Performance Zen

Blog

  • Enterprise Shield — ASN Blocklist – 2026 08 25

    For those of you who are interested, my current list of blocked hosting ASNs is listed below. This list is current as of 23:00 UTC.

    PLEASE NOTE: This list does not include the following ASNs.

    8075	# Microsoft Azure
8069	# Microsoft Corporation (AS8069)
14618	# Amazon AWS (us-east-1)
16509	# Amazon AWS (multi-region)
31898	# Oracle Cloud Infrastructure
396982	# Google Cloud Platform
13335	# Cloudflare (primary)
132892	# Cloudflare (secondary)
14789	# Cloudflare (secondary)
63949	# Linode / Akamai
207825	# Marginalia Search (Datarymden Internet AB, SE)

    The above ASNs are managed by separate rulesets as some of the traffic is valid and I want it to hit the server. The ASNs in the blocklist do not have any traffic of interest and are set to DROP at the firewall.

    # ===========================================================================
# TRANSIT / BACKBONE
# Large transit carriers. Review carefully — blocking these can cause
# collateral damage to legitimate traffic from downstream customers.
# ===========================================================================

174       # Cogent Communications (US) — major transit
1299      # Arelion Sweden AB — Tier 1 backbone
3209      # Vodafone Germany
3257      # GTT Communications Inc. (US)
6939      # Hurricane Electric (US) — large transit, review if needed
7979      # SoftLayer / IBM Cloud
11042     # Network Transit Holdings LLC (US)


# ===========================================================================
# CHINESE STATE CARRIERS & TECH GIANTS
# ===========================================================================

4134      # ChinaNet — China Telecom backbone
4811      # China Telecom (Group) — Shanghai MAN
4831      # China Telecom (CTTNET)
4837      # China Unicom (CNC Group)
9808      # China Mobile Communications Group Co., Ltd.
23724     # ChinaNet IDC Beijing (CN)
24445     # Henan Mobile Communications Co. Ltd (CN)
37963     # Alibaba Cloud (Aliyun) — mainland China
38365     # Baidu — Beijing Baidu Netcom Science and Technology Co., Ltd.
45102     # Alibaba Cloud APAC
58461     # CT-HangZhou-IDC (CN)
63199     # CDS Global Cloud Co., Ltd (CN/HK)
132203    # Tencent Cloud
136907    # Huawei Cloud
138699    # TikTok Pte. Ltd. (SG/CN)
200350    # YandexCloud — Yandex.Cloud LLC
211443    # Sino Worldwide Trading Limited (HK)
214669    # Starlight Tech Trading Co. Limited (HK)
396986    # Bytedance Inc. (US/CN)
17497     # liasail global hongkong limited (HK) — auto-classified 2026-08-21
205369    # LI YIRAN (CN) — auto-classified 2026-08-21
208525    # Airu Limited (HK) — auto-classified 2026-08-21
209109    # DataSphere (H.K) Limited (HK) — auto-classified 2026-08-21
214454    # PoloNetwork Limited (HK) — auto-classified 2026-08-21
219300    # Yan Xiangdong (CN) — auto-classified 2026-08-21
55967     # Beijing Baidu Netcom Science and Technology Co., Ltd. (CN) — auto-classified 2026-08-21
138915    # Kaopu Cloud HK Limited (HK) — auto-classified 2026-08-21

# ===========================================================================
# RUSSIAN / CIS CARRIERS & HOSTING
# ===========================================================================

12389     # Rostelecom (Russia) — state carrier
33993     # UFO Hosting LLC (RU)
35048     # Biterika Group LLC (RU)
41853     # LLC NTCOM (RU)
44050     # Petersburg Internet Network Ltd (RU)
45055     # Dontechsvyaz LLC (RU)
47913     # Moshonkin Ilia Sergeevich (RU)
48030     # Martynova Irina Nikolaevna (RU) — private operator
48031     # Ivanov Vitaliy Sergeevich (RU) — private operator
48043     # Ozyorsk Telecom CJSC (RU)
48467     # Pronet LLC (RU)
48507     # LTD SibMediaFon (RU)
48515     # Praktika Ltd (RU)
49505     # JSC Selectel (RU)
197695    # REG.RU (RU)
200328    # Bakhtin Evgenii Valerevich (RU)
202269    # BitCommand LLC (AM)
205196    # BIG CORE LLC (RU)
209946    # ALINDA LLC (RU)
210644    # AEZA GROUP LLC (RU)
9123      # JSC "TIMEWEB" (RU) — auto-classified 2026-08-21
211399    # KPD group OOO (RU) — auto-classified 2026-08-21
199514    # ILIA KALASHNIKOV (RU) — auto-classified 2026-08-21
204353    # TM226-AS (RU) — auto-classified 2026-08-21
58347     # AiK LLC (RU) — auto-classified 2026-08-25

# ===========================================================================
# CENTRAL ASIA
# ===========================================================================

8193      # Uzbektelekom Joint Stock Company (UZ)
8200      # Uplink LLC (KZ)
35682     # Best Internet Solution (UZ)
48716     # PS Internet Company LLP (KZ)
#203044    # Telepatiya Ltd (KZ)
203087    # Fedinyak Sergey Vyacheslavovich (KZ)
210006    # Shereverov Marat Ahmedovich (KZ)
210976    # Timeweb LLP (KZ)

203534    # Erik Omarov (KZ) — auto-classified 2026-08-21

# ===========================================================================
# EASTERN EUROPE / UKRAINE / BALTICS
# ===========================================================================

24651     # JSC BALTICOM (LV)
30860     # Virtual Systems LLC (UA)
42159     # Zemlyaniy Dmitro Leonidovich (UA) — private operator
56851     # PE Skurykhin Mukola Volodumurovuch (UA)
204957    # GREEN FLOID LLC (UA)
209630    # LLC VASH KREDIT BANK (UA)
211736    # FOP Dmytro Nedilskyi (UA)

39845     # 2 Cloud Ltd. (LV) — auto-classified 2026-08-21
219268    # Geodema Group LLC (UA) — auto-classified 2026-08-21

# ===========================================================================
# MIDDLE EAST
# ===========================================================================

8697      # Jordan Telecommunications PSC (JO)
9038      # BATELCO / Al Bahrainia al Urdunia (JO/BH)
201771    # Arabian Internet & Communications Services Co. Ltd (SA)
202670    # CLOUDZME FZE (UAE)
211273    # Cloud Software FZCO (UAE)
216154    # CLODO CLOUD SERVICE CO. L.L.C (UAE)
44709     # O.M.C. COMPUTERS & COMMUNICATIONS LTD (IL) — auto-classified 2026-08-21
200236    # Saif Mohammed Alashram trading as Privacy Cloud Service & Datacenters Providers (AE) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Israel
# ---------------------------------------------------------------------------

206446    # CLOUD LEASE Ltd (IL)


# ===========================================================================
# TURKEY
# ===========================================================================

9121      # Turk Telekomunikasyon Anonim Sirketi (TR)
12735     # TurkNet (TR)
205733    # HOSTIFOX Bilisim Hizmetleri (TR)
208913    # Kitsune Bilisim Sistemleri (TR)
211557    # TAYNET TEKNOLOJI TICARET LIMITED SIRKETI (TR)
212193    # VIVA INTERNET LIMITED SIRKETI (TR) — active attack detected 2026-04-07
213407    # Uzmansoft Bilisim Web Yazilim Hizmetleri (TR)
213488    # Inoxweb Datacenter ve Hosting (TR)
214000    # Voxnet Bilisim Teknolojileri (TR)


# ===========================================================================
# CLOUD / HYPERSCALER INFRASTRUCTURE
# Broad blocks — may affect legitimate SaaS/B2B traffic.
# ===========================================================================

2639      # Zoho Corporation
#8075      # Microsoft Azure — managed via hyperscalers.conf
#14618     # Amazon AWS (us-east-1) — managed via hyperscalers.conf
#16509     # Amazon AWS (multiple regions) — managed via hyperscalers.conf
#31898     # Oracle Cloud Infrastructure — managed via hyperscalers.conf
208172    # Proton AG (CH) — VPN/privacy provider
#396982    # Google Cloud Platform (GCP) — NOTE: AS15169 (Google Search/crawlers)
          #   is excluded. This ASN covers GCP third-party hosted services.
          #   Block specific /cidr ranges instead of this ASN if possible.


