# Monthly Cloudflare blocklist review to catch stale IP blocks

> Every month we check who really owns the addresses you block, then flag the ones that may now be turning away real customers.

- Workflow type: agent
- Services: IPinfo, Cloudflare, Slack Bot
- Categories: Engineering, Operations
- Published: 2026-08-14

## What it does

- Gathers every IP address, range, country and network you currently block in Cloudflare, across both your account and your individual zone.
- Looks up who owns each one today: the company behind it, the city and country, the kind of network it is, and whether it still shows any sign of hiding traffic.
- Sorts every block into keep, worth a review, or likely stale, and highlights the risky ones such as home broadband and mobile ranges that have probably changed hands since you blocked them.
- Posts a grouped summary to your security channel in Slack with a one-line recommendation for each rule. Nothing is ever removed for you.

## What you'll need

- A Cloudflare account containing the blocklist you want reviewed
- An IPinfo account. A free one is enough to get started, and returns location and network owner for each address
- A Slack workspace and a channel where the monthly digest should land

## Prompt

On the first Monday of every month at 9am, review my Cloudflare blocklist and tell me which rules have gone stale. Never delete anything automatically, because I want to approve every removal myself.

Start by pulling every entry using Cloudflare's List IP Access Rules operation, covering both my zone-level and my account-level rules. Each rule tells you what it targets (a single IP, a CIDR range, an ASN, or a country), the mode it applies (block, challenge, or allow), any note attached to it, and when it was created. Use the creation date to work out how old each block is.

Then enrich each rule with IPinfo. For single IPs and CIDR ranges, use Get Full IP Details to see the current owner, city, country, and network type. Use Core / Plus IP Lookup to check the privacy and VPN detection flags. For any rule that blocks a whole autonomous system, use Get ASN Details to see the organisation behind it, its country, and the prefixes it covers, so I can tell how much of the internet that one rule actually reaches.

Two data caveats to handle gracefully. IPinfo's privacy and VPN detection, company, and carrier fields are paid-plan data, and a field that is not included in my plan is simply left out of the response rather than failing the request. Do not read a missing field as evidence of anything: carry on using the location and network owner data, and say plainly in the digest when the VPN signal was unavailable rather than implying the address came back clean. Separately, skip any entry that comes back marked as a bogon (a non-routable address such as an internal 10.x or 192.168.x range), since there is no location or network data to judge it against. Do not report those as unknown.

Judge each block against what the data shows now, and sort them into keep, review, and likely stale. Call out the risky ones specifically: residential or mobile ranges that were most likely reassigned to innocent users since the block was added; blocks that now cover a major cloud or CDN provider that real customer traffic runs through; country-wide and ASN-wide rules that are far broader than whatever the original threat was; and any rule older than twelve months with no remaining VPN, proxy, or hosting signal.

Post the result to my security channel in Slack as a grouped digest, sending it as the bot. Group the rules under likely stale, review, and keep, with likely stale first so the actionable items lead. For each rule, show the rule ID, what it targets, how old it is, what IPinfo reports about it today, and a one-line recommendation. Keep recommendations concrete, for example: 'Residential broadband range in Vietnam, no proxy or hosting signal, blocked 19 months ago, strong candidate for removal.'

If the blocklist is long, summarise the keep group as a count with a couple of examples rather than listing every rule, so the digest stays readable. If nothing looks stale this month, still post a short all-clear noting how many rules were checked. Close every digest with a reminder that nothing was changed and that any removal needs my approval first.

## How to customize

- Change the timing. The first Monday of each month suits most teams, but a quarterly review is plenty for a short blocklist.
- Adjust what counts as old. Blocks older than twelve months get flagged by default, which you can tighten or relax.
- Send the digest somewhere else, or split the urgent warnings about cloud and delivery networks into their own message.

## FAQ

### Will this delete any of my blocks?

No. The review only reads your blocklist and reports back. Every removal stays a manual decision you make yourself, which is deliberate: a wrong deletion reopens your site to traffic you blocked for a reason.

### Does this work with a free IPinfo account?

Yes, with fewer details. A free account gives you the location and the network owner for each address, which is enough to spot most stale blocks. The VPN and proxy detection flags are part of the paid plans, and the review simply notes when that signal was not available instead of guessing.

### Why do blocked IP addresses go stale in the first place?

Blocklists only ever grow. Addresses get handed back to internet providers and reassigned to completely different people, and a range that hosted an attacker two years ago may be somebody's home broadband today. Nobody notices, because a blocked customer just sees your site fail to load and quietly goes elsewhere.

### What if I block entire countries or large networks?

Those get special attention. The review works out how much of the internet a country-wide or network-wide rule actually covers and flags it when the block reaches far beyond whatever the original threat was.

### Does it check both account-level and site-level blocks?

Yes. Cloudflare lets you block at either level and it is easy to forget the rules set up in the other place, so the review pulls both and reports them together.

Use this prompt in General Input: https://www.generalinput.com/prompts/monthly-cloudflare-blocklist-review-to-catch-stale-ip-blocks