diff --git a/roles/openresty/files/java-nginx-config/nginx/conf/lua/limit_api_flow.lua b/roles/openresty/files/java-nginx-config/nginx/conf/lua/limit_api_flow.lua
index a06a9aa..da32e74 100644
--- a/roles/openresty/files/java-nginx-config/nginx/conf/lua/limit_api_flow.lua
+++ b/roles/openresty/files/java-nginx-config/nginx/conf/lua/limit_api_flow.lua
@@ -74,7 +74,7 @@ function rate_limit()
   -- do limit
   local flag= limit("yh:nginx:limitflow:" .. req_uri_method, max_per_sencond)
   if not flag then
-    ngx.log(ngx.ERR,"The request is in limited :" .. req_uri_method)
+    ngx.log(ngx.ERR,"The request is limited :" .. req_uri_method)
     ngx.header["Content-Type"]="application/json;charset=utf-8"
     local msg='{"code":' .. err_code .. ',"message":"'.. err_msg .. '"}'
     ngx.say(msg)
@@ -99,14 +99,19 @@ function is_white()
 end
 
 ----- check weather ip is in black list
+--- be careful when change response(body & header). APP need those to pop up verify toast
 function check_malIp()
   local cache=lua_context.mal_ip_cache
   local ip=ngx.var.real_ip
   local exist = cache:get("yh:mip:" .. ip)
   
   if exist then
-     ngx.log(ngx.ERR, "The request ip is in blacklist:" .. ip)
-     ngx.exit(ngx.HTTP_FORBIDDEN)
+    ngx.log(ngx.ERR, "[LimitIPAccess:ip]:" .. ip )
+
+    ngx.header["x-yoho-malicode"]="10011"
+    local rsp ='{"code": 10011, "message": ""}'
+    ngx.say(rsp)
+    ngx.exit(ngx.HTTP_OK)
   end 
 end
 ---------end check_malIp()-----------