# ===========================================================================
# SOCIAL MEDIA PLATFORMS
# Blocked to prevent platform crawler / scraper traffic.
# ===========================================================================

32934     # Facebook Inc. (Meta)
54115     # Facebook Inc. (Meta) — ASN 2
63293     # Facebook Inc. (Meta) — ASN 3


# ===========================================================================
# EUROPEAN HOSTING & VPS PROVIDERS
# ---------------------------------------------------------------------------
# France
# ---------------------------------------------------------------------------

12876     # Scaleway SAS (FR)
16276     # OVHcloud (FR)
30781     # Free Pro SAS (FR)
203476    # GANDI SAS (FR)
#208046    # KOGLER Gabin (FR) — small operator
210403    # Groupe LWS SARL (FR)
210743    # Babbar SAS (FR) — SEO crawler
211590    # Bucklog SARL (FR)
213412    # ONYPHE SAS (FR) — active security scanner
204818    # Hosteur SAS (FR) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Germany
# ---------------------------------------------------------------------------

6724      # Strato GmbH (DE)
8560      # IONOS SE / 1&1 (DE)
8972      # Host Europe GmbH (DE) — GoDaddy EMEA
12574     # Hosting.de GmbH (DE)
12816     # Leibniz-Rechenzentrum (DE) — NOTE: university/research network, review
21013     # eww ag (AT/DE)
21499     # Host Europe GmbH (DE)
24940     # Hetzner Online GmbH (DE) — ASN 1 of 3
24961     # WIIT AG (DE/CH)
28753     # Leaseweb Deutschland GmbH (DE)
29066     # velia.net Internetdienste GmbH (DE/FR)
29550     # Team Blue Carrier Limited (UK/DE)
30823     # aurologic GmbH (DE)
34081     # INCUBATEC GmbH – Srl (DE/IT)
34549     # meerfarbig GmbH & Co. KG (DE)
42237     # w1n ltd (DE)
42366     # TerraTransit AG (DE)
42525     # GlobalConnect A/S (DE) — see also ASN 12552 (SE), 8896 (NO)
51167     # Contabo GmbH (DE)
51396     # Pfcloud UG (DE)
58212     # dataforest GmbH (DE)
61157     # PlusServer GmbH (DE)
141995    # Contabo Asia Private Limited
197540    # netcup GmbH (DE)
198139    # Lucas Vossberg (DE) — private operator
200373    # 3xK Tech GmbH (DE)
203516    # AltunHOST LTD (UK/DE)
204646    # web2objects GmbH (DE)
205948    # creoline GmbH (DE)
206996    # ZAP-Hosting GmbH (DE)
210558    # 1337 Services GmbH (DE) — privacy/anonymous hosting
210785    # KAPELAN Medien GmbH (DE)
212317    # Hetzner Online GmbH (DE) — ASN 3 of 3
213230    # Hetzner Online GmbH (DE) — ASN 2 of 3
215607    # dataforest GmbH (DE) — ASN 2
215859    # Hetzner Online GmbH (DE) — ASN 4
31103     # Keyweb AG (DE) — auto-classified 2026-08-22
214996    # netcup GmbH (DE) — auto-classified 2026-08-22
35042     # Layer7 Networks GmbH (DE) — auto-classified 2026-08-21
45012     # dogado GmbH (DE) — auto-classified 2026-08-21
213250    # Dominic Scholz trading as ITP-Solutions GmbH & Co. KG (DE) - 2026-08-21

# ---------------------------------------------------------------------------
# Austria
# ---------------------------------------------------------------------------

42473     # ANEXIA Internetdienstleistungs GmbH (AT)
64457     # Matteo Fruhwald trading as PipeHost e.U. (AT)
40994     # Hohl IT e.U. (AT) — auto-classified 2026-08-21
57169     # EDIS GmbH (AT) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Switzerland
# ---------------------------------------------------------------------------

29222     # Infomaniak Network SA (CH)
51852     # Private Layer INC (CH) — privacy hosting
61098     # Akenes SA / Exoscale (CH)
209373    # SWISSNET LLC (CH/Global)
1836      # green.ch AG (CH) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Sweden
# ---------------------------------------------------------------------------

12552     # GlobalConnect AB (SE) — see also ASN 8896 (NO), 42525 (DE)
30893     # No ACK Group Holding AB (SE)
39351     # 31173 Services AB (SE)
42708     # Portlane AB (SE)
51747     # Internet Vikings International AB (SE)
212220    # Kepler Technologies AB (SE)
214503    # QuxLabs AB (SE)
59437     # Northern Data AG (DE) — auto-classified 2026-08-21
13116     # Tele2 Sverige AB (SE) — auto-classified 2026-08-21
207825    # Datarymden Internet AB (SE) — auto-classified 2026-08-21
33837     # Fredrik Holmqvist (SE) — auto-classified 2026-08-21
62395     # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203297    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
202910    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
202922    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
16312     # Internet Vikings International AB (SE) — auto-classified 2026-08-21
51913     # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203191    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203192    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203193    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203194    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203213    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203240    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203241    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203295    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203298    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203300    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203552    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203605    # Synotio AB (SE) — auto-classified 2026-08-21
203610    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203625    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203800    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203814    # Internet Vikings International AB (SE) — auto-classified 2026-08-21
203839    # Internet Vikings International AB (SE) — auto-classified 2026-08-21


# ---------------------------------------------------------------------------
# Norway
# ---------------------------------------------------------------------------

8896      # GlobalConnect AS (NO) — see also ASN 12552 (SE), 42525 (DE)
50304     # Blix Solutions AS (NO)
56655     # Gigahost AS (NO) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Netherlands
# ---------------------------------------------------------------------------

1101      # IP-EEND BV (NL)
20857     # TransIP BV / Signet B.V. (NL) — ASN 2 of 2
35470     # Signet B.V. (NL) — ASN 1 of 2
39572     # DataWeb Global Group B.V. (NL)
39704     # CJ2 Hosting B.V. (NL)
43350     # NForce Entertainment BV (NL)
48137     # PI-GROUP BV (NL)
49453     # Global Layer BV (NL)
49532     # Eonix Corporation / ServerHub (NL)
49981     # WorldStream B.V. (NL)
50077     # SYN LTD (NL)
51430     # AltusHost B.V. (NL)
57043     # HOSTKEY B.V. (NL)
60404     # Liteserver / The Infrastructure Group B.V. (NL)
60781     # LeaseWeb Netherlands BV (NL)
201176    # DUND MC2 B.V. (NL)
207179    # WilroffReitsma B.V. (NL)
209847    # WorkTitans B.V. (NL)
211381    # Podaon SIA (LV/NL)
215125    # Church of Cyberology (NL) — privacy/anonymity hosting
215747    # NubaCloud B.V. (NL)
216472    # HS-SYR High Speed For Internet Services L.L.C (NL)
209334    # Modat B.V. (NL) — auto-classified 2026-08-21
198478    # Alireza Mirzaei Fard (NL) — auto-classified 2026-08-21
204729    # Xaviero Xaviel Kajafas trading as Internalhost (NL) — 2026-08-21
209675    # Jelle Hofstee trading as AxisNetworks (NL) — auto-classified 2026-08-21
212953    # Bas Dierx Trading As CableHosting (NL) — auto-classified 2026-08-21
34343     # Eweka Internet Services B.V. (NL) — auto-classified 2026-08-21
197902    # Hostnet B.V. (NL) — auto-classified 2026-08-21
24875     # NovoServe B.V. (NL) — auto-classified 2026-08-21
34305     # Base IP B.V. (NL) — auto-classified 2026-08-21
49870     # Alsycon B.V. (NL) — auto-classified 2026-08-21
205467    # Base IP B.V. (NL) — auto-classified 2026-08-21
214783    # Danny Nieuwenhuis trading as DedicatedNodes (NL) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# United Kingdom
# ---------------------------------------------------------------------------

