01
Individual evidence
A hostile IP address is treated as evidence rather than automatically becoming the final defensive decision. Activity, behaviour and supporting intelligence add context.
DEFENCE
Intelligence that
acts.
Pynblok turns hostile activity and accumulated intelligence into network-level protection.
Decisions are processed through a persistent attack queue, evaluated against the available evidence, and synchronised with the systems that enforce the defence.
DEFENCE PIPELINE
Attack detected
OBSERVE
Evidence enriched
UNDERSTAND
Threat assessed
DECIDE
Network promoted
ESCALATE
Block synchronised
DEFEND
01 / FROM INTELLIGENCE TO ACTION
Blocking is the last step, not the first.
A useful defence system needs to do more than maintain a growing list of IP addresses.
Pynblok processes attacks through a persistent queue. Each event can be enriched, classified, scored and evaluated alongside the other evidence associated with an attacker and its infrastructure.
This allows defensive decisions to be based on intelligence rather than simply on the fact that an address has been seen before.
02 / ATTACK PROCESSING
Every attack enters
a process.
The attack queue provides a persistent processing path from the initial observation through enrichment, classification, scoring, intelligence and defensive action.
03 / DEFENSIVE DECISION
From individual events
to network decisions.
02
Network intelligence
When the evidence supports it, individual addresses can be associated with a wider network or prefix. This allows Pynblok to recognise infrastructure rather than repeatedly dealing with isolated addresses.
03
Escalation
Multiple individual blocks can therefore be subsumed by a broader network decision. The defensive list becomes more meaningful as intelligence accumulates.
04 / NETWORK DEFENCE
Defend at the
network edge.
Pynblok can synchronise its defensive intelligence with Cloudflare, turning assessed threats into blocks before unwanted traffic reaches the protected application.
05 / NETWORK ESCALATION
A block can become
a network decision.
The difference between blocking an address and understanding its infrastructure matters.
An individual hostile address can be represented as a /32. Where the evidence identifies a broader hostile network, Pynblok can promote that evidence to a CIDR prefix such as a /24.
The original individual records remain visible as escalated evidence, while the broader network becomes the active defensive decision.
This allows the blocklist to represent what Pynblok has learned about the attacker, rather than simply becoming an ever-growing collection of addresses.
06 / DEFENCE LAYERS
Protection where
it matters.
EDGE
Cloudflare
Defensive IP and network intelligence can be synchronised to Cloudflare so hostile traffic can be stopped at the network edge.
UPSTREAM
Firewall
Network-level blocks can also be applied upstream, preventing hostile traffic from reaching the protected server in the first place.
LOCAL
Server defence
Defensive intelligence can also be reflected into local firewall or IP-table controls, providing another layer of protection.
THE DEFENSIVE PRINCIPLE
Don't just block the attacker. Understand the infrastructure behind the attack.