Data-Shield_IPv4_Blocklist - Data-Shield IPv4 Blocklist Community provides an o

项目说明

<p align="center">
<a href="
<img src=" alt="CIA Triad Integrity Pipeline">
</a>
<img src="
<img src="
<img src="
<img src="
<img src="
<img src="
</p>

<di="center">
<a href="
<img src="
</a>
<a href="
<img src="
</a>
<br />
</div>

<p align="center">
<br />
<a href=" target="_blank">
<img src=" alt="Support me on Ko-fi">
</a>
<br />
</p>

Data‑Shield IPv4 Blocklist Community

The Data-Shield IPv4 Blocklist Community provides an official, curated registry of IPv4 addresses identified as malicious. Updated continuously, this resource offers vital threat intelligence to bolster your Firewall and WAF instances, deli a robust, additional layer of security for your infrastructure.

Key Features & Benefits

Proacti & Reduced Attack Surface The Data-Shield IPv4 Blocklist Community Community serves as an essential protecti for your exposed assets (Web Apps, WordPress, Websites, VPS with Apache, Nginx). By blocking malicious traffic early, it significantly reduces the reconnaissance phase and lowers on scanners like Shodan.

High-Fidelity, Centralized Intelligence Data is aggregated from a single, source fed by global probes and processed via a self-hosted HIDS/SIEM stack. We prioritize data reliability to minimize false positives, ensuring your legitimate traffic remains uninterrupted.

Seamless Compatibility & Integration Designed for uni deployment:

- Uni Format: Easily integrates via a single RAW link into most Firewalls and WAFs.
- : Includes split-list logic to accommodate hardware with strict entry-count limitations.
- CTI Ready: Fully portable for enrichment in Threat Intelligence platforms like OpenCTI and MISP.

Freshness & Performance

- Updates: Refreshed every 6 hours to counter immediate threats.
- Retention: A 15-day rolling window ensures we track short-li IPs without bloating your rulesets with obsolete data.
- Efficiency: Delivers enterprise-grade performance comparable to commercial solutions.

Open Source & Community Driven Accessible to anyone—from hobbyists to enterprise admins. The project is proudly distributed under the GNU GPLv3 license, fostering a transparent and collaborati ecosystem.

Core Objectives & Impact

Drastic Noise Reduction & Streamlined Response By filtering out approximately 95% of malicious bot traffic, we reduce o log noise by up to 50%. This significantly improves the signal-to-noise ratio, allowing Cybersecurity Incident Responders (CIRs) to focus on genuine anomalies and critical alerts rather than sifting through automated background noise.

Optimized Resource Consumption Blocking threats at the perimeter prevents them from reaching your application logic. This leads to a direct reduction in CPU, RAM, and bandwidth usage, preserving your ser for legitimate user traffic and reducing infrastructure costs.

Automated, Multi-Channel Delivery Ensure your defense is always acti manual inter. Blocklists are automatically updated and distributed networks including GitHub, JSdelivr CDN, BitBucket, Codeberg, and GitLab, guaranteeing reliable access through standard Raw URLs.

Production Lists

> For Web Apps, WordPress, Websites, VPS with Apache, Nginx

To guarantee high a and resilience, the Data-Shield IPv4 Blocklist Community is deployed across a robust multi-cloud infrastructure. The data is synchronized every 6 hours across multiple repositories and a global CDN.

Which list should I use?

- Full List: Recommended for most modern Firewalls, WAFs, and SIEMs.
- Split Lists (A/B/C): Designed for legacy hardware or with strict entry limits per object (e.g., max 30k IPs). If used, ensure all 3 parts are ingested.