9009      # M247 Europe (UK/EU)
11721     # StylenTech LLC (UK)
12488     # Krystal Hosting Ltd (UK)
13213     # UK-2 Limited / Iomart (UK)
14670     # WHG Hosting Services Ltd (UK) — ASN 4 of 4
20738     # Heart Internet Ltd (UK)
20860     # IOMART Cloud Services Limited (UK)
41281     # KeFF Networks Ltd (UK)
41564     # Orion Network Limited (UK) — ASN 1 of 2
42831     # UK Dedicated Servers Limited (UK)
43357     # Owl Limited (UK)
46805     # Angelnet Limited (UK) — ASN 4 of 4
49592     # Pipe Networks LTD (UK)
49683     # MASSIVEGRID LTD (UK)
50300     # CustodianDC Limited (UK)
51713     # WHG Hosting Services Ltd (UK) — ASN 1 of 4
57858     # Angelnet Limited (UK) — ASN 3 of 4
58065     # Orion Network Limited (UK) — ASN 2 of 2
62240     # Clouvider Ltd (UK) — ASN 2 of 2
62651     # Strong Technology, LLC. (UK/US)
63119     # Angelnet Limited (UK) — ASN 2 of 4
199404    # WHG Hosting Services Ltd (UK) — ASN 2 of 4
201579    # HostGnome Ltd (UK)
203446    # Smartnet Limited (UK)
203520    # 3xK Tech GmbH (UK)
204800    # WHG Hosting Services Ltd (UK) — ASN 3 of 4
206092    # F.N.S. Holdings Limited (UK)
206804    # EstNOC OU (EE/UK)
207569    # I-SERVERS LTD (UK)
207957    # Serv.Host Group Ltd (UK)
209242    # Clouvider Ltd (UK) — ASN 1 of 2
211298    # Driftnet Ltd (UK) — security scanner / honeypot operator
212286    # LonConnect Ltd (UK)
213702    # QWINS LTD (UK)
213887    # WAIcore Ltd (UK)
214238    # HOST TELECOM LTD (UK)
214716    # WEYRO LTD (UK)
#215215    # Freakhosting Ltd (UK)
215540    # Global Connectivity Solutions LLP (UK)
215703    # FREAKHOSTING LTD (UK)
206134    # NEKOBYTE INTERNATIONAL LIMITED (GB) — auto-classified 2026-08-21
209693    # OC NETWORKS LIMITED (GB) — auto-classified 2026-08-21
205544    # Leaseweb UK Limited (GB) — auto-classified 2026-08-21
203919    # LUMADOCK LTD (GB) — auto-classified 2026-08-21
207096    # Link Web Solutions LLP (GB) — auto-classified 2026-08-21
4785      # xTom Limited (GB) — auto-classified 2026-08-21
215286    # IXROOT LTD (GB) — auto-classified 2026-08-21
204044    # Packet Star Networks Limited (GB) — auto-classified 2026-08-21
216014    # BestDC Limited (GB) — auto-classified 2026-08-21
197595    # SEEKAHOST TECHNOLOGIES LTD (GB) — auto-classified 2026-08-21
202147    # VPSUS LTD (GB) — auto-classified 2026-08-21
209149    # SEEKAHOST LTD (GB) — auto-classified 2026-08-21
209710    # SNRD NETWORKS LIMITED (GB) — auto-classified 2026-08-21
209809    # ROCO HOST LTD (GB) — auto-classified 2026-08-21
213549    # SATISFYHOST LTD (GB) — auto-classified 2026-08-21
215674    # Brookplus Limited (GB) — auto-classified 2026-08-21
219412    # Lewis Brown (GB) — auto-classified 2026-08-21
216039    # EdgeSec Technologies Limited (GB) — auto-classified 2026-08-21
60064     # HOSTPALACE DATACENTERS LTD (GB) — auto-classified 2026-08-21
203363    # Kuroit Limited (GB) — auto-classified 2026-08-21
61112     # AKILE LTD (GB) — auto-classified 2026-08-21
209723    # EXPERT NETCLOUD LLP (GB) — auto-classified 2026-08-21
215590    # DpkgSoft International Limited (GB) — auto-classified 2026-08-21
203758    # EUGAMEHOST LTD (GB) — auto-classified 2026-08-21
215925    # VPSVAULT.HOST LTD (GB) — auto-classified 2026-08-21
207043    # DEDIK SERVICES LIMITED (GB) — auto-classified 2026-08-21
209413    # DEDIK SERVICES LIMITED (GB) — auto-classified 2026-08-21
61323     # ANS ACADEMY LIMITED (GB) — auto-classified 2026-08-21
216180    # WHG Hosting Services Ltd (GB) — auto-classified 2026-08-21
219464    # FORESTSNET LTD (GB) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Ireland
# ---------------------------------------------------------------------------

30900     # Sternforth Ltd. trading as WebWorld (IE)
39122     # Blacknight Internet Solutions Limited (IE)
212353    # Crelativity Limited (IE) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Iceland
# ---------------------------------------------------------------------------

200651    # FlokiNET ehf (IS) — privacy hosting

# ---------------------------------------------------------------------------
# Poland
# ---------------------------------------------------------------------------

15967     # Nazwa.pl Sp.z.o.o. (PL)
29522     # Cyber_Folks S.A. (PL) — ASN 1 of 2 (fka CF-KRK)
31229     # Beyond.pl sp. z o.o. (PL)
34360     # Cyber_Folks S.A. (PL) — ASN 2 of 2 (fka OGICOM)
41079     # Cyber_Folks S.A. (PL) — ASN 3
43641     # Sollutium EU Sp. z o.o. (PL)
47544     # IQ PL Sp. z o.o. (PL)
48047     # Krakowskie Centrum Przetwarzania Danych (PL)
48505     # Kylos sp. z o.o. (PL)
50599     # DATASPACE P.S.A. (PL)
56511     # GAMP Sp. z o.o. (PL)
201814    # MEVSPACE sp. z o.o. (PL)
204444    # LanTech Piotr Pilek (PL)
210100    # Adam Chodkowski (PL) — auto-classified 2026-08-21
210146    # Dawid Lewandowski (PL) — auto-classified 2026-08-21
207208    # MEVSPACE sp. z o.o. (PL) — auto-classified 2026-08-21
42927     # S-NET Sp. z o.o. (PL) — auto-classified 2026-08-25

# ---------------------------------------------------------------------------
# Lithuania
# ---------------------------------------------------------------------------

47583     # Hostinger International (LT)
133944    # trafficforce UAB (LT) — ASN 2 of 2
198651    # HOSTLINE, UAB (LT)
201341    # trafficforce UAB (LT) — ASN 1 of 2
202044    # Getechbrothers, MB (LT)
203061    # UAB code200 (LT) — ASN 2 of 2
203098    # trafficforce, UAB (LT) — ASN 3
204770    # UAB Cherry Servers (LT) — ASN 1 of 2
205964    # UAB code200 (LT) — ASN 3
209605    # UAB Host Baltic (LT)
209709    # UAB code200 (LT) — ASN 1 of 2
210906    # UAB Bite Lietuva (LT)
213896    # UAB Cherry Servers (LT) — ASN 2 of 2
214159    # UAB Cherry Servers (LT) — ASN 3
59642     # UAB "Cherry Servers" (LT) — auto-classified 2026-08-21
61272     # UAB Bacloud (LT) — auto-classified 2026-08-21
16125     # UAB "Cherry Servers" (LT) — auto-classified 2026-08-21
212531    # UAB "Interneto vizija" (LT) — auto-classified 2026-08-21
211373    # Simoresta UAB (LT) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Estonia
# ---------------------------------------------------------------------------

3920      # PUSHPKT OU (EE)
61189     # Elkdata OU (EE)
203273    # NetCrafters OU (EE) — auto-classified 2026-08-21
62005     # BlueVPS OU (EE) — auto-classified 2026-08-21
61254     # ESTOXY OU (EE) — auto-classified 2026-08-25

