Overview of the Block Page IP Addresses used by Cisco Umbrella
When a page is blocked by the Cisco Umbrella service, our DNS resolvers display a block page instead of the page with the blocked content. These block pages are served from Cisco Umbrella servers. The anycast IP address and associated block type for these servers are outlined in the table below.
Recent infrastructure updates have required changes to the IP addresses that are provided as a response to blocked requests. We do not expect these IPs to change again in the near future, but if they did change, that update would be included in this article.
|Domain List Block Page||a||188.8.131.52|
|Domain List Block Page||aaaa||::ffff:184.108.40.206|
|Command and Control Callback Block Page||a||220.127.116.11|
|Command and Control Callback Block Page||aaaa||::ffff:18.104.22.168|
|Content Category Block Page||a||22.214.171.124|
|Content Category Block Page||aaaa||::ffff:126.96.36.199|
|Malware Block Page||a||188.8.131.52|
|Malware Block Page||aaaa||::ffff:184.108.40.206|
|Phishing Block Page||a||220.127.116.11|
|Phishing Block Page||aaaa||::ffff:18.104.22.168|
|Suspicious Response Block Page||a||22.214.171.124|
|Suspicious Response Block Page||aaaa||::ffff:126.96.36.199|
|Security Integrations Block Page||a||188.8.131.52|
|Security Integrations Block Page||aaaa||
We will keep this page updated with any additional changes.