IP Lists
Use an IP List to reference a group of IP addresses collectively, by name, in rule expressions. You can create your own custom lists of IP addresses or use the Managed IP Lists provided by Cloudflare.
Create an IP List
Refer to Create a list in the dashboard or to the Lists API page.
Managed IP Lists
Use Managed IP Lists to access Cloudflare’s IP threat intelligence.
Cloudflare provides the following Managed IP Lists:
| Display name | Name in expressions | Description |
|---|---|---|
| Cloudflare Open Proxies | cf.open_proxies | IP addresses of known open HTTP and SOCKS proxy endpoints, which are frequently used to launch attacks and hide attackers identity. |
| Cloudflare Anonymizers | cf.anonymizer | IP addresses of known anonymizers (Open SOCKS Proxies, VPNs, and TOR nodes). |
| Cloudflare VPNs | cf.vpn | IP addresses of known VPN servers. |
| Cloudflare Malware | cf.malware | IP addresses of known sources of malware. |
| Cloudflare Botnets, Command and Control Servers | cf.botnetcc | IP addresses of known botnet command-and-control servers. |
IP address and range formats
IP Lists support:
- Individual IPv4 addresses
- IPv4 CIDR ranges with a prefix from
/8to/32 - IPv6 CIDR ranges with a prefix from
/4to/64
You can combine individual addresses and CIDR ranges in the same list.
You can use uppercase or lowercase characters for IPv6 addresses in lists. However, when you save the list, uppercase characters are converted to lowercase.
CSV file format
When uploading a CSV file containing a list of IP addresses and optional descriptions, use the following format for each item (enter one item per line):
<IP_ADDRESS_1>,<DESCRIPTION_1><IP_ADDRESS_2>