The Data-Shield IPv4 Blocklist Community provides an official, curated registry of IPv4 addresses identified as malicious. Updated continuously, this resource offers vital threat intelligence to bolster your Firewall and WAF instances, delivering a robust, additional layer of security for your infrastructure.
Data‑Shield IPv4 Blocklist Community — Apply on your server ✕
ipset + iptables # Charge la liste dans un ensemble ipset, remplacé d'un bloc (pas de trou de protection)
sudo mkdir -p /etc/blocklist
curl -fsSL "https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt" | grep -Eo '^[0-9]{1,3}(\.[0-9]{1,3}){3}(/[0-9]{1,2})?' | sort -u | sudo tee /etc/blocklist/data_shield_ipv4.txt >/dev/null
sudo ipset create -exist data_shield_ipv4 hash:net family inet maxelem 262144
sudo ipset create -exist data_shield_ipv4_tmp hash:net family inet maxelem 262144
sudo ipset flush data_shield_ipv4_tmp
while read -r net; do sudo ipset add -exist data_shield_ipv4_tmp "$net"; done < /etc/blocklist/data_shield_ipv4.txt
sudo ipset swap data_shield_ipv4_tmp data_shield_ipv4
# Une seule fois : la règle qui bloque
sudo iptables -C INPUT -m set --match-set data_shield_ipv4 src -j DROP 2>/dev/null || sudo iptables -I INPUT -m set --match-set data_shield_ipv4 src -j DROP nftables # IPv4. Adaptez « inet filter » et la chaîne « input » à votre jeu de règles (nft list ruleset)
curl -fsSL "https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt" | grep -Eo '^[0-9]{1,3}(\.[0-9]{1,3}){3}(/[0-9]{1,2})?' | sort -u | sudo tee /etc/blocklist-data_shield_ipv4.txt >/dev/null
sudo nft add set inet filter data_shield_ipv4 '{ type ipv4_addr; flags interval; auto-merge; }'
sudo nft flush set inet filter data_shield_ipv4
{ echo "add element inet filter data_shield_ipv4 {"; paste -sd, /etc/blocklist-data_shield_ipv4.txt; echo "}"; } | sudo nft -f -
# Une seule fois : la règle qui bloque
sudo nft insert rule inet filter input ip saddr @data_shield_ipv4 drop fail2ban # fail2ban n'importe pas de liste : on injecte les adresses dans une prison existante (ici « recidive »).
# Pour de petites listes seulement (quelques milliers d'entrées) ; au-delà, préférez ipset ou nftables.
curl -fsSL "https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt" | grep -Eo '^[0-9]{1,3}(\.[0-9]{1,3}){3}(/[0-9]{1,2})?' | sort -u | while read -r net; do sudo fail2ban-client set recidive banip "$net"; done CrowdSec # Importe la liste comme décisions CrowdSec (un bouncer pare-feu doit être installé : crowdsec-firewall-bouncer)
curl -fsSL "https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt" | grep -Eo '^[0-9]{1,3}(\.[0-9]{1,3}){3}(/[0-9]{1,2})?' | sort -u > /tmp/data_shield_ipv4.txt
sudo cscli decisions import -i /tmp/data_shield_ipv4.txt --format values --duration 24h --reason "data_shield_ipv4 rdr-it" --type ban nginx # /etc/nginx/conf.d/blocklist-data_shield_ipv4.conf (dans le bloc http)
geo $blocked_data_shield_ipv4 { default 0; include /etc/nginx/blocklist-data_shield_ipv4.geo; }
# Dans chaque server à protéger : if ($blocked_data_shield_ipv4) { return 444; }
curl -fsSL "https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt" | grep -Eo '^[0-9]{1,3}(\.[0-9]{1,3}){3}(/[0-9]{1,2})?' | sort -u | awk '{print $1 " 1;"}' | sudo tee /etc/nginx/blocklist-data_shield_ipv4.geo >/dev/null && sudo nginx -t && sudo systemctl reload nginx Automatic refresh (cron) # Rafraîchir chaque jour à 4 h : placez les commandes ipset (ou nft) ci-dessus dans /usr/local/bin/blocklist-update-data_shield_ipv4.sh puis :
echo '0 4 * * * root /usr/local/bin/blocklist-update-data_shield_ipv4.sh' | sudo tee /etc/cron.d/blocklist-data_shield_ipv4 Read the commands before running them, adapt table and chain names to your firewall, and keep a fallback access: a wrong rule can lock you out.