# ---------------------------------------------------------------------------
# Czech Republic
# ---------------------------------------------------------------------------

15685     # CASABLANCA INT a.s. (CZ)
24641     # FASTER CZ spol. s r.o. (CZ)
29278     # Rackhost Zrt. (CZ/HU)
39392     # SH.cz s.r.o. / SuperNetwork (CZ)
43037     # Seznam.cz a.s. (CZ) — search engine / scanner
61424     # eServer s.r.o. (SK/CZ)
197806    # Andrei Rys (CZ) — auto-classified 2026-08-21
204150    # David Zakoucky (CZ) — auto-classified 2026-08-21
25234     # ACTIVE 24, s.r.o. (CZ) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Hungary
# ---------------------------------------------------------------------------

56322     # ServerAstra Kft. (HU)
206892    # Rendszerinformatika Zrt. (HU)
62214     # Rackforest Zrt. (HU) — auto-classified 2026-08-21
47381     # Servergarden Kft. (HU) — auto-classified 2026-08-22

# ---------------------------------------------------------------------------
# Italy
# ---------------------------------------------------------------------------

31034     # Aruba S.p.A. (IT)
60798     # Servereasy Srl (IT)
212271    # Cinzia Tocci trading as Lumanex Srl (IT) — auto-classified 2026-08-21
20836     # CDLAN SpA (IT) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Spain
# ---------------------------------------------------------------------------

16371     # acens AS (ES)
41608     # NextGenWebs S.L. (ES)
42220     # TREVENQUE SISTEMAS DE INFORMACION S.L. (ES)
43578     # bitNAP (ES)
49635     # Cloudi Nextgen SL (ES)
50926     # AXARNET Comunicaciones S.L. (ES)

# ---------------------------------------------------------------------------
# Portugal
# ---------------------------------------------------------------------------

24768     # ALMOUROLTEC Servicos de Informatica e Internet Lda (PT)

# ---------------------------------------------------------------------------
# Denmark
# ---------------------------------------------------------------------------

44803     # Webdock.io ApS (DK)
48854     # team.blue Denmark A/S (DK)
57860     # Zencurity ApS (DK) — security research / scanning
214902    # Philip Fjaera trading as PFWeb Solutions (DK)

# ---------------------------------------------------------------------------
# Romania
# ---------------------------------------------------------------------------

#206305    # SC ITNS.NET SRL (RO)
208137    # Feo Prest SRL (RO)
212810    # GODLIKE DIGITAL SOLUTIONS S.R.L. (RO)
205941    # Lungu Stefan Gabriel (RO) — auto-classified 2026-08-21
210622    # Kicked SRL (RO) — auto-classified 2026-08-21
213590    # DIGITALRUS SRL (RO) — auto-classified 2026-08-21
49468     # MAGIT'ST SRL (RO) — auto-classified 2026-08-21
39287     # Materialism s.r.l. (RO) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Moldova
# ---------------------------------------------------------------------------

43289     # Trabia SRL (MD)
#44477     # PQ Hosting Plus S.R.L. (MD) — Stark Industries affiliate
200019    # ALEXHOST SRL (MD)

# ---------------------------------------------------------------------------
# Cyprus
# ---------------------------------------------------------------------------

202448    # MVPS LTD (CY)
214504    # Hostman LTD (CY) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Belgium
# ---------------------------------------------------------------------------

59943     # Level 27 BVBA (BE)

# ---------------------------------------------------------------------------
# Luxembourg
# ---------------------------------------------------------------------------

199524    # G-Core Labs S.A. (LU)
202422    # G-Core Labs S.A. (LU) — ASN 2

# ---------------------------------------------------------------------------
# North Macedonia
# ---------------------------------------------------------------------------

48057     # ITV DOOEL Skopje (MK)

# ---------------------------------------------------------------------------
# Serbia
# ---------------------------------------------------------------------------

35779     # mCloud doo (RS)
51859     # Mainstream doo Beograd (RS)

# ---------------------------------------------------------------------------
# Multi-region / unspecified EU
# ---------------------------------------------------------------------------

14576     # Hosting Solution Ltd.
26141     # CubePath
#48024     # NEROCLOUD LTD
48090     # TECHOFF SRV LIMITED — Team Cymru C2 confirmed
51247     # Serverio technologijos MB (LT/NL)
59651     # AS QualityNetwork (Global)
60068     # CDN77 / Datacamp Limited
64160     # NimblyNet Limited (BZ/Global)
204240    # REXE
206238    # Unknown — review recommended
206264    # Amarutu Technology Ltd
202412    # Omegatech LTD
203003    # Magna Capax Finland Oy (FI/EU)
207567    # Intezio Worldwide Limited
210457    # Kyonix Networks Limited
212238    # Datacamp Limited (multi-region)
213535    # YottaSrc
213755    # LUNORY CLOUD SOLUTIONS LTD
213790    # Limited Network LTD
214639    # TakeHost.Biz (EU)
215439    # PLAY2GO INTERNATIONAL LIMITED
215730    # H2NEXUS LTD
216071    # SERVERS TECH FZCO (UAE/NL)

50091     # Negenet shpk (AL) — auto-classified 2026-08-21
209378    # Inios Oy (FI) — auto-classified 2026-08-21
44901     # Belcloud LTD (BG) — auto-classified 2026-08-21
59711     # HZ Hosting Ltd (BG) — auto-classified 2026-08-21
203380    # DA International Group Ltd. (BG) — auto-classified 2026-08-21
210250    # K Media Tech Ltd. (BG) — auto-classified 2026-08-21
29210     # Internews 98 OOD (BG) — auto-classified 2026-08-21

# ===========================================================================
# LEASEWEB GROUP
# Consolidated here — operates across multiple countries / ASNs.
# ===========================================================================

7203      # Leaseweb USA Inc. (US) — ASN 4 of 7
19148     # Leaseweb USA Inc. (US) — ASN 5 of 7
27411     # Leaseweb USA Inc. (US) — ASN 6 of 7
30633     # Leaseweb USA (US) — ASN 1 of 7
32613     # Leaseweb Canada Inc. (CA)
393886    # Leaseweb USA Inc. (US) — ASN 7 of 7
394380    # Leaseweb USA Inc. (US) — ASN 3 of 7
395954    # Leaseweb USA (US) — ASN 2 of 7
396190    # Leaseweb USA Inc. (US) — ASN 8 of 7
396362    # Leaseweb USA (US) — ASN 3 of 3


# ===========================================================================
# GMO INTERNET GROUP / SAKURA (JAPAN)
# ===========================================================================

7506      # INTERQ — GMO Internet Group Inc. (JP)
7684      # SAKURA Internet Inc. (JP) — ASN 2 of 2
9370      # SAKURA Internet Inc. (JP) — ASN 1 of 2
58791     # GMO Internet Group Inc. (JP) — ASN 2
131921    # GMO GlobalSign Holdings K.K. (JP)
131965    # Xserver Inc. (JP)

3258      # xTom Japan Corporation (JP) — auto-classified 2026-08-21

# ===========================================================================
# US & NORTH AMERICAN HOSTING / VPS PROVIDERS
# ===========================================================================

