Data-Shield IPv4 Blocklists

Two complete lists. Clear choices. Controlled updates.

Data-Shield provides maintained IPv4 blocklists for inbound filtering on firewalls, gateways and web application firewalls. Choose the policy that fits your environment, import its raw URL, and review its effect on legitimate traffic.

Download standard · Download critical · Report a false positive

Choose your list

Profile	Intended use	File
Standard	The starting point for Internet-facing services, with reviewed exceptions to reduce avoidable blocking.	prod_data-shield_ipv4_blocklist.txt
Critical	A broader blocking policy for environments that accept stricter ingress filtering. Review the impact before deployment.	prod_critical_data-shield_ipv4_blocklist.txt

Each file is complete and can be used on its own. Applying both lists combines their blocking decisions and may override the exceptions of the profile you intended to use.

The entry count changes over time. Check your product's capacity against the actual file, including whether it silently truncates oversized imports. There is no fixed 100,000-entry cap. Split files are no longer published; existing integrations must use one of the two complete files above.

Stable download URLs

Destination	Standard	Critical
GitHub	Raw file	Raw file
GitLab	Raw file	Raw file
Codeberg	Raw file	Raw file
Bitbucket	Raw file	Raw file
jsDelivr CDN	Raw file	Raw file

These are the existing download URLs used by SysWarden. The two filenames and their paths remain unchanged. GitLab manages repository mirroring to Codeberg and Bitbucket. jsDelivr serves a cached copy from GitHub, so CDN refreshes can lag behind publication.

Use a raw file URL in your firewall's feed configuration. A repository or preview-page URL returns a web page, not the blocklist.

Format and updates

• Plain text, with one public IPv4 address per line.
• No headers, comments, ports, CIDR ranges or IPv6 entries.
• Duplicate addresses removed and addresses sorted numerically.
• Generation scheduled every two hours. A new commit appears only when published file content changes.
• Both files validated before publication and committed together on GitHub and GitLab. Downstream mirrors and CDN caches can differ until they refresh.
• Failed generation checks preserve the last validated files. Failed publication is retried independently.

The public repository distributes the lists and their usage documentation. Review a file's commit history to check when its content last changed. Neither a successful download nor an unchanged commit proves that your firewall has applied the latest available data.

Deployment strategy

1. Start with the standard profile. Check the number of entries and your device's import limits.
2. Apply the list to inbound Internet traffic. Match the remote source address on traffic reaching the gateway or your published services. Do not apply the feed as a blanket outbound destination blocklist.
3. Review rule ordering and local exceptions. Preserve required administration and business access. A whitelist must take precedence according to your firewall's own rule model.
4. Observe before broad enforcement. Use logging or a limited deployment to inspect matches and identify legitimate services that need exceptions.
5. Refresh and monitor. Configure automatic retrieval where supported. Check fetch failures, truncation warnings and the number of entries actually loaded. Keep the last working rules if a download or import fails.

Platform integration guides

The Data-Shield website documentation provides setup instructions, copyable feed URLs and commands, capacity checks, and verification steps for fourteen platforms: