Unique blocked IPv4 addresses
PUBLIC INTELLIGENCE / IPV4 ONLY
Clarity at the
network edge.
Understand what you block.
Explore the global footprint of Data-Shield, from country-level coverage to the addresses protecting your infrastructure.
Published snapshot/08 Nov 2026, 11:05 UTC
Checked 08 Nov 2026, 11:11 UTC
Unique blocked IPv4 addresses
IPv4 addresses covered in both profiles
With addresses in Critical
THE GLOBAL PICTURE
A world of signals.
Every country in view.
Explore blocked addresses and whitelist coverage.
Hover, tap or select a country to see its numbers.
STANDARD / BLOCKED IPV42D COUNTRY ATLAS
Blocked IPv4Low → High
Unique IPv4 addresses, not connection or attack counts. Colors use a logarithmic scale.
Geolocation: DB-IP 2026-11 · Map: Natural Earth
COUNTRY RANKINGS
The Top 50.
Standard countries ranked by unique blocked IPv4 addresses.
| Rank | Country | Blocked IPv4 | Whitelisted IPv4 | Blocked share |
|---|---|---|---|---|
| 01 | USUnited States | 31,289 | 420,208 | |
| 02 | CNPeople's Republic of China | 8,747 | 558,120 | |
| 03 | DEGermany | 5,341 | 31,756 | |
| 04 | GBUnited Kingdom | 4,804 | 37,792 | |
| 05 | RURussia | 4,602 | 184,901 | |
| 06 | SGSingapore | 4,060 | 36,427 | |
| 07 | NLNetherlands | 3,876 | 47,891 | |
| 08 | BEBelgium | 3,517 | 4,056 | |
| 09 | BRBrazil | 3,422 | 43,230 | |
| 10 | INIndia | 2,619 | 47,149 | |
| 11 | KRSouth Korea | 2,537 | 8,146 | |
| 12 | UAUkraine | 2,154 | 2,588 | |
| 13 | FRFrance | 2,084 | 22,805 | |
| 14 | HKHong Kong | 1,881 | 27,967 | |
| 15 | CACanada | 1,855 | 1,065,695 | |
| 16 | JPJapan | 1,818 | 22,794 | |
| 17 | IDIndonesia | 1,779 | 204,338 | |
| 18 | ARArgentina | 1,733 | 9,535 | |
| 19 | TWTaiwan | 1,425 | 5,266 | |
| 20 | BDBangladesh | 1,240 | 4,353 | |
| 21 | PKPakistan | 1,204 | 3,584 | |
| 22 | MYMalaysia | 1,165 | 35,648 | |
| 23 | VNVietnam | 1,042 | 2,015 | |
| 24 | ITItaly | 826 | 8,342 | |
| 25 | AUAustralia | 754 | 22,341 | |
| 26 | MXMexico | 664 | 6,148 | |
| 27 | SESweden | 653 | 6,883 | |
| 28 | UZUzbekistan | 651 | 864 | |
| 29 | IRIran | 615 | 0 | |
| 30 | TRTurkey | 607 | 8,644 | |
| 31 | FIFinland | 589 | 5,227 | |
| 32 | CLChile | 543 | 5,120 | |
| 33 | ZASouth Africa | 531 | 8,722 | |
| 34 | COColombia | 519 | 6,155 | |
| 35 | ESSpain | 510 | 9,468 | |
| 36 | PLPoland | 507 | 326,378 | |
| 37 | THThailand | 372 | 5,632 | |
| 38 | VEVenezuela | 312 | 0 | |
| 39 | KEKenya | 296 | 3,585 | |
| 40 | ILIsrael | 277 | 6,929 | |
| 41 | BGBulgaria | 275 | 3,841 | |
| 42 | CHSwitzerland | 247 | 3,733 | |
| 43 | PHPhilippines | 224 | 6,917 | |
| 44 | EGEgypt | 218 | 1,319 | |
| 45 | SASaudi Arabia | 212 | 5,376 | |
| 46 | ADAndorra | 206 | 256 | |
| 47 | IQIraq | 196 | 3,074 | |
| 48 | KZKazakhstan | 196 | 2,324 | |
| 49 | AEUnited Arab Emirates | 181 | 2,369 | |
| 50 | LTLithuania | 172 | 769 |
Unknown country is excluded from the ranking and included in totals.
TWO PROFILES. A DELIBERATE CHOICE.
Choose your
protection policy.
Both profiles apply the shared whitelist. Critical adds broader blocking coverage. Each file is complete and can be used on its own.
Compare and download ↗In both lists110,189
Standard only0
Critical only9,329
Unique across both119,518
Shared whitelist exceptions take precedence in both profiles. Whitelist coverage counts unique IPv4 addresses, with overlapping ranges counted once.