7393      # CYBERCON INC. (US)
7489      # HostUS (US)
9115      # Internet Names for Business Inc. (CA) — ASN 1 of 2
10439     # CariNet Inc. (US)
10557     # Connect Northwest Internet Services LLC (US)
11320     # LightEdge Solutions (US)
11706     # Telefônica Brasil S.A (US-registered)
11798     # Ace Data Centers Inc. (US)
11878     # tzulo inc. (US)
13332     # Hype Enterprises (US)
13627     # Ambyre LLC (US)
13768     # Aptum Technologies (CA)
14061     # DigitalOcean LLC (US)
14131     # DataYard (US)
14555     # LiquidNet US LLC (US)
14956     # RouterHosting LLC (US)
15003     # Nobis Technology Group (US)
15817     # Robert Meyer trading as Mittwald CM Service GmbH & Co. KG (US/DE)
16628     # DedFiberCo (US)
18450     # WebNX Inc. (US)
18501     # CyberCloud Professionals LLC (US)
19084     # ColoUp (US)
19318     # Interserver Inc. (US)
20278     # Nexeon Technologies Inc. (US)
20454     # SECURED SERVERS LLC (US)
20473     # Vultr / AS-CHOOPA (US)
21769     # Colocation America Corporation (US)
21859     # Zenlayer Inc. (US) — ASN 1 of 2 — see also AS4229
22295     # Advin Services LLC (US)
22439     # Perfect International Inc. (US)
22611     # InMotion Hosting Inc. (US) — ASN 1 of 2
22612     # Namecheap Inc. (US)
22363     # Powerhouse Management Inc. (US)
23033     # Wowrack.com (US)
23352     # DEFT.COM / ServerCentral (US)
23470     # ReliableSite.Net LLC (US)
25820     # IT7 Networks Inc. (CA)
26347     # DreamHost (US)
26464     # Joyent Inc. (US)
26496     # GoDaddy.com LLC (US)
26548     # PureVoltage Hosting Inc. (US)
26658     # HENGTONG-IDC-LLC (US)
27257     # Webair Internet Development Company Inc. (US)
27589     # MOJOHOST (US)
29802     # HIVELOCITY Inc. (US) — ASN 1 of 2
29873     # Newfold Digital Inc. (US)
30058     # FDCservers.net (US)
30447     # Internet Names For Business Inc. (CA) — ASN 2 of 2
32097     # WholeSale Internet Inc. (US)
32244     # Liquid Web LLC (US)
32489     # Amanah Tech Inc. (CA)
33182     # HostDime.com Inc. (US)
35916     # Multacom Corporation (US)
36007     # Kamatera Inc. (US)
36352     # ColoCrossing (US)
36444     # Liquid Web / Nexcess-Net LLC (US)
36530     # IDC Cube (US)
36680     # Netiface LLC (US) — ASN 1 of 3
40021     # Contabo Inc. (US)
40065     # CNSERVERS LLC (US)
40300     # DR Fortress LLC (US)
40676     # Psychz Networks (US)
46261     # QuickPacket LLC (US)
46475     # Limestone Networks Inc. (US)
46562     # Performive LLC (US)
46606     # UNITAS Global (US)
46844     # Sharktech (US)
46873     # Host Color (US)
46918     # GlobalHostingSolutions Inc. (US)
46995     # Jump Wireless LLC (US)
50053     # VPS Dedicated LLC (US)
50219     # Valence Technology Co. (US)
50245     # Serverel Inc. (US)
53514     # UHQ Services LLC (US)
53667     # FranTech Solutions / BuyVM (US)
53755     # Input Output Flood LLC (US)
54600     # PEG TECH INC (US)
54641     # InMotion Hosting Inc. (US) — ASN 2 of 2
55286     # B2 Net Solutions / ServerCheap (US)
61317     # Hivelocity LLC (US) — ASN 2 of 2
62468     # VpsQuan L.L.C. (US)
62610     # Zenlayer Inc. (US) — ASN 2 of 2
62633     # HostRush / ServerCheap (US)
62874     # Web2Objects LLC (US)
62904     # Eonix Corporation (US)
63023     # GTHost (US)
63150     # BAGE CLOUD LLC (US)
63410     # PrivateSystems Networks (US)
#63949     # Linode / Akamai (US) — managed via hyperscalers.conf
64200     # VIVID-HOSTING LLC (US)
64249     # Charles River Operation (US)
64267     # Sprious LLC (US) — proxy / hosting
64286     # LogicWeb Inc. (US)
146943    # Tier 4 Cloud Services (US)
149042    # Silicon Cloud Global (US)
150303    # SoloRDP (IN Company — US Registered)
197769    # VPS Dedicated LLC (US)
202015    # HZ Hosting Ltd (US)
202425    # IP Volume Inc. (US)
205775    # NEON CORE NETWORK LLC (US)
205759    # Ghosty Networks LLC (US)
206715    # UXHOST LTD (US)
209372    # WS Telecom Inc (US)
209641    # IHOR HOSTING LTD (US)
213954    # Global Transit Systems LLC (US)
214036    # Ultahost Inc. (US)
214481    # Wojciech Czapkowicz (US/PL)
215161    # Michael Vassileiou trading as DATAHOST (US)
215402    # Asadov Ruslan Rafaelevich (US)
393577    # Tritan Development (US)
394474    # WhiteLabelColo (US)
395092    # Shock Hosting LLC (US)
396073    # Majestic Hosting Solutions LLC (US)
396319    # Oxylabs (LT) — proxy / scanner network
396356    # Latitude.sh (US)
396998    # Path Network Inc. (US) — DDoS mitigation
397032    # SPARKED HOST LLC (US)
397423    # Tier.Net Technologies LLC (US)
398019    # Dynu Systems Incorporated (US)
398256    # Ultahost Inc. (US) — ASN 2
398781    # Oculus Networks Inc. (US)
399073    # BUNNY TECHNOLOGY LLC (US) — CDN
399244    # AME Hosting LLC (US)
399275    # Solid Systems LLC (US)
399629    # BL Networks (US)
399804    # Hostodo (US)
400072    # THUNDERBOX INC (US)
400529    # Infraly LLC (US)
400587    # Ryamer LLC (US)
400810    # BreezeHost (US)
400940    # Railway (US) — cloud PaaS
401152    # Ace Data Centers II LLC (US)
401243    # Komi LLC (US)
401322    # NetO Corp (US)
401626    # Netiface America Inc. (US) — ASN 3 of 3
401696    # cognetcloud INC (US)
402226    # OnlyScans LLC (US)
402253    # SKN Subnet & Telecom Ltd (KN)
394814    # ISP4Life INC (US)
46516     # HostRoyale LLC (US) — auto-classified 2026-08-21
1004      # Ambyre LLC (US) — auto-classified 2026-08-21
401896    # MISIU LLC (US) — auto-classified 2026-08-21
29889     # Fast Serv Networks, LLC (US) — auto-classified 2026-08-21
63018     # Dedicated.com (US) — auto-classified 2026-08-21
23532     # IOVZ NETWORKS INC (US) — auto-classified 2026-08-21
397373    # H4Y Technologies LLC (US) — auto-classified 2026-08-21
200598    # Lunarnaut, LLC (US) — auto-classified 2026-08-21
36137     # PEG TECH INC (US) — auto-classified 2026-08-21
398823    # PEG TECH INC (US) — auto-classified 2026-08-21
398478    # PEG TECH INC (US) — auto-classified 2026-08-21
398993    # PEG TECH INC (US) — auto-classified 2026-08-21
62744     # Quintex Alliance Consulting (US) — auto-classified 2026-08-21
54548     # IONOS Cloud Inc. (US) — auto-classified 2026-08-21
47007     # Colocation America Corporation (US) — auto-classified 2026-08-21
26383     # Baxet Group Inc. (US) — auto-classified 2026-08-21
27176     # DataWagon LLC (US) — auto-classified 2026-08-21
46635     # AviationAI (US) — auto-classified 2026-08-21
39618     # HostCram LLC (US) — auto-classified 2026-08-21
61228     # BGP NETWORKS LLC (US) — auto-classified 2026-08-21
203607    # 1000119767 ONTARIO INC. (CA) — auto-classified 2026-08-21
203975    # Zorn Technologies LLC (US) — auto-classified 2026-08-21
204874    # SaaStack LLC (US) — auto-classified 2026-08-21
211673    # Mynymbox Hosting LLC (KN) — auto-classified 2026-08-21
214300    # Layer 4 Group LLC (US) — auto-classified 2026-08-21
214456    # ServerSP LLC (US) — auto-classified 2026-08-21
215731    # Novus Labs Limited (US) — auto-classified 2026-08-21
216044    # Terranode LLC (US) — auto-classified 2026-08-21
152918    # Liberally Network LLC (US) — auto-classified 2026-08-21
14315     # 1GSERVERS, LLC (US) — auto-classified 2026-08-21
49791     # Newserverlife LLC (US) — auto-classified 2026-08-21
40355     # Sundance International LLC (US) — auto-classified 2026-08-21
32002     # RackGenius (US) — auto-classified 2026-08-21
62164     # Heymman Servers Corporation (CA) — auto-classified 2026-08-21
40861     # Paradise Networks LLC (US) — auto-classified 2026-08-21
400463    # DynaNode LLC (US) — auto-classified 2026-08-21
3842      # InMotion Hosting, Inc. (US) — auto-classified 2026-08-21
61125     # SABOTAGE LLC (US) — auto-classified 2026-08-21
207847    # CloudBlast LLC (US) — auto-classified 2026-08-21
25653     # FortressITX (US) — auto-classified 2026-08-21
208483    # WERIDATA LLC (US) — auto-classified 2026-08-21
63473     # HostHatch, LLC (US) — auto-classified 2026-08-21
13649     # Flexential Colorado Corp. (US) — auto-classified 2026-08-21
19437     # SECURED SERVERS LLC (US) — auto-classified 2026-08-21
402215    # Devology Tech LLC (US) — auto-classified 2026-08-21
27640     # GIGAS HOSTING USA, LLC (US) — auto-classified 2026-08-22

