A single blocked Hetzner IP address took 325 unrelated domains offline in Italy. One of them belonged to a Portuguese hosting provider, which lost email connectivity with its Italian customers for 16 days. Neither had anything to do with the pirated football stream the block was aimed at (Sommese, Sperotto, van der Ham, Affinito and Prado, 90th Minute: A First Look to Collateral Damages and Efficacy of the Italian Piracy Shield, University of Twente, peer-reviewed, CNSM 2025). On average, domains caught in that collateral damage stayed unreachable for around 320 days. CDN IP blocking is not a censorship story — it is a reachability risk sitting inside every anycast CDN contract, and almost nobody prices it.
The mechanic: anycast means sharing reachability with strangers
A hyperscale CDN serves thousands of customers from the same anycast IP ranges. That is the design — it is what makes anycast fast and what makes DDoS absorption possible. It also means the routable address your customers resolve to is shared with tenants you did not choose and cannot audit.
When a regulator blocks by IP rather than by domain, everything on that address goes with it. Your site does not need to be the target. It only needs to be a neighbour.
The clearest public example of the mechanic is a Cloudflare Community thread from July 2026: a site owner found their domain unreachable from Russia because it resolved to a shared Cloudflare IP that had been added to the state blocklist over a completely unrelated site sharing the same address. The browser simply spun — no error, no notification, connection silently dropped.
You cannot fix this by being compliant. Your legal standing is irrelevant to a /24 null route.
The Twente study put names to who actually gets hit. Of 7,114 domains affected during the study window, researchers manually confirmed 510 as legitimate sites with no connection to streaming — hotels, restaurants, retail shops, an accountant, a car mechanic, a nunnery, and a telehealth missionary program among them. In three separate cases, blocking one IP address caused 60 collateral blocks each. Mail server IPs were blocked in 782 cases and nameserver disruption in 397 — meaning the damage extends past the website to email and DNS.
And there is a second-order effect that should concern anyone leasing IPv4 space. Of the 10,918 blocked addresses, 24% were linked to leased address space, and 453 addresses were leased for the first time after they had already been blocked. The new tenant inherits an address that is silently unreachable from Italy, with no notification and no obvious cause. A further 250 addresses were re-leased to different companies while still under block. If you lease IPv4 space for a CDN origin or a mail server, check the block status of the range in your target markets before you announce it — the study's authors describe the polluted address space they leave behind as one of the system's lasting harms.
Four jurisdictions, one pattern
This is not a Russia story. It is a structural consequence of IP-level enforcement, and it is happening across regulatory contexts with very different intentions.
Sources: TorrentFreak (2025); RIPE Labs and APNIC Blog (2025) on the Piracy Shield study; TechRadar (2025); The Record (2024, 2025); DNS at Risk.
Note what Italy, Spain and Austria have in common: these are EU member states pursuing copyright enforcement, not censorship. The intent does not change the blast radius. Any business with customers in those markets carries the same exposure as one serving a heavily censored market — which is why this belongs in an infrastructure risk register rather than a politics conversation.
The Austrian outcome is the most useful signal in the table: a regulator that tried IP-level blocking on shared infrastructure and then banned it, because the collateral damage was indefensible. That is the direction of travel, but it arrives jurisdiction by jurisdiction, years apart.
Blocking happens at four layers, and each has a different fix
Teams conflate these, then apply the wrong countermeasure and conclude nothing works.
The ECH case deserves its own note because it is the single most common misdiagnosis in this space. Cloudflare enables Encrypted Client Hello by default; Russian networks have blocked TLS connections using the ECH extension since 2024. The result is a site that becomes unreachable in waves, which owners routinely misread as "Cloudflare is fully banned." It usually isn't. With ECH turned off, connections fall back to plain SNI and typically stop being dropped — a zone-level configuration change, not a migration.
Check ECH before you plan a CDN migration. It is free, reversible, and resolves a meaningful share of cases that look like IP blocking but aren't.
Why you find out last
There is no notification. No appeal path that operates on infrastructure timescales. In Italy, the blocklist behind Piracy Shield is not published — AGCOM has repeatedly refused freedom-of-information requests for it, leaving only single-IP lookup tools with no bulk export. Cloudflare told Human Rights Watch in May 2025 that it is generally unable to identify or confirm government-directed blocking and had received no notice from any Russian entity about the reported disruptions.
