How to Block Datacenter IPs on Shopify

Almost no genuine shopper browses your store from a server rack. Yet a large share of automated abuse — card testing, inventory scraping, fake account creation, checkout bots — originates from datacenter IPs: addresses owned by hosting providers, cloud platforms, and VPS resellers. Blocking this category is one of the highest-leverage, lowest-risk moves you can make on Shopify.

What a datacenter IP actually is

Every IP address belongs to an Autonomous System (AS), identified by an ASN. Residential ISPs like Comcast or Vodafone run their own ASNs and hand addresses to home users. Hosting companies — AWS, Google Cloud, DigitalOcean, OVH, Hetzner, Contabo, and thousands of smaller resellers — run separate ASNs whose entire purpose is to serve machines, not people.

When traffic arrives from an ASN classified as hosting or cloud, you can be confident there is a script, not a shopper, on the other end. The exceptions are rare: corporate VPNs that egress through cloud, or a developer testing from a server. Both are edge cases you can allowlist.

Why fraudsters love them

• Cheap and disposable. A $5/mo VPS or a free-tier cloud instance gives an attacker a clean IP in minutes. Burned addresses are trivially rotated.
• Bandwidth and uptime. Card-testing scripts fire hundreds of $1 authorizations per minute; datacenter links handle that easily.
• Automation-friendly. Headless browsers, scrapers, and credential-stuffing tools run on servers by default.
• Geographic masking. An attacker in one country can egress through a datacenter in yours to look local.

Signals. Datacenter traffic tends to show tight, machine-like patterns: sub-second intervals between requests, no image or font loading, missing or generic Referer headers, identical User-Agent strings across many IPs, and requests that jump straight to /cart or checkout without browsing.

Detection: ASN over blocklists

Maintaining a raw IP blocklist is a losing game — attackers rotate faster than you can add entries. ASN-based detection is the durable approach: instead of blocking 203.0.113.44, you classify the network that owns it. If the ASN is a known hosting provider, the whole range is suspect regardless of which specific address is used today.

Best control. Match incoming IPs against a maintained hosting/cloud ASN dataset, then decide per category:

• Hosting/VPS/cloud ASNs — block or challenge by default.
• VPN/proxy egress ranges — block for high-risk actions (checkout), allow for browsing.
• Residential/mobile ASNs — allow, and score on behavior instead.

The key is that ASN data is updated continuously by reputation providers, so new hosting ranges are covered without you touching a list.

Blocking on Shopify without collateral damage

Shopify does not expose raw request-level IP filtering in the admin, and editing themes only affects the storefront, not checkout. The reliable path is a Shopify Functions-based control that evaluates the request at the network and checkout layer.

Shieldy Fraud Filter classifies visitors by ASN in real time and lets you block datacenter, VPN, proxy, and Tor traffic while leaving residential and mobile shoppers untouched. Because it runs on Shopify Functions, the datacenter/checkout rules apply at checkout too — not just on marketing pages a bot can skip.

A safe rollout looks like this:

1. Start in monitor mode. Log which sessions match hosting ASNs before you block anything. Over a few days you will see the volume and confirm it is not real customers.
2. Block the clearest category first. Pure hosting/VPS ASNs almost never carry legitimate shoppers. Turn these to hard block.
3. Challenge the gray zone. For VPN/proxy ranges, prefer a challenge or a checkout-only block rather than a blanket deny, since privacy-conscious real customers sometimes use VPNs.
4. Allowlist your own tools. Uptime monitors, your headless CI, and any legitimate integration run from datacenters — add their IPs or ASNs to an allowlist so you don't break your own stack.

Avoiding false positives

The failure mode to watch for is blocking a real buyer who happens to sit behind a corporate or carrier-grade network that egresses through cloud infrastructure. Mitigate it:

• Separate hosting from VPN. Treat pure hosting ASNs as high-confidence blocks and VPN/proxy as lower-confidence (challenge instead of block).
• Scope by action. Blocking a datacenter IP from browsing your blog is overkill; blocking it from completing a $400 checkout is prudent. Apply the strictest rules to cart and checkout.
• Watch the block log. If a blocked session later shows human-like behavior (long dwell time, real navigation), review that ASN and consider moving it to challenge.
• Give a clean fallback. Where possible, present a challenge page rather than a dead end, so a rare legitimate user on a flagged network can still get through.

What good looks like

After enabling datacenter blocking, most stores see card-testing authorizations collapse, scraper hits drop, and fake-account spikes disappear — with checkout conversion for real customers unchanged. The reason it works so cleanly is the base rate: legitimate shoppers essentially never come from server IPs, so the category is safe to filter aggressively.

Datacenter blocking is the foundation layer. Once it's in place, you can add residential-proxy detection and behavioral scoring on top for the traffic that slips through on real ISP addresses.

Want to see how much of your traffic is coming from hosting IPs right now? Turn on monitor mode in Shieldy Fraud Filter — the free plan lets you watch before you block. Compare plans on the pricing page when you're ready to scale controls.