What to Do If Your Hosting Provider or CMS Blocks KillBot IP Addresses

If you receive a message saying that KillBot server IP addresses have been blocked, it means that your website is not accessible from KillBot servers, even though the website itself may open normally when accessed directly without KillBot.

In most cases, the block happens:

  • at the CMS level;
  • at the hosting or server security level.

After connecting KillBot, all incoming website traffic goes through KillBot servers

For example:

  • if your website is connected to one KillBot server, all requests will come from a single IP address;
  • if multiple KillBot servers are used, requests will come from several IP addresses.

Some security systems may treat a large number of requests coming from the same IP address as suspicious activity and automatically block that IP.

Possible reasons for the block

1. Blocking at the CMS level

One of the most common reasons is a built-in CMS security mechanism. For example, a proactive security module may automatically block an IP address after several failed login attempts. Since all requests go through the KillBot server, its IP address gets blocked.

When a website operates behind a reverse proxy, the CMS needs to receive the visitor's real IP address instead of the KillBot server IP. KillBot passes the visitor's real IP address in the HTTP_X_REAL_IP header.

To make your CMS see the visitor's real IP address instead of the KillBot server IP, you can add the following code before the website starts (directly in index.php). This code replaces the KillBot server IP with the visitor's real IP on the website side, allowing built-in security systems to work normally:

if (isset($_SERVER["HTTP_X_REAL_IP"])) {
     $_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_X_REAL_IP"];
}

 

Check your security modules

We recommend checking whether your CMS uses security modules such as:

  • Security;
  • Defender;
  • Web Application Firewall (WAF);
  • or similar security tools.

If you use any of these modules:

  • add the KillBot server IP addresses to the whitelist;
  • or temporarily disable the module and check whether the problem disappears.

If the CMS is not blocking the IP addresses

If you have confirmed that your CMS is working correctly and is not blocking KillBot servers, the block is most likely happening at the server or hosting level.

It may be caused by:

  • ModSecurity;
  • Fail2Ban;
  • Anti-DDoS systems;
  • CloudLinux Security;
  • other security tools installed by your hosting provider.

For example, an Anti-DDoS system may detect a large number of requests coming from a KillBot server IP as an attack and automatically block that IP address.

How to find out what blocked the KillBot IP address

The most reliable way is to check your web server logs.

Check the error logs:

  • Nginx: /var/log/nginx/error.log ;
  • Apache: /var/log/apache2/error.log;
  • ModSecurity: (/var/log/modsec_audit.log or /var/log/httpd/modsec_audit.log or /var/log/apache2/modsec_audit.log);
  • Fail2Ban: /var/log/fail2ban.log;
  • and any other logs generated by your hosting security system.

If your website is hosted on shared hosting or a website builder

Send the following message to technical support and ask them to whitelist the IP addresses:

Hello!

My website is proxied through KillBot.ru, a behavioral bot protection service, so all requests to my website come from one of the service's IP addresses: https://killbot.ru/api/ips/killbot.json 

Please add these IP addresses to the whitelist so that traffic from them is not blocked.

 

Connect a CDN to prevent the IP addresses from being blocked again

To prevent KillBot IP addresses from being blocked again, we recommend connecting a CDN. In this case, traffic will reach your website through the CDN network. This can both improve website loading speed and prevent the protection server IP addresses from being blocked.

 

How to whitelist our servers in Fail2Ban

Open the Fail2Ban configuration file: /etc/fail2ban/jail.conf 

Find this section:

# MISCELLANEOUS OPTIONS
#

# "ignorself" specifies whether the local resp. own IP addresses should be ignored
# (default is true). Fail2ban will not ban a host which matches such addresses.
#ignorself = true

# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator.
#ignoreip = 127.0.0.1/8 ::1

ignoreip = 109.236.57.58 31.192.108.184 82.148.21.137 166.88.185.206 78.17.139.5

Add the IP addresses of our servers to "ignoreip =", separated by spaces.

 

Then restart Fail2Ban:

sudo systemctl restart fail2ban

 

To view the Fail2Ban logs and check blocked IP addresses: 

sudo tail -f /var/log/fail2ban.log

 

How to increase timeouts in Nginx: 

Open the Nginx configuration file: /etc/nginx/nginx.conf

Find the proxy settings section and increase the timeouts: 

    # Proxy settings

    proxy_connect_timeout   60s;
    proxy_send_timeout  180s;
    proxy_read_timeout  1200s;


    #proxy_connect_timeout   30s;
    #proxy_send_timeout  90s;
    #proxy_read_timeout  600s;

 

You should increase these values if you see errors like this in your logs: 

 Line 57276: 2026/08/13 05:59:28 [error] 1111#1111: *24943676 upstream timed out (110: Connection timed out) while connecting to upstream, client: 109.236.57.58

 

How to whitelist KillBot servers in ModSecurity: 

For Apache (Plesk, Debian/Ubuntu), open:

/etc/apache2/modsecurity.d/000ipwhitelist.conf

Disable ModSecurity for these IP addresses:


SecRule REMOTE_ADDR "@ipMatch 109.236.57.58,31.192.108.184,82.148.21.137,166.88.185.206,78.17.139.5" "phase:1,id:200000001,nolog,allow"

id:200000001: This is the unique ID of the rule. Make sure to replace it with your own unique ID so that it does not conflict with any existing rules.

apache2ctl -t

or

httpd -t

 

If this protection is enabled, disable it or add the KillBot servers to the whitelist: 109.236.57.58,31.192.108.184,82.148.21.137,166.88.185.206,78.17.139.5