#### GitHub Repository (Mirror)
> View Official Repository

| Dataset | Entry Cap | Raw Link |
| :--- | :---: | :--- |
| Full List | ~100k IPs | prod_data-shield_ip.txt |
| Split List A | 30k IPs | prod_aa_data-shield_ip.txt |
| Split List B | 30k IPs | prod_ab_data-shield_ip.txt |
| Split List C | 30k IPs | prod_ac_data-shield_ip.txt |

#### GitLab Repository (Main Source)
> View Official Repository

| Dataset | Entry Cap | Raw Link |
| :--- | :---: | :--- |
| Full List | ~100k IPs | prod_data-shield_ip.txt |
| Split List A | 30k IPs | prod_aa_data-shield_ip.txt |
| Split List B | 30k IPs | prod_ab_data-shield_ip.txt |
| Split List C | 30k IPs | prod_ac_data-shield_ip.txt |

#### jsDelivr CDN (High Performance)
> View CDN Status

| Dataset | Entry Cap | Raw Link |
| :--- | :---: | :--- |
| Full List | ~100k IPs | prod_data-shield_ip.txt |
| Split List A | 30k IPs | prod_aa_data-shield_ip.txt |
| Split List B | 30k IPs | prod_ab_data-shield_ip.txt |
| Split List C | 30k IPs | prod_ac_data-shield_ip.txt |

#### BitBucket Repository (Mirror)
> View Official Repository

| Dataset | Entry Cap | Raw Link |
| :--- | :---: | :--- |
| Full List | ~100k IPs | prod_data-shield_ip.txt |
| Split List A | 30k IPs | prod_aa_data-shield_ip.txt |
| Split List B | 30k IPs | prod_ab_data-shield_ip.txt |
| Split List C | 30k IPs | prod_ac_data-shield_ip.txt |

#### Codeberg Repository (Mirror)
> View Official Repository

| Dataset | Entry Cap | Raw Link |
| :--- | :---: | :--- |
| Full List | ~100k IPs | prod_data-shield_ip.txt |
| Split List A | 30k IPs | prod_aa_data-shield_ip.txt |
| Split List B | 30k IPs | prod_ab_data-shield_ip.txt |
| Split List C | 30k IPs | prod_ac_data-shield_ip.txt |

New Production Lists

> For DMZs, critical assets, exposed infrastructure, and APIs

Critical Infrastructure & Specialized Lists Tailored for SMBs and enterprise en, we provide 5 dedicated lists specifically designed to protect high-value targets such as DMZs, critical assets, exposed infrastructure, and APIs. This expanded co offers granular protection suited for complex en, ensuring your most sensiti remain secure.

#### GitHub Repository (Mirror)
> View Official Repository

| Dataset | Entry Cap | Raw Link |
| :--- | :---: | :--- |
| Full List | ~100k IPs | prod_critical_data-shield_ip.txt |
| Split List A | 30k IPs | prod_critical_aa_data-shield_ip.txt |
| Split List B | 30k IPs | prod_critical_ab_data-shield_ip.txt |
| Split List C | 30k IPs | prod_critical_ac_data-shield_ip.txt |

#### GitLab Repository (Main Source)
> View Official Repository

| Dataset | Entry Cap | Raw Link |
| :--- | :---: | :--- |
| Full List | ~100k IPs | prod_critical_data-shield_ip.txt |
| Split List A | 30k IPs | prod_critical_aa_data-shield_ip.txt |
| Split List B | 30k IPs | prod_critical_ab_data-shield_ip.txt |
| Split List C | 30k IPs | prod_critical_ac_data-shield_ip.txt |

#### jsDelivr CDN (High Performance)
> View CDN Status

| Dataset | Entry Cap | Raw Link |
| :--- | :---: | :--- |
| Full List | ~100k IPs | prod_critical_data-shield_ip.txt |
| Split List A | 30k IPs | prod_critical_aa_data-shield_ip.txt |
| Split List B | 30k IPs | prod_critical_ab_data-shield_ip.txt |
| Split List C | 30k IPs | prod_critical_ac_data-shield_ip.txt |

#### BitBucket Repository (Mirror)
> View Official Repository

| Dataset | Entry Cap | Raw Link |
| :--- | :---: | :--- |
| Full List | ~100k IPs | prod_critical_data-shield_ip.txt |
| Split List A | 30k IPs | prod_critical_aa_data-shield_ip.txt |
| Split List B | 30k IPs | prod_critical_ab_data-shield_ip.txt |
| Split List C | 30k IPs | prod_critical_ac_data-shield_ip.txt |

