Blocked addresses

What a blocked address sees

A block is on an address, never on an account or an API key, so the same key works from another network. A request can be stopped in two places, and each looks different.

A key that is paused for calling long after its limit is a different thing. It answers 403 KEY_ON_HOLD from any address, and the errors page lists every reason.

How to ask for a block to be lifted

Write to support@gunspec.io. Email works from any network, while a blocked address may not be able to load this site or a web form, so write from a different connection if you have to. Put these in the message and nobody has to ask you for them.

1. 1

   The blocked address

   On the blocked connection, a what-is-my-IP page shows it. If you write from another network, say which network the blocked traffic came from.

2. 2

   When it happened

   The time, with its time zone, of the first request that was refused.

3. 3

   What the app was doing

   Which program or integration sent the requests, and what it was meant to do.

4. 4

   What you saw

   The Ray ID from Cloudflare’s page, or the request id header from the API’s answer.

5. 5

   Whether the address is shared

   An office, a school or a phone network is one address for many people, and the block may be for traffic that was not yours.

6. 6

   Stop what was blocked, then wait for our reply

   Pause the calls that were refused if you can. We reply by email, to the address you wrote from.

What happens after you write to us

A person looks at it. A block also ends by itself when its length is up, but nothing is lifted early without someone looking.

• We read the reason the block was added, who or what added it, and what the address has sent in the past week.
• If it was a mistake, or the cause is fixed, we lift the block and tell you. The address is then left alone for 24 hours, so the same traffic cannot block it again at once.
• If the address sends the same input again after a lift, it is blocked again and for longer each time: 24 hours, 7 days, and 30 days. An address is remembered for 90 days.

Who can block an address

Three things add a block, and only three.

• A person on our staff, by hand, with the reason written down.
• The automatic detector, when one address sends the requests it counts as hostile. It is described below.
• Addresses taken over from a Cloudflare rule that already existed when we connected the firewall.

Nothing else adds a block. No AI agent does, and no call a customer can make does. The agents that research the catalogue only file proposals for a person to review, and none of them can touch a block.

What counts as a hostile request

The detector counts requests to the API whose query string carries input that only an attack sends. It does not matter which parameter holds it, or that the endpoint ignores the parameter and answers 200. It is the same screen the search boxes use.

• Markup or template characters, such as angle brackets and double braces.
• Encoded escapes, such as percent codes and HTML entities, where plain text belongs.
• A web address or a file path where a search term belongs.
• Hostnames that scanners use to call back and confirm a hit.
• SQL that only an attack writes.
• Control characters and invisible characters.

A request refused because of the program that sent it, its user agent, counts for much less. A developer who forgot a User-Agent header meets it while debugging.

These are the figures it works to.

What does not get an address blocked

None of these counts towards a block.

• A wrong, missing or expired API key.
• A 404 for a record that does not exist, or a 400 for a parameter that is not valid.
• A 429 for going over a limit. Slow down and it clears; limits never block an address.
• Heavy but ordinary traffic. The rate limits and the daily allowance deal with volume.
• Ordinary punctuation, such as quotes, semicolons, equals signs and ampersands. A search for Smith & Wesson is fine.
• Any real firearm, maker or cartridge name. The screen was checked against every name in the catalogue and none of them trips it.

Who is never blocked automatically

The detector leaves these addresses alone.

• Private and reserved network ranges, and Cloudflare’s own addresses.
• An address that a key on a paid plan has used successfully in the last 3 days. An office, a campus or a phone network is one address for many people, and a customer should not lose access because of someone else on it.
• An address whose block we lifted in the last 24 hours.

Our staff can still block any address by hand.

Why a real app gets blocked, and how to avoid it

Almost every block on a real integration has the same cause. The app takes what its own visitors type, or what arrives in its own request, and forwards it to the API unchanged. One visitor, or one scanner probing your site, sends text that only an attack writes, your server passes it on, and the API sees it come from your server’s address.

• Check search text before you forward it. Drop or reject input that is markup, a web address or a file path, and pass on only what a person would type.
• Never forward your own request’s query string as it arrived. Pick the parameters you use and send only those.
• Cache answers so identical input is not sent again and again. Caching covers how.
• Send a stable, descriptive User-Agent that names your app.
• Call from one outbound address where you can, and tell us which one when you write, so we can tell your traffic from anyone else’s.
• Keep the key on your server behind an allow list of paths. Keys in production shows the proxy.

When the Cloudflare rule is full

The rule in Cloudflare’s firewall holds about 290 addresses. When it is full, the oldest automatic blocks are left off it and those addresses stay blocked by the API itself. The block holds either way. The only difference to the person it affects is what they see: the API’s JSON 403 in place of Cloudflare’s page. It is lifted the same way, by writing to us.