Nightly AbuseIPDB threat list sync to Cloudflare firewall
Every night we pull the most-reported malicious IPs from AbuseIPDB and block them at your Cloudflare edge, so bad traffic never reaches your site.
AbuseIPDB
CloudflareEngineeringOperationsData SyncResearch & MonitoringEvery night at 2:00 AM, keep our Cloudflare edge firewall in sync with the AbuseIPDB threat feed so the worst offenders are blocked before they ever reach our site. This is a deterministic sync with no judgement required: pull the list, skip anything already blocked, and create one block rule per new IP.
Step 1 - Pull the feed. Use AbuseIPDB's Download Blacklist operation to get the current list of the most-reported malicious IP addresses. Filter to the highest confidence by setting confidenceMinimum to 100 (this is also the default), so we only act on the most certain offenders.
Step 2 - See what is already blocked. Before creating anything, call Cloudflare's List IP Access Rules for our zone and collect every IP that already has a block rule. Page through all results so the dedupe set is complete.
Step 3 - Add only the new ones. For each IP on the blacklist that is not already in the existing block list, call Cloudflare's Create IP Access Rule with the mode set to block and the target set to that IP address. Skip any IP that is already covered so we never create duplicate rules. This dedupe against List IP Access Rules is what makes the nightly run safe to repeat and fully idempotent.
Cap each run to a sensible maximum number of new rules (for example, up to 500 per night) to stay within Cloudflare's account limits. On each rule set a short note such as 'AbuseIPDB blacklist auto-sync' so the source is obvious when someone reviews the firewall later. Do not send any notifications or make any judgement calls; the whole workflow is a straight sync from the blacklist into the firewall.
Additional information
What does this prompt do?
- Pulls the current list of the most-reported malicious IP addresses from AbuseIPDB every night.
- Adds each dangerous IP as a block rule in Cloudflare, so the traffic is stopped at the edge before it reaches your site.
- Checks what is already blocked first and skips duplicates, so repeat runs stay clean.
- Caps how many new blocks it adds each night to stay within your Cloudflare limits.
What do I need to use this?
- An AbuseIPDB account (the free plan works for the highest-confidence list).
- A Cloudflare account with the website you want to protect.
- Permission for Cloudflare to manage firewall rules on that site.
How can I customize it?
- Change the time it runs (the default is 2am every night).
- Raise or lower how many new IPs it blocks per run.
- Keep the list as strict or as broad as you like by adjusting the confidence level of the IPs it pulls.
Frequently asked questions
Will this block real customers by accident?
Does it create duplicate rules if it runs every night?
Do I need a paid AbuseIPDB plan?
What if the threat list is very large?
Can I run it less often or pause it?
Related templates
Stop known attackers before they reach your site.
Turn the AbuseIPDB threat feed into live Cloudflare firewall blocks, refreshed automatically every night.