Read that carefully: the regulator will not tell you, and your CDN cannot tell you. Your first signal is a traffic drop from one country, and if that country is not a top-three market you may not notice for weeks.
Monitoring from inside the affected market is the only reliable detection. Synthetic checks from your own CI or from a US/EU monitoring region will pass while real users in the blocked market see nothing. If you have meaningful revenue from a market with an active blocking regime, you need a probe that actually resolves and connects from inside it.
What no CDN vendor will tell you
A large CDN cannot publish this article. Cloudflare cannot write "our IP ranges are subject to state-level blocking in several markets, so consider a provider with a smaller footprint." Akamai cannot either. The structural incentive runs the other way: their answer to concentration risk will always be more of their own product. That is not dishonesty, it is positioning — but it means the SERP for this problem is written entirely by parties who cannot recommend the fix.
The fixes that exist are gated behind Enterprise. Cloudflare's BYOIP, where Cloudflare announces IP space you lease or own across its locations, is Enterprise-only. The traditional onboarding path ran up to four to six weeks, involving addressing teams, network engineering, legal, and a Letter of Agency — Cloudflare has since launched a self-serve BYOIP API that removes much of that manual process. Either way, BYOIP is a posture you adopt in advance, not a lever you pull during an outage.
Not every "dedicated IP" product solves this problem, and the distinction matters. Cloudflare's Dedicated CDN Egress IPs sound like the answer and are not: they govern traffic from Cloudflare to your origin, for origin allowlisting and firewall lockdown, not the address your users resolve to. Buying them changes nothing about whether a regulator can reach you. The controls that affect the user-facing address are BYOIP, leased static IPs with address maps, and the certificate option below.
And leased static IPs solve only half the problem. They are still Cloudflare addresses. If a neighbour on your shared IP gets you blocked, a static address fixes it. If a regulator blocks Cloudflare's ranges wholesale — as happened across eastern Russia in March 2025 — a static Cloudflare IP goes down with everything else. Only address space that is yours, or a provider whose ranges are not listed, survives range-level blocking. Match the control to which of the two failure modes you actually face.
There is one cheap partial mitigation almost nobody uses. Business and Enterprise customers can reduce the number of Cloudflare IPs their domain shares with other customer domains by uploading a Custom SSL certificate. That does not give you a dedicated address, but it shrinks the neighbourhood — fewer strangers on your IP means lower probability of inheriting someone else's block. For a Business-plan site with exposure to an active blocking regime, it is the highest ratio of risk reduction to effort available.
And the honest limit on all of this: if a block is a lawful order directed at your own content in a market where you operate, the answer is legal and compliance work, not a different IP range. Infrastructure diversity solves collateral damage — being caught by someone else's enforcement. It does not solve being the target, and any provider who pitches it that way is selling you a problem rather than a solution.
What breaks in production
You migrate CDN and inherit a new set of neighbours. Moving from one hyperscale anycast provider to another swaps one shared-IP exposure for a different one. If the new provider's ranges are already listed in your target market, you have executed a migration for nothing. Check the destination's IP ranges against the market's blocklist status before cutover, not after.
Your monitoring says everything is fine. Covered above, and it is the most common failure. Region-blind synthetic monitoring is how a two-week outage in a secondary market becomes a quarterly revenue surprise.
Lowering TTLs after you need them is too late. If your records sit at 86,400 and a market goes dark, your fastest possible failover is a day away. Pre-lowered TTLs on anything exposed to a blocking regime are cheap insurance — the same discipline covered in our [CDN migration playbook → /blog/cdn-shutdown-migration-playbook].
Regional CDNs solve reachability and introduce other constraints. A provider with local presence in a market is far less likely to be blocked there, and often has better last-mile performance. It will also usually have a smaller global footprint, different feature coverage, and its own compliance obligations in that jurisdiction. That is a real trade, not a free win.
"Not blocked yet" is a depreciating asset. Selecting a provider purely because regulators have not reached it is a position with a shelf life. The durable property is not obscurity — it is how fast you can move when it changes, which is a procurement and architecture question rather than a provider-selection one.
The mitigation ladder
Work down this list; each step costs more than the one above it.