# ===========================================================================
# LATIN AMERICAN CARRIERS & HOSTING
# ---------------------------------------------------------------------------
# Brazil
# ---------------------------------------------------------------------------

1916      # Rede Nacional de Ensino e Pesquisa (BR) — NOTE: academic/research network
17222     # Mundivox do Brasil Ltda (BR)
26599     # Telefônica Brasil S.A. (BR)
28573     # Claro NXT Telecomunicacoes Ltda (BR)
52368     # ZAM LTDA. (BR)
53107     # EVEO S.A. (BR)
53158     # Net Turbo Telecom (BR)
206971    # BedHosting BR — Datacenter No Brasil
262688    # MHNET Telecom (BR)
266572    # WORLDNET Telecomunicações (BR)
268136    # P J A Telecomunicacoes Ltda (BR)
268372    # WISESITE Comunicacao e Tecnologia (BR)
270716    # GOVISTA Telecomunicao Importacao Ltda (BR)
262287    # Unknown (BR) — auto-classified 2026-08-22

# ---------------------------------------------------------------------------
# Mexico
# ---------------------------------------------------------------------------

8151      # UNINET S.A. de C.V. (MX)
17072     # Total Play Telecomunicaciones S.A.P.I. de C.V. (MX)

# ---------------------------------------------------------------------------
# Caribbean
# ---------------------------------------------------------------------------

23520     # Columbus Networks USA Inc. — Caribbean operations (consistent abuse)
30689     # FLOW (JM)
197528    # Suibian Network LLC (VC) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Central America / Panama
# ---------------------------------------------------------------------------

18809     # Cable Onda (PA)
27947     # Telconet S.A. (EC)
48721     # Flyservers S.A. (PA — EU Hosted)
52449     # My Tech BZ (BZ)
52485     # networksdelmanana.com (HN)
141039    # PacketHub S.A. (PA) — ASN 2 of 2 (APAC-registered)
207137    # PacketHub S.A. (PA) — ASN 1 of 2
209854    # Cyberzone S.A. (PA)
263792    # IN.PLANET S.A. (EC)
263744    # Udasha S.A. (HN)
264750    # TELEOPERADORA DEL NORDESTE S.R.L. (DO)
264850    # TODAS LAS REDES SA (HN)
266827    # BOHO BEACH CLUB S.A. (HN/Global)
271935    # AIRTIME TECHNOLOGY SRL (DO)
263179    # Unknown (HN) — auto-classified 2026-08-21
136787    # PacketHub S.A. (PA) — auto-classified 2026-08-25

# ---------------------------------------------------------------------------
# South America
# ---------------------------------------------------------------------------

3132      # Red Cientifica Peruana (PE) — NOTE: academic/research network
21826     # Corporación Telemic C.A. (VE)
44382     # Fiba Cloud Operation Company LLC
52393     # Corporacion Dana S.A. (PA)
263735    # SOCIEDAD BUENA HOSTING, S.A. (LACNIC region)
263740    # Corporacion Laceibanetsociety (LACNIC region)
263753    # SERVICIOS DE DATACENTER DATANETWORKS LIMITADA (CL)
263821    # Soluciones Favorables (LACNIC region)


# ===========================================================================
# AFRICA
# ===========================================================================

37153     # xneelo (Pty) Ltd (ZA)
37611     # Afrihost SP (Pty) Ltd (ZA)
43444     # Fast Servers (Pty) Ltd (ZA/Global)
204300    # D2CLOUD NETWORK SERVICES (PTY) LTD (ZA)
204209    # Internet Magnate (Pty) Ltd (ZA)
329184    # Host Africa (Pty) Ltd (ZA)

36943     # 1 GRID (PTY) LTD (ZA) — auto-classified 2026-08-21

# ===========================================================================
# ASIA-PACIFIC HOSTING & TELECOM
# ---------------------------------------------------------------------------
# Japan — (GMO/SAKURA group consolidated above)
# ---------------------------------------------------------------------------
# Hong Kong
# ---------------------------------------------------------------------------

4760      # HKT Limited (HK)
9269      # Hong Kong Broadband Network Ltd. (HK)
38136     # Akari Networks (HK)
45753     # Netsec Limited (HK)
55933     # Cloudie Limited (HK)
132056    # SCICUBE (HK)
133380    # Layerstack Limited (HK)
135357    # Hong Kong Kowloon Telecommunications Co., Limited (HK)
135377    # UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
152194    # CTG Server Limited (HK)
153656    # OWGELS INTERNATIONAL CO., LIMITED (HK)
153671    # Liasail Global Hongkong Limited (HK)
212512    # Detai Prosperous Technologies Limited (HK)
213802    # Tianfeng (Hong Kong) Communications Limited (HK)
215929    # Data Campus Limited (HK)

# ---------------------------------------------------------------------------
# Singapore
# ---------------------------------------------------------------------------

9465      # AGOTOZ PTE. LTD. (SG)
135354    # NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD. (SG)
139341    # ACEVILLE PTE.LTD. (SG) — auto-classified 2026-08-21
142036    # Hosteons Pte. Ltd. (SG) — auto-classified 2026-08-21
59253     # LEASEWEB SINGAPORE PTE. LTD. (SG) — auto-classified 2026-08-21
154373    # Singapore Data Cloud Pte Ltd (SG) — auto-classified 2026-08-21
142002    # Scloud Pte Ltd (SG) — auto-classified 2026-08-25

# ---------------------------------------------------------------------------
# South Korea
# ---------------------------------------------------------------------------

5065      # Bunny Communications (KR)
45370     # BROADBANDIDC (KR)
212388    # Auraz Corporation Co.,Ltd. (KR) — auto-classified 2026-08-21
38661     # abcle (KR) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Malaysia
# ---------------------------------------------------------------------------

149440    # Evoxt Sdn. Bhd. (MY)
45839     # Shinjiru Technology Sdn Bhd (MY) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Vietnam
# ---------------------------------------------------------------------------

45899     # VNPT Corp (VN)
135951    # Webico Company Limited (VN)

# ---------------------------------------------------------------------------
# Indonesia
# ---------------------------------------------------------------------------

7713      # Telekomunikasi Indonesia PT (ID)
17451     # Biznet Networks (ID)
58487     # Rumahweb (ID)
141968    # PT Industri Kreatif Digital (ID)
150493    # PT Gunung Sedayu Sentosa (ID)
219215    # M. RIMBA ADHITYA A. (ID) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Bangladesh
# ---------------------------------------------------------------------------

23688     # Link3 Technologies Limited (BD)
38203     # ADN Telecom Ltd. (BD)
132817    # DZCRD Networks Ltd (BD)
139921    # JASHORE COLO (BD)
147053    # Bhaluka Broadband Internet Service (BD)
153038    # Business Zone Limited (BD)
#153168    # BengalCloud (BD)
153568    # NEW DHAKA HARDWARE (BD)

# ---------------------------------------------------------------------------
# Nepal
# ---------------------------------------------------------------------------

