Cloudflare Docs
Visit WAF on GitHub
Set theme to dark (⇧+D)

IP Lists

Use an IP List to reference a group of IP addresses collectively, by name, in rule expressions. You can create your own custom lists of IP addresses or use the Managed IP Lists provided by Cloudflare.

​​ Create an IP List

Refer to Create a list in the dashboard or to the Lists API page.

​​ Managed IP Lists

Use Managed IP Lists to access Cloudflare’s IP threat intelligence.

Cloudflare provides the following Managed IP Lists:

Display name Name in expressions Description
Cloudflare Open Proxies cf.open_proxies IP addresses of known open HTTP and SOCKS proxy endpoints, which are frequently used to launch attacks and hide attackers identity.
Cloudflare Anonymizers cf.anonymizer IP addresses of known anonymizers (Open SOCKS Proxies, VPNs, and TOR nodes).
Cloudflare VPNs cf.vpn IP addresses of known VPN servers.
Cloudflare Malware cf.malware IP addresses of known sources of malware.
Cloudflare Botnets, Command and Control Servers cf.botnetcc IP addresses of known botnet command-and-control servers.

​​ IP address and range formats

IP Lists support:

  • Individual IPv4 addresses
  • IPv4 CIDR ranges with a prefix from /8 to /32
  • IPv6 CIDR ranges with a prefix from /4 to /64

You can combine individual addresses and CIDR ranges in the same list.

You can use uppercase or lowercase characters for IPv6 addresses in lists. However, when you save the list, uppercase characters are converted to lowercase.

​​ CSV file format

When uploading a CSV file containing a list of IP addresses and optional descriptions, use the following format for each item (enter one item per line):