The Umbrella Documentation Hub

Welcome to the Umbrella documentation hub. Here you'll find access to all of our Cisco Umbrella user guides.

Get Started    

Block Page IP Addresses

When Umbrella blocks a domain or URL, our DNS resolvers display a block page instead of the requested page. Umbrella provides different types of block page depending on the security event. The following table describes the block page types, record types, and Anycast IP addresses for the Umbrella servers.

Block Page Type
Record Type
IP Address

Domain List

A

146.112.61.104

Domain List

AAAA

::ffff:146.112.61.104

Command and Control Callback

A

146.112.61.105

Command and Control Callback

AAAA

::ffff:146.112.61.105

Content Category or Application

A

146.112.61.106

Content Category or Application

AAAA

::ffff:146.112.61.106

Malware

A

146.112.61.107

Malware

AAAA

::ffff:146.112.61.107

Phishing

A

146.112.61.108

Phishing

AAAA

::ffff:146.112.61.108

Security Integrations, Newly Seen Domains, DNS Tunneling VPN, Potentially Harmful, and Dynamic DNS

A

146.112.61.110

Security Integrations, Newly Seen Domains, DNS Tunneling VPN, Potentially Harmful, and Dynamic DNS

AAAA

::ffff:146.112.61.110

Note: If you have configured Block Page Bypass, the Umbrella servers could use any one of the Umbrella data center IP addresses.


Redirect to a Custom Block Page < Block Page IP Addresses > Manage Accounts

Updated 12 months ago

Block Page IP Addresses


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.