142065    # Wifi Nepal Private Limited (NP)

# ---------------------------------------------------------------------------
# Sri Lanka
# ---------------------------------------------------------------------------

9329      # Sri Lanka Telecom Internet (LK)

# ---------------------------------------------------------------------------
# Cambodia
# ---------------------------------------------------------------------------

38623     # Viettel Cambodia (KH)

# ---------------------------------------------------------------------------
# Taiwan
# ---------------------------------------------------------------------------

3462      # HiNet / Data Communication Business Group (TW)

# ---------------------------------------------------------------------------
# Thailand
# ---------------------------------------------------------------------------

56309     # Siamdata Communication Co. Ltd (TH)
134240    # Super Broadband Network Company Limited (TH)

# ---------------------------------------------------------------------------
# Mongolia
# ---------------------------------------------------------------------------

45237     # Magicnet LLC (MN)

# ---------------------------------------------------------------------------
# Georgia
# ---------------------------------------------------------------------------

16010     # Magticom Ltd. (GE)
47810     # Proservice LLC (GE)

# ---------------------------------------------------------------------------
# New Zealand
# ---------------------------------------------------------------------------

56030     # Voyager Internet Ltd. (NZ)

# ---------------------------------------------------------------------------
# Seychelles
# ---------------------------------------------------------------------------

213438    # ColocaTel Inc. (SC)
197170    # TechTies Inc. (SC) — auto-classified 2026-08-21
202959    # Lushu Limited (SC) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# India
# ---------------------------------------------------------------------------

24560     # Bharti Airtel Ltd. Telemedia Services (IN)
133499    # HostRoyale Technologies Pvt Ltd (IN) — ASN 1 of 5
134180    # Md. Shariful Islam T/A BRISK SYSTEMS (IN)
134291    # TECHNO FAQ DIGITAL MEDIA (IN)
134450    # HostRoyale Technologies Pvt Ltd (IN) — ASN 2 of 5
140947    # SnTHostings (IN)
142430    # DIGI VPS (IN)
#143586    # AYSTOR / Yanoor Islam Khan (IN)
203020    # HostRoyale Technologies Pvt Ltd (IN) — ASN 3 of 5
#203999    # Geekyworks IT Solutions Pvt Ltd (IN/US)
204287    # HostRoyale Technologies Pvt Ltd (IN) — ASN 4 of 5
207990    # HostRoyale Technologies Pvt Ltd (IN) — ASN 5 of 5
39486     # HostRoyale Technologies Pvt Ltd (IN) — auto-classified 2026-08-21
200169    # Manish Pant (IN) — auto-classified 2026-08-21

# ---------------------------------------------------------------------------
# Pakistan
# ---------------------------------------------------------------------------

9541      # Cyber Internet Services (Pvt) Ltd. (PK)

# ---------------------------------------------------------------------------
# Australia / APAC multi-region
# ---------------------------------------------------------------------------

45187     # Rackspace IT Hosting (AU/APAC)
55803     # Hostopia Australia Web Pty Ltd (AU)
56038     # RackCorp (AU/Global)
133159    # Mammoth Media Pty Ltd (AU)
134562    # Discovery Internet (AU)
136557    # Host Universal Pty Ltd (AU)
137409    # GSL Networks Pty LTD (AU/Global)
133153    # Unknown (AU) — auto-classified 2026-08-21
151592    # Indonesia Network Information Center (AU) — auto-classified 2026-08-21
64080     # Unknown (AU) — auto-classified 2026-08-21
133643    # EWEBGURU (AU) — auto-classified 2026-08-21
135175    # Facts Online Pvt Ltd (AU) — auto-classified 2026-08-21
58477     # Argon Data Communication (AU) — auto-classified 2026-08-21
149948    # Indonesia Network Information Center (AU) — auto-classified 2026-08-25

# ---------------------------------------------------------------------------
# Multi-region APAC
# ---------------------------------------------------------------------------

9597      # KDDI Web Communications Inc. (JP/APAC)
21100     # GREEN FLOID LLC (APAC)
45090     # Shenzhen Tencent Computer Systems Company Limited (CN/APAC)
56971     # CGI GLOBAL LIMITED (APAC)
64445     # NetJoin srl (IT/APAC)
133453    # Mogul Service LLC (APAC)
150436    # Byteplus Pte. Ltd. (SG/APAC)
201200    # SuperHosting.BG Ltd. (BG/APAC)
205402    # Asadov Ruslan (APAC)


# ===========================================================================
# SECURITY SCANNERS, RESEARCH NETWORKS & PRIVACY INFRASTRUCTURE
# ===========================================================================

16417     # Cisco Systems IronPort Division — email security scanner
42969     # Alpha Strike Labs GmbH (DE) — active security scanner
60729     # TORSERVERS-NET / Stiftung Erneuerbare Freiheit — Tor exit nodes
200107    # Kaspersky Lab Switzerland GmbH — security scanner
209366    # SEMrush CY Ltd — SEO crawler / scanner
211680    # NSEC Sistemas Informaticos S.A. (PT) — BitSight security scanner

  • Enterprise Shield: Automated Penalty Box

    The Enterprise Shield firewall system that I have implemented on my home server has a Penalty Box feature that allows me to add priority blocking rules to the system for IPs or CIDRs that manage to evade the other rulesets or are particularly annoying (I’m looking at you,Cloudflare WARP).

    However, this required me to watch the logs of my web server for these abusive systems and add them, as I noted, manually. With the number of attacks or floods that even a home server like mine gets, this can become a full-time analysis job.

    I had been considering fail2ban for a while, and finally implemented it with a number of jails designed to detect WordPress and general web attacks. The positives are really easy to document.

    • Automatic Blocking of 403 Floods: I have a number of rules in my web server config that redirect unwanted traffic directly to a 403 page. Things such as old browsers, blank UA strings, undesired bots, and attempts to access pages that should not be accessed immediately redirect a visitor to the 403 page. After five (5) 403 responses in a minute or less, immediate 24-hour ban. There is a separate low-and-slow 403 jail that looks at the same IP and if it generates a number of 403s over a 1-hour period, it also gets the 24-hour ban.
    • General WordPress Attack Patterns: Thes patterns are well-documented, and have their own jail. These are even less permissive — one strike and your out for 24 hours.
    • General Web Attack Patterns: A one stike rule also applies to visits that try general web attack patterns, credential-sniffing, or environment file requests. Again, immediate 24 hour ban

    The setup is obviously more complex than this under the hood, but it removed the need for me to add Penalty Box rules except in very specific cases.

    Silently alongside this I implemented a special ruleset for Cloudflare IPs. As these have been particularly egregious in sending attack traffic my way, I have created a special bucket using Cloudflare’s published CIDR blocks that begins to block traffic if large volumes of traffic begin to originate in total from these ranges. THis alone removed the need to have a very large number of Penalty Box rules specific to dealing with this group of “visitors”.

    On the whole, the new automated Penalty Box maintains a constant 25-50 rules that automatically cycle in an out after 24 hours. This prevents me from:

    • Adding unecessary rules for one-time attacks/floods from IPs or CIDRs that will never visit again
    • Blocking traffic for “real” bot traffic that may inherit an IP or CIDR I have blocked due to a previous attack/flood
    • Constamtly monitor web log files for potential new attacks and ranges that could cause load or security issues on the server.

    For those that chose to build their own security system for Home Servers rather than relying on paid services or CDNs, I definitely recommend integrating fail2ban into the automation path.

  • Enterprise Shield – Top Offenders – 2026-07-22

    Ah, Cloudflare. You claim to be security focused and help customers block threats to their sites, including unwanted bots. So, when are you going to clean your own house?

    This week, like last week, the single largest source of traffic captured by my firewall was, again, AS13335 – Cloudflare WARP. The firewall blocked nearly 4x the amount of hits when compared to the next closest ASN; and that was from just one of their ASNs.

    When the data is sorted by the number of unique IPs hitting the server, Cloudflare comes first and second, with AS14789 contributing a smaller number of hits.

