Cloudflare

Push the list into a Cloudflare IP List and block it with a WAF rule, before traffic reaches you.

Block listed addresses at Cloudflare's edge, before they reach your origin. A script keeps a Cloudflare IP List in sync, and one WAF rule blocks it for every zone in the account.

Set it up

1. Create the list. In the Cloudflare dashboard go to Manage Account › Configurations › Lists, create an IP list called isipsafe, and note its ID from the URL.
2. Create an API token under My Profile › API Tokens with the permission Account › Account Filter Lists › Edit.
3. Sync the list with this script, from cron every hour. It replaces the whole list in one call:

   #!/bin/sh
   CF_ACCOUNT=your_account_id
   CF_LIST=your_list_id
   CF_TOKEN=your_api_token
   ISIPSAFE_KEY=sl_your_key_here
   
   curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt&confidenceMinimum=90&limit=10000" \
     | jq -R '{ip: ., comment: "isipsafe"}' | jq -s . \
     | curl -sf -X PUT "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT/rules/lists/$CF_LIST/items" \
         -H "Authorization: Bearer $CF_TOKEN" -H "Content-Type: application/json" --data @-

4. Block it. In each zone, go to Security › WAF › Custom rules and create a rule with the expression (ip.src in $isipsafe) and action Block (or Managed Challenge if you prefer to be gentle).

List size limits depend on your Cloudflare plan; limit=10000 fits the free allowance. The script needs jq.

Need a hand?

If something here does not work with your version of Cloudflare, or you have improved it, tell us. We update these pages with what people send.

Cloudflare and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.