- Check ECH first. If the symptom is intermittent unreachability in a specific market, disable ECH on the zone and re-test before doing anything else. Free, reversible, resolves a large share of misdiagnosed cases.
- Deploy in-market monitoring. You cannot manage exposure you cannot see. One probe resolving and connecting from inside each market that matters.
- Upload a Custom SSL certificate if you are on a plan that supports it, to reduce the number of domains sharing your IPs.
- Pre-lower TTLs on any hostname serving a market with an active blocking regime.
- Keep a second CDN configured and warm, carrying real traffic at a small percentage rather than sitting idle with stale config and expired certificates.
- Evaluate a regional provider for markets where reachability is a revenue-critical requirement, accepting the feature and footprint trade honestly.
- Consider BYOIP or leased static IPs if you have Enterprise scale and the market exposure justifies it — static IPs for neighbour risk, BYOIP for range-level risk. Start the process before you need it.
The decision framework
Three questions decide how much of this ladder applies to you.
- Do you have revenue from a market with an active IP-blocking regime? If no, steps 1 and 2 are still worth doing and the rest is over-engineering. If yes, you need at least through step 5.
- Is the exposure collateral or direct? Collateral — someone else's content on your shared IP — is an infrastructure problem with infrastructure fixes. Direct — a lawful order about your content — is a legal problem, and no CDN change resolves it.
- How fast can you currently switch providers? Not "do you have a second CDN," but: certificates provisioned, config parity verified, TTLs low, contract already in place. If the honest answer is measured in weeks, that is the gap to close, regardless of which provider you use today.
INXY brokers CDN capacity across multiple providers — including regional and specialist networks that do not appear on hyperscaler comparison pages — on a single contract and a single invoice. The practical consequence is that adding or switching a provider is a configuration decision rather than a procurement cycle, which is precisely the capability this risk requires. We will also tell you when your problem is ECH rather than IP blocking and costs nothing to fix, because a migration you did not need is not a sale worth making.
If you have a market where traffic dropped and you are not sure why, send us the affected hostnames and the market. [Request an infrastructure audit → /book-a-demo]. To review delivery options: [CDN, streaming and data delivery → /data-delivery].
This article describes publicly reported regulatory and network conditions for general information. It is not legal advice — obligations differ by jurisdiction and by the nature of the content being served, and decisions with regulatory consequence should be reviewed by qualified counsel in the relevant market.
FAQ
Why is my site blocked in a country when I have done nothing wrong? Hyperscale CDNs serve many customers from shared anycast IP ranges. When a regulator blocks by IP address rather than by domain, every site on that address becomes unreachable regardless of its content. Documented cases include a single blocked IP disrupting 325 unrelated domains in Italy.
Is Cloudflare blocked in Russia? Not fully. Sites behind Cloudflare load from Russia but unreliably, due to ECH connection blocking, shared-IP collateral damage, and targeted blocks of individual resources. Roskomnadzor has officially recommended against foreign CDNs, which is a recommendation rather than a prohibition, but a clear regulatory signal.
What is ECH and why does it break my site? Encrypted Client Hello is a TLS extension that encrypts the server name during the handshake. Cloudflare enables it by default, and some national networks block TLS connections using it. This produces intermittent unreachability that looks like IP blocking. Disabling ECH on the zone usually restores connections.
How do I know if my CDN's IP ranges are blocked somewhere? Monitor from inside the affected market. Synthetic checks running from US or EU regions will pass while real users in the blocked market see nothing. Neither the regulator nor your CDN will notify you — in Italy the blocklist itself is not published, and Cloudflare has stated it generally cannot confirm government-directed blocking.
Does switching CDN providers fix IP blocking? Only if the destination's IP ranges are not already listed in that market. Moving between two hyperscale anycast providers swaps one shared-IP exposure for another. Regional providers with local presence are less likely to be blocked in their own market, at the cost of smaller global footprint and different feature coverage.
Can I get dedicated IP addresses from a CDN? Some providers offer it at Enterprise tier. Cloudflare's BYOIP announces IP space you lease or own across its network, and leased static IPs with address maps fix which addresses your domain resolves to. Note that Dedicated CDN Egress IPs are a different product governing Cloudflare-to-origin traffic, not the user-facing address.
