A method for distributed rate limiting is provided. The method includes detecting, in a first communication received by an application, a suspicious behavior, the first communication having traveled through a network to the application, the detecting performed by a rate limiter coupled to the application. The method includes communicating, from a blocking analytics module associated with the application, to a blocker located in the network, information regarding an origin of the first communication. The method includes blocking, at the blocker located in the network, further communication having a same origin as the origin of the first communication.