Shieldlist lists
Blocklists built from what servers running Shieldlist see, published here as plain text and rebuilt every day.
Each list is a text file: one address or prefix per line, blank lines and lines starting with # ignored, a header saying when it was built and from what. The files are small and served with Last-Modified and ETag, so fetch them with conditional requests as often as you like; once a day is enough, the lists change once a day.
aws-ireland-scanners
- File
https://lists.shieldlist.eu/aws-ireland-scanners.txt- What
- AWS Ireland unsolicited scanners (AS16509). The Amazon prefixes from which unsolicited security scans reach servers running Shieldlist: hundreds of thousands of addresses a week, mostly from Amazon's Irish region and its neighbours, no identifying header or user agent, probing every name they can find for backup files, admin panels and known CVEs, and not stopping when asked to.
- How it is built
- From the sanctions those servers decided over the last 30 days. Every prefix of AS16509, as the network presents it, that carried at least five convicted addresses, nine in ten of them convicted by web rules, is in. A new pool appears the day after it starts scanning; an abandoned one leaves after thirty days. Nothing is added by hand.
- Size
- About a hundred prefixes, a third of the network's IPv4 space.
- Caveat
- These are the network's own blocks, /12 to /16: blocking them blocks every AWS service hosted in those ranges, scanners and everything else alike. That is the granularity the scanning imposes. Servers that must keep talking to something hosted there should exempt it first.
baidu
- File
https://lists.shieldlist.eu/baidu.txt- What
- Baidu: its search crawler, and above all the JavaScript renderer that comes back behind it. The renderer loads the pages a site has refused to Baiduspider, under an ordinary browser's user agent that changes from one request to the next, and runs their scripts — every analytics tool on those pages counts it as a human visit. Nothing in its requests tells it apart from a visitor; only where it comes from does.
- How it is built
- Every prefix Baidu's own networks, AS55967 and AS38365, announce. And the ranges Baidu crawls from inside Chinese carriers' space, which it publishes nowhere: a range is in when Baidu's own reverse DNS names its addresses (
*.crawl.baidu.com, confirmed forward — the test Baidu documents), checked again every day, its neighbouring ranges swept the same way to catch a new one; plus the range its renderer was seen using from addresses with no reverse name, marked as such in the file's header. - Size
- About sixty prefixes, some 390 000 IPv4 addresses.
- Caveat
- Blocking it ends Baidu's indexing of the sites behind the firewall, and blocks everything hosted on Baidu Cloud (AS38365) too.
Using a list
Shieldlist: Lists → Blocked → Published blocklists, turn the list on and choose where — the fleet, a group, or servers. The controller fetches it every six hours and pushes one firewall set per server; each server's exemptions are carved out first.
Any other firewall: fetch the file and load it. With CrowdSec, a daily cron with a short expiry so that removals take effect:
curl -fsS https://lists.shieldlist.eu/aws-ireland-scanners.txt \ | cscli decisions import -i - --format values -t ban -d 25h -R "AWS Ireland unsolicited scanners (AS16509)"
Provided as is, free to use. The lists describe what reached our servers; whether to block them is your decision. Questions and corrections: shieldlist.eu.
Network prefixes: for aws-ireland-scanners, DB-IP's IP to ASN Lite database, licensed CC BY 4.0; for baidu, the prefixes the networks announce, from RIPEstat (RIPE NCC).