Create a security group inbound rule to deny traffic from the specific IP address. Assign the security group to the domain.

Create a network ACL inbound rule to deny traffic from the specific IP address. Assign the rule to the default network Ad for the subnet where the domain is located.

Create a shadow variant for the domain. Configure SageMaker Inference Recommender to send traffic from the specific IP address to the shadow endpoint.

Create a VPC route table to deny inbound traffic from the specific IP address. Assign the route table to the domain.