot protection

The JS challenge filters automated traffic without denying a whole network.

Open the topic

Background

Blocking traffic by ASN and country

What an autonomous system number is, how to find the right one, and when a block beats a challenge.

Read the guide

Panel path

Management Panel
CDN Accounts
Delivery Rules
Security defaults
Country Blacklist Manager / ASN Blacklist Manager

Prerequisites

You need the AS numbers or the ISO country codes you intend to block; the panel does not look them up for you.
Check Security events first. Blocking a network you have not seen in the logs is guesswork.
You need a role that can save delivery rules: owner or editor.

Decision model

Country or ASN?

They answer different questions: where the visitor is, versus whose network they are on.

Country blacklist: the right tool when a market is genuinely out of scope — a Turkey-only service, a licence limited by territory.
ASN blacklist: the right tool against datacenter, hosting and proxy networks, which is where most scraping and automated abuse comes from.
Neither: if the traffic is abusive but arrives from ordinary consumer ISPs, a rate limit or the JS challenge fits better than a blanket block.

How wide is the blast radius?

Both lists are blunt by design. Sizing the block is the part worth thinking about.

A consumer ISP AS number carries real customers. Blocking one is almost always a mistake.
A hosting provider AS number carries bots, but also monitoring services, feed readers and payment callbacks. Check what you depend on before blocking it.
A country block hits your own travelling users and anyone behind a VPN exit in that country.

Step-by-step guide

Identify the network in Security events

Start from what actually hit the site, not from a reputation list.

Open Security events for the account and set the time range to the period the abuse happened in.
Read the AS number and country of the requests you care about.
Note whether the same AS number is behind a monitoring service or a payment callback you rely on.

Expected result: You have a short list of AS numbers or country codes with evidence behind each one.

cdnctl equivalent

cdnctl waf logs --account <account_uuid> --range 1d
cdnctl waf logs --account <account_uuid> --range 7d --format json

Enter the list and submit

Country Blacklist Manager and ASN Blacklist Manager sit next to each other in Security defaults.

Open Delivery Rules and scroll to Security defaults.
Type the values into the right box, comma separated — country codes in Country Blacklist Manager, numbers such as 12735, 47331 in ASN Blacklist Manager.
Click Submit. The account is redeployed automatically; this list does not need a separate Apply Changes.

Expected result: The list is saved, a deploy is queued, and the edge starts denying requests from those networks.

cdnctl equivalent

GET  /api/accounts/<account_uuid>/asn_blacklist
POST /api/accounts/<account_uuid>/asn_blacklist_update
{"listType":"blacklist","asns":[12735,47331]}

Verify the denial and the way back

A blacklist you cannot verify is a blacklist you will be afraid to touch later.

Request the site from a host on the blocked network — a shell on that provider is the easiest way.
Confirm the branded 403 page with its Reference ID, and confirm an unrelated network still gets 200.
Write down how to undo it: clear the box and submit again.

Expected result: Requests from the listed networks get the branded 403; everything else is unaffected.

cdnctl equivalent

curl -sI https://www.example.com/   (from a host on the blocked AS)
curl -sI https://www.example.com/   (from anywhere else)

Verification

A request from the listed AS or country returns the branded 403 page with a Reference ID.
A request from any other network still returns 200.
The saved list contains exactly the entries you intended — the submit replaced the previous list.
Nothing you depend on, such as monitoring or payment callbacks, runs on a blocked network.

Use cases

Scrapers, credential-stuffing bots, or a flood of junk requests arrive from datacenter and proxy networks rather than from consumer ISPs. Blocking the country would punish real customers; blocking the AS number takes out the network the abuse actually rides on.

Quick workflow

Find the source in Security events: the table shows the AS number and country behind each blocked or challenged request.
Decide which list fits: country code for a geography, AS number for a network.
Open Delivery Rules, enter the values in Country Blacklist Manager or ASN Blacklist Manager as a comma-separated list, and submit.
Verify from a host on that network: the request must return the branded 403 page with a Reference ID, while an unrelated network still gets 200.

Checks

Each list is account-wide. It applies to every hostname on the account, not to a single path or rule.
Submitting a list replaces it. Send the full list you want in force, not only the new entry.
AS 0 cannot be blocked. It is what the edge records when a client IP maps to no known network, and blocking it would deny unclassified traffic wholesale.
Up to 200 AS numbers per list. A blacklist longer than that is usually a sign that a rate limit or a challenge is the better tool.
A blocked visitor sees the branded 403 page with a Reference ID. Ask the customer for that ID: it is what ties their report to a specific denial.