Data-Shield IPv4 Blocklists

Two complete lists. Clear choices. Controlled updates.

Data-Shield provides maintained IPv4 blocklists for inbound filtering on firewalls, gateways and web application firewalls. Choose the policy that fits your environment, import its raw URL, and review its effect on legitimate traffic.

Download standard · Download critical · Report a false positive

Choose your list

Profile	Intended use	File
Standard	The starting point for Internet-facing services, with reviewed exceptions to reduce avoidable blocking.	prod_data-shield_ipv4_blocklist.txt
Critical	A broader blocking policy for environments that accept stricter ingress filtering. Review the impact before deployment.	prod_critical_data-shield_ipv4_blocklist.txt

Each file is complete and can be used on its own. Applying both lists combines their blocking decisions and may override the exceptions of the profile you intended to use.

The entry count changes over time. Check your product's capacity against the actual file, including whether it silently truncates oversized imports. There is no fixed 100,000-entry cap. Split files are no longer published; existing integrations must use one of the two complete files above.

Stable download URLs

Destination	Standard	Critical
GitHub	Raw file	Raw file
GitLab	Raw file	Raw file
Codeberg	Raw file	Raw file
Bitbucket	Raw file	Raw file
jsDelivr CDN	Raw file	Raw file

These are the existing download URLs used by SysWarden. The two filenames and their paths remain unchanged. GitLab manages repository mirroring to Codeberg and Bitbucket. jsDelivr serves a cached copy from GitHub, so CDN refreshes can lag behind publication.

Use a raw file URL in your firewall's feed configuration. A repository or preview-page URL returns a web page, not the blocklist.

Format and updates

• Plain text, with one public IPv4 address per line.
• No headers, comments, ports, CIDR ranges or IPv6 entries.
• Duplicate addresses removed and addresses sorted numerically.
• Generation scheduled every two hours. A new commit appears only when published file content changes.
• Both files validated before publication and committed together on GitHub and GitLab. Downstream mirrors and CDN caches can differ until they refresh.
• Failed generation checks preserve the last validated files. Failed publication is retried independently.

The public repository distributes the lists and their usage documentation. Review a file's commit history to check when its content last changed. Neither a successful download nor an unchanged commit proves that your firewall has applied the latest available data.

Deployment strategy

1. Start with the standard profile. Check the number of entries and your device's import limits.
2. Apply the list to inbound Internet traffic. Match the remote source address on traffic reaching the gateway or your published services. Do not apply the feed as a blanket outbound destination blocklist.
3. Review rule ordering and local exceptions. Preserve required administration and business access. A whitelist must take precedence according to your firewall's own rule model.
4. Observe before broad enforcement. Use logging or a limited deployment to inspect matches and identify legitimate services that need exceptions.
5. Refresh and monitor. Configure automatic retrieval where supported. Check fetch failures, truncation warnings and the number of entries actually loaded. Keep the last working rules if a download or import fails.

Platform integration guides

The Data-Shield website documentation provides setup instructions, copyable feed URLs and commands, capacity checks, and verification steps for sixteen platforms:

Platform	Integration method
FortiOS / FortiGate	Native HTTPS IP address external feed.
UniFi	Dynamic IPv4 Network List with zone-based firewall policies.
Palo Alto / PAN-OS	IP External Dynamic List with certificate validation.
OPNsense	Regularly refreshed URL table alias.
pfSense CE / Plus	Native URL Table (IPs), with daily refresh and capacity checks.
Sophos Firewall	SFOS 22.0 third-party threat feeds, with entitlement and polling checks.
VyOS	Native remote groups, with release-specific refresh settings.
MikroTik RouterOS	RouterOS v7 with a Linux controller for verified complete-feed updates.
OpenWrt	OpenWrt 25.12 with native banIP feeds and scheduled two-hour reloads.
Stormshield / SNS	Validated CSV conversion and manual custom web services import.
IPFire	Locally maintained source definitions with native two-hour update eligibility and Core Update persistence checks.
F5 BIG-IP / AFM	AFM custom IP Intelligence feeds with two-hour HTTPS polling and scoped source-address enforcement.
OpenCTI	Headerless CSV feeds for IPv4 observables, with hourly ingestion and explicit provenance.
MISP	Freetext feed caches for attribute correlation, refreshed by dedicated two-hour jobs.
CrowdSec	Verified two-hour LAPI imports with three-hour ban decisions, local allowlists and bouncer enforcement checks.
nftables	Verified atomic replacement of dedicated IPv4 sets, with two-hour refresh and persistent last-successful state.

OpenCTI and MISP provide investigation workflows. Raw IP feeds do not automatically import CVE associations or establish successful exploitation; the guides explain how to preserve dated evidence and verify current membership.

The UniFi guide in this repository also remains available. Check the guide for your release and appliance model. Product refresh intervals can be longer than Data-Shield's generation interval; the Stormshield workflow requires a manual import.

IP-based blocking is one layer of protection. It complements application security, patching, authentication, rate limiting and monitoring. It cannot identify every attack, and shared or reassigned addresses can produce false positives.

False positives and corrections

Open a false-positive report with:

• The affected IPv4 address and the list you use.
• The legitimate service affected and the time of the observed block.
• A concise explanation and sanitized evidence that helps reproduce the issue.

Do not post credentials, private logs or personal information in a public issue. For sensitive evidence or security vulnerabilities, follow the security policy. If access must be restored immediately, apply a narrowly scoped local exception while the report is reviewed.

Project and support

Maintained by Laurent Minne / Duggy Tuxy. If these lists help protect your services, you can support their maintenance on Ko-fi.

For Linux host protection, explore SysWarden and its repository.

See contributing, the code of conduct, and the GNU GPLv3 license.

Copyright 2023-2026 Laurent Minne / Duggy Tuxy.