Imunify360 is the ultimate defense for web servers. While its automated firewall is excellent, manual intervention is sometimes necessary to stop botnets or targeted attacks. In this guide, you will learn how to manage blocks precisely using commands and the visual interface.
Before blocking any range, make sure to:
Understand the scope: An error in the CIDR mask (such as a /8) could leave millions of legitimate users without access.
This is the fastest way for system administrators. You must access via SSH as the root user.
Ideal for stopping a specific attacker identified in your logs.
- imunify360-agent blacklist ip add 1.2.3.4 --comment "Brute force attack"
Blocked IPs: 1
If attacks come from different IPs but the same network, use these common prefixes:
Example command for a /24 range:
- imunify360-agent blacklist ip add 192.168.1.0/24 --comment "Identified botnet range"
If you blocked someone by mistake or the attack has ceased:
- imunify360-agent blacklist ip delete 1.2.3.4
If you prefer not to use the console, Imunify360 offers an intuitive interface within WHM:
Log in to WHM and search for Imunify360.
Go to the Firewall tab.
Click on the Blacklist sub-tab.
Press the Add IP/Network button.
Enter the IP or range, add a comment (this is vital for future audits!) and click Add.
Mandatory Comments: Always use the --comment parameter. Months later, you won't remember why you blocked that IP, and the comment will save you time.
Country Detection: If malicious traffic is massive from a specific country where you have no customers, it is better to use the Country Blocking feature in Imunify360 instead of adding hundreds of manual ranges.
Whitelists: If you use external services (such as monitoring tools or payment APIs), make sure to add them to the Whitelist so Imunify360 does not block them for suspicious activity.