Curated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for threat intelligence platforms.
The Data-Shield IPv4 Blocklist Community provides an official, curated registry of IPv4 addresses identified as malicious. Updated continuously, this resource offers vital threat intelligence to bolster your Firewall and WAF instances, delivering a robust, additional layer of security for your infrastructure.
Proactive Defense & Reduced Attack Surface The Data-Shield IPv4 Blocklist Community Community serves as an essential protective layer for your exposed assets (Web Apps, WordPress, Websites, VPS with Apache, Nginx). By blocking malicious traffic early, it significantly reduces the reconnaissance phase and lowers visibility on scanners like Shodan.
High-Fidelity, Centralized Intelligence Data is aggregated from a single, verified source fed by global probes and processed via a self-hosted HIDS/SIEM stack. We prioritize data reliability to minimize false positives, ensuring your legitimate traffic remains uninterrupted.
Seamless Compatibility & Integration Designed for universal deployment:
Freshness & Performance
Open Source & Community Driven Accessible to anyone—from hobbyists to enterprise admins. The project is proudly distributed under the GNU GPLv3 license, fostering a transparent and collaborative security ecosystem.
Drastic Noise Reduction & Streamlined Response By filtering out approximately 95% of malicious bot traffic, we reduce overall log noise by up to 50%. This significantly improves the signal-to-noise ratio, allowing Cybersecurity Incident Responders (CIRs) to focus on genuine anomalies and critical alerts rather than sifting through automated background noise.
Optimized Resource Consumption Blocking threats at the perimeter prevents them from reaching your application logic. This leads to a direct reduction in CPU, RAM, and bandwidth usage, preserving your server resources for legitimate user traffic and reducing infrastructure costs.
Automated, Multi-Channel Delivery Ensure your defense is always active without manual intervention. Blocklists are automatically updated and distributed via high-availability networks including GitHub, JSdelivr CDN, BitBucket, Codeberg, and GitLab, guaranteeing reliable access through standard Raw URLs.
For Web Apps, WordPress, Websites, VPS with Apache, Nginx
To guarantee high availability and resilience, the Data-Shield IPv4 Blocklist Community is deployed across a robust multi-cloud infrastructure. The data is synchronized every 6 hours across multiple repositories and a global CDN.
Which list should I use?
| Dataset Variant | Entry Cap | Raw Link |
|---|---|---|
| Full List | ~100k IPs | prod_data-shield_ipv4_blocklist.txt |
| Split List A | 30k IPs | prod_aa_data-shield_ipv4_blocklist.txt |
| Split List B | 30k IPs | prod_ab_data-shield_ipv4_blocklist.txt |
| Split List C | 30k IPs | prod_ac_data-shield_ipv4_blocklist.txt |
| Dataset Variant | Entry Cap | Raw Link |
|---|---|---|
| Full List | ~100k IPs | prod_data-shield_ipv4_blocklist.txt |
| Split List A | 30k IPs | prod_aa_data-shield_ipv4_blocklist.txt |
| Split List B | 30k IPs | prod_ab_data-shield_ipv4_blocklist.txt |
| Split List C | 30k IPs | prod_ac_data-shield_ipv4_blocklist.txt |