#### Codeberg Repository (Mirror)
> View Official Repository

| Dataset | Entry Cap | Raw Link |
| :--- | :---: | :--- |
| Full List | ~100k IPs | prod_critical_data-shield_ip.txt |
| Split List A | 30k IPs | prod_critical_aa_data-shield_ip.txt |
| Split List B | 30k IPs | prod_critical_ab_data-shield_ip.txt |
| Split List C | 30k IPs | prod_critical_ac_data-shield_ip.txt |

Integration Tutorials

To ensure the Data-Shield IPv4 Blocklist Community is operational and effective, it is crucial to apply the filtering rules in the correct direction of traffic flow.

Deployment Strategy

> ✅ Correct Usage: WAN to LAN (Inbound Traffic)
> The blocklist is designed to stop threats *entering* your network from the Internet.

> ⛔ Restricted Usage: LAN to WAN (Outbound Traffic)
> Do not apply these rules to outgoing traffic (from your internal network to the Internet).

Community & Tutorials

A non-exhausti of guides to facilitate integration across en.

| / Platform | Resource Type | Capacity Note |
| :--- | :---: | :---: |
| BunkerWeb | Official Documentation | ≥ 100k IPs |
| Fortinet | Official Guide | ≥ 100k IPs |
| Checkpoint | Manufacturer's Guide | *TBC* |
| Palo Alto | EDL O | *TBC* |
| F5 BIG-IP | Official Guide | *TBC* |
| Stormshield | Official Video | *TBC* |
| OPNsense | Slash-Root Guide | ≥ 100k IPs |
| Synology NAS | MyOwnSer | ≥ 100k IPs |
| UniFi Gateways | Community Guide | 100k IPs per dynamic list |

GRC & Compliance

Go & Operational Efficiency

The solution reduces operational noise by up to 50% and blocks 95% of malicious bot traffic, significantly freeing up ser (CPU, RAM). It enforces a strict WAN-to-LAN configuration to guarantee system effecti while offering 5 official lists (up to 120,000 IPs) adapted to hardware limitations.

Regulatory Alignment (ISO 27001 & NIS2)

Integration directly supports ISO 27001:2022 controls (A.8.20 Network Security, A.5.7 Threat Intelligence) by automating perimeter defense against known attacks. It also meets NIS2 Directive requirements for essential entities by pro structured risk management and proportionate technical measures to ensure service resilience.

GDPR & Privacy Standards

When correctly configured (WAN-to-LAN only), the blocklist operates outside the scope of GDPR, as blocked IPs belong to external malicious actors with no contractual relationship to your organization. This ensures a compliance-friendly integration without the need for complex personal data processing documentation.

Risk Management & Reliability

We utilize a rigorous beha analysis methodology to minimize false positives, targeting a rate of less than 2 occurrences per month. High a is guaranteed via 4 independent download sources (GitHub, BitBucket, Codeberg, GitLab), ensuring continuous protection e host incidents.

Structured Deployment & Community Feedback

Adoption follows a secure, phased approach—from Obser (logging only) to Acti—ensuring non-regression on critical flows. The project fosters transparency with a clear process for reporting false positives , aiming for collecti and resolution within 48 hours.

> Download the complete GRC Compliance Model to modify it if necessary and insert it into your information systems security policy, in accordance with your GRC officer Docx and PDF formats.

Support & Sustainability

> Help keep the project alive
> De and maintaining a high-fidelity, real-time blocklist requires significant infrastructure resources and dedicated time. Your contributions are vital to ensure the project remains sustainable, up-to-date, and free for the community.
> If you find this project useful, consider supporting its ongoing de:

* ☕ Ko-Fi:

License & Copyright

Data-Shield IPv4 Blocklist Community © 2023–2026

De by Duggy Tuxy (Laurent Minne).

"This project is open-source software licensed under the GNU GPLv3 License."

项目信息

开发语言：未知

Star 数：612

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Data-Shield IPv4 Blocklist Community provides an official, curated registry of IPv4 addresses identified as malicious. Updated continuously, this resource offers vital threat intelligence to bolster your Firewall and WAF instances,...展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。