READY FOR YOUR NETWORK
Two lists. Five delivery paths.
Plain text. One IPv4 address per line.
Numerically sorted. No duplicates. No IPv6.
Standard
IPV4 / TXTA focused inbound filtering policy with reviewed exceptions.
prod_data-shield_ipv4_blocklist.txt
110,189 addresses1.49 MiB
Verify SHA-256
98d729b150faf179dc7e3624c197f192bc25b35653867c05bef3353861d7786bCritical
IPV4 / TXTA broader inbound blocking policy for stricter environments.
prod_critical_data-shield_ipv4_blocklist.txt
119,518 addresses1.62 MiB
Verify SHA-256
f61888dfec16b9068997a8f74dabdfca8a6f522475ea7b8462f1060087a0d92bChoose your mirror
STANDARD / CRITICAL| Delivery | Standard | Critical | Publication path |
|---|---|---|---|
| GitHub | Standard ↓ | Critical ↓ | Primary publication |
| GitLab | Standard ↓ | Critical ↓ | Direct publication and mirror origin |
| Codeberg | Standard ↓ | Critical ↓ | Mirrored through GitLab |
| Bitbucket | Standard ↓ | Critical ↓ | Mirrored through GitLab |
| CDN | Standard ↓ | Critical ↓ | Cached GitHub delivery |
GitHub and GitLab publish both files together. Codeberg and Bitbucket are mirrored through GitLab. The CDN caches GitHub content; mirrors and caches can lag behind the source.
CHECK BEFORE YOU REPORT
Where does this IP stand?
Check an IPv4 address or CIDR against both published lists. The lookup happens in your browser. The address you enter is never sent in a lookup request.
TRANSPARENCY BY DESIGN
Know what the numbers mean.
Published, then measured.
Statistics refer to one published GitHub commit. Both files are checked against their expected SHA-256 hashes before the site is built.
Freshness you can inspect.
Blocklists are generated every two hours. The site updates after publication and refreshes automatically every hour. Open pages check for updates every minute.
Exceptions stay private.
Whitelist statistics count unique IPv4 addresses covered by the policy, including CIDR ranges. Only aggregate country statistics are public. Internal rules and reasons stay private.
Should I use Standard or Critical?
Start with the profile that fits your inbound filtering policy. Both profiles apply the shared whitelist; Critical adds broader blocking coverage. Both are complete files. Review changes and retain a working local copy before applying updates.
Does a country with more blocked IPs mean it is more dangerous?
No. Rankings are counts in these lists, not population-adjusted or network-size-adjusted risk scores. Hosting infrastructure and address allocation affect the distribution. Geolocation is approximate and does not establish the origin or nationality of an attacker.
What does whitelisted mean here?
The shared whitelist applies to both Standard and Critical. Statistics count unique IPv4 addresses covered by exceptions for the selected profile, with overlapping ranges counted once. It is not the number of benign addresses on the Internet, nor the number of allowed connections. An address absent from a blocklist is not necessarily explicitly whitelisted.
How should I use the blocklists?
Use them for incoming traffic filtering on firewalls, gateways or WAFs. Do not apply them blindly as a blanket outgoing traffic block. SysWarden can consume Data-Shield lists for kernel-level filtering. Follow the integration guides for FortiOS, UniFi, Palo Alto, OPNsense and Stormshield.
What happens if an update fails?
The last verified website snapshot remains available. The page displays its generation time and warns when it is stale. Deployments fail closed if list contents, counts or hashes disagree. Hosting caches and GitHub Pages deployment time can delay visibility of a new snapshot.
Privacy, licensing and data credits
This site uses no analytics, advertising cookies or external font services. Only your theme preference is saved locally. Hosting providers process normal connection information. Created and maintained by duggytuxy (Laurent Minne). Code and blocklists are covered by the project's GPL-3.0 license. Country geolocation is based on DB-IP Country Lite, under CC BY 4.0. Map geometry is from Natural Earth (public domain); the Outfit font uses the SIL Open Font License.
EVIDENCE BEFORE CONCLUSIONS
Context behind every signal.
Investigate blocked IPv4 addresses with optional exposure enrichment, CVSS severity, CISA KEV and FIRST EPSS. Understand the evidence and its limits.
FROM INTELLIGENCE TO ENFORCEMENT
Put the lists to work.
Connect Data-Shield to FortiOS, UniFi, Palo Alto, OPNsense or Stormshield. Follow the setup, copy the commands and verify your coverage.
BETTER DATA. TOGETHER.
A clear signal starts with you.
Found a malicious address or a false positive? Share evidence through the project's dedicated forms. Keep credentials and sensitive logs out of public issues.