Rules

Refuse an address, a range, a machine, a country, a network or VPNs before the key is even looked at.

Rules decide who may not sign in to an app at all, before the key or the account is even looked at. They are yours to set, per app, and they work for keys, customer accounts, sign-ups and trials alike. The program gets BLOCKED with the words you set in Applications → Blocked.

What a rule can block

Rule	Value	Use it when
Address	one IP, 203.0.113.9	Somebody keeps guessing keys, or a leaked key is used from one place.
Range	203.0.113.0/24, 2001:db8::/32	The same, for a whole block of addresses.
Machine	the hardware ID the app sends	One PC must not sign in again, whatever key it tries. Easiest from Sessions: Block this machine on its row.
Country	a two-letter code, RU	You do not sell there, or most abuse comes from there.
Network	an AS number, AS12345	One provider or data centre: every address it owns, however often they change.
VPNs and proxies	a switch	Customers must sign in from where they really are (shared or resold keys often hide behind a VPN).
Hosting addresses	a switch	Your program is for people, not for servers and bot farms.

Country, network, VPN and hosting are read from the address's provider record (the same one Sessions shows as a flag). A home connection in the wrong country is refused; a customer on a VPN is refused until they turn it off. Addresses on a private network (your own test PC) have no country or provider, so those rules never touch them.

Allowed addresses only

For a program used from known places only, an office, a shop, your own servers: list the addresses or ranges that may sign in. With at least one entry there, every other address is refused. The blocks above still apply to the allowed ones. Remove the last entry and any address may sign in again.

Before you add the first allowed address, make sure your own address is in it, or your own tests are refused too. The page shows your address right now, and never lets you block it.

What happens

The sign-in is refused with BLOCKED and your message. The key is not touched: it is not used up, not bound, not counted.
The refusal is logged like any other, so it shows in Dashboard → Activity as Sign-in refused · Blocked by rule, and the rule counts how often it fired.
When you add a rule with Sign out the running copies ticked, every copy the rule refuses is signed out within 30 seconds with your Blocked message.
Remove a rule and that visitor can sign in again at once; nothing else changes.

A rule is a blunt tool: it refuses everyone it matches, paying customers too. Prefer banning the one key (Licences) when the problem is one customer; use a rule when the problem is a place or a machine.

Something missing or unclear? Tell us on Telegram.