    Top ASNs – By Hits – Last 7 Days
    Top ASNs – By Unique IPs – Last 7 Days

    You can see the scope of the unwanted traffic from Cloudflare WARP even more clearly when it is charted.

    Top ASNs – By Hits – Last 7 Days

    Since the last update, I have had to add a large number of Cloudflare CIDR blocks to my penalty_box list that is before the shield_hyperscaler rules in my firewall rules. The Penalty Box is a complete drop rule, with a time limit. Unfortunately, pretty much all the CIDR blocks in the penalty_box qualify for permanent blocks, and I will likely move them their in the near future.

    You can see when I migrated the Cloudflare CIDR Blocks to the penalty_box ruleset in these time charts — the red items are shield_hyperscaler while the purple is penalty_box (I apologize to my brethren who have red/green color blindness).

    Hits by Ruleset – Last 7 Days
    Unique IPs by Ruleset – Last 7 Days

    I will continue to watch this over the next few weeks; if Cloudflare WARP continues to be this aggressive, they will end up in the permanent block ruleset.

  • Create your own Google CrUX Benchmark Report

    Google CrUX is a great publicly available source of performance data that is not only good for analyzing the performance of a single site over time, but also a good way to create a comparative performance benchmark using shared metrics with agreed upon definitions.

    The CrUX History API allows for data to be extracted, analyzed, and compared using these metrics. However, it is challenging to use some of the publicly available CrUX Report generators to create a benchmark.

    Starting from some reporting I had already developed to use the CrUX History API for my day-job, I extended this to allow for the reporting capability to be extended to anyone who has a CrUX API key (get your own by following the directions here) and a list of URLs they want to compare.

    PerformanceZen CrUX Benchmark Builder

    The web UI is simple.

    Crux Report UI

    Right now it only accepts domains. I may in the future add the ability to do individual URLs, but this is the easiste to implement.

    Once you run the report, you get the following output.

    Initial Report Output

    The report that is generated is viewable right in the page, can be saved to your local drive, or stored on the server for 30 Days. Using the stored on server method, I have created a sample report you can review here.

    I hope you get some fun and entertainment from it!

  • Enterprise Shield – Top Offenders – 2026-07-13

    In this week’s edition of the Top Offenders list, there is a new leader in the abuse list: AS13335 – Cloudflare WARP. They have been hitting the site in large bursts for a couple of weeks now, using the anonymity afforded by hiding behind the open VPN Cloudflare provides.

    Top ASNs – 7 Days

    All of the largest surges seen over the last 7 days originate from this single ASN.

    Firewall Hits by Hour – Last 7 Days
    Distinct IPs by Hour – Last 7 Days

    Clouflare is in the shield_hyperscaler ruleset that was discussed in the previous Top Offenders post. This traffic is forced into a rate-limiting situation where a flood of traffic automatically triggers a DROP once a set volume is reached. However, even this is challenging as the Cloudflare surges have the largest amount of IP diversity of all those tracked at the firewall.

    In order to be more flexible, the shield_hyperscaler ruleset is applied on a /24 network basis. So even if the attacker tries to hide behind a set of IPs, if they come from a small number of /24 networks, they will end up in the DROP bucket.

  • Retiring an old friend

    On July 10 2026, I retired the 2008 13″ Macbook Aluminum that has been running as my web server/firewall/testbed for the last 4-5 years. A couple of unexpected power events and complete server lockups indicated that this old friend needed a rest.

    I replaced it with this — no endorsement on my part; just stating the facts. While a small homelab/office workstation cube may not be to everyone’s liking, I can tell you that with resource-constrained applications where the old Macbook had struggled, the new machine is more than capable.

    I had considered buying an old laptop to serve the purpose, but this little box is quiet, unobtrusive, and does what I ask it too.

    I’m a little sad to see a laptop that I have been using since 2008 fall out of service, but there comes a point where it just doesn’t do any job anymore.

    I’m not getting rid of it. I’m sure I will find a use for it some day. Just like everytime I thought that it was permanently retired. There is always a use for computer hardware of all kinds.

  • Enterprise Shield – Top Offenders – 2026-06-19

    Here is your weekly list of top offenders for your own security reading pleasure.

    Big change this week with Google EU West taking the top spot and Techoff SRV Limited, everyone’s favority Andorra-based Bulletproof Hosting Provider (despite company registration listing it as being from the UK and/or the Netherlands depending on how it is examined) taking the number 2 spot. Techoff is also the source of a number of the largest surges against the firewall this week.

    Top ASNs – 7 Days

    Cloudflare Warp is still a major source of attacks, providing the single source of attackers hiding behind the VPN/Proxy services in this ASN.

    This week was much quieter for Surge events, with most surge events originating from ASNs and CIDR blocks that already exist in the Hyperscaler or Block ASN/CIDR rule lists. Multi-IP surges completely originated from the Hyperscalers while the Block ASN/CIDR surges coming from only a small number of IPs.

    Hour by Hits – 7 Days
    Hours by IPs – 7 Days

    A note on the difference between the firewall rulesets. The Block ASN/CIDR rulesets do exactly as advertised — completely block the traffic that reaches them. The Hyperscaler ruleset is rate-limiting and only starts to DROP traffic if the number of connections or number of requests becomes aggressive.

    There is also a separate set of ratelimiting for Azure, as Microsoft doesn’t seem to have as much control on bad actors as the other Hyperscalers do.

    The current rulesets are:

    shield_allow       → ACCEPT
    shield_abuseipdb   → DROP
    shield_penalty     → DROP
    shield_azure       → AZURE-RATELIMIT (3/min per IP)
    shield_hyperscaler → CLOUD-RATELIMIT (10/min per /24)
    shield_block       → DROP

    As with everything, the ordering is important. For example, if there is a really aggressive AS8075 (Microsoft) IP that has been flagged by AbuseIPDB to the extent that it appears in the top 10K list that they provide, it gets immediately blocked. If I have found an aggressive IP that appears in none of the lists, I can add it (or the approporate CIDR block) to the Penalty Box ruleset for a set period of time to discourage that traffic.

    Another week of interesting learning around what is and isn’t traffic worth completely blocking. Learning that not all traffic can be blocked is one of the the twelve steps of learning to exist within the modern internet.

    As a final note, the Spamhaus list of offensive IPV4 addresses (available here) was added as yet another data source that is automatically added into the firewall rules on a daily basis. I will try and provide a sense of how effective this ruleset is next week.

  • Enterprise Shield – Top Offenders – 2026-06-12

    With the visualization system built to capture the data from the Enterprise Shield firewall system, I get to see exactly who the top Offenders are. This is the start of a series that allows me to share with the larger community who exactly has been trying to bring my tiny home web server to its knees.

    Top ASNs – 7 Days

    Using the Campaign naming schema, you can see many of the same providers showing up and being classified based on timing and attack pattern.

    Top Capmpaigns – 7 Days

    This has been a busy 7 days for surges in traffic.

    Hour by Hits – 7 Days
    Hours by Unique IPs – 7 Days

    The various surges are made up traffic from small numbers of IPs (SoloRDP – AS150303 with 2 IPs for 11,517 firewall hits) to large distributed attacks with huge blocks of IPs (Cloudflare WARP – AS13335 & AS14789; 3xK Tech GmbH – AS200373; etc.).

    Overall, it’s been a good learning experience to be able to see a full 7 days of traffic that was previously invisible to me.

  • Enterprise Shield – Surge Analysis

    When the Enterprise Shield firewall system was re-written, one of the things I worked on with Claude was the creation of an HTML dashboard that could share details on what and who was hitting the system.

    One of the items I iterated through on this was a Surge Analysis, a view into hours when traffic against the firewall was completely off the charts. Well that is starting to bear fruit.

    The system has been absolutely hammered today from a number of sources, but most notably slamming into the Hyperscaler ruleset which is more permissive than Azure (that’s a separate nightmare).

    These hours are completely out of spec for the system since the reporting system fired up. Taking only the most recent example, the system is designed to show when and where the attacks are coming from and how this traffic relates to traffic for +/- 3h on either side.

    But it is also critical to see who is slamming their head into the firewall. In this instance, the surge is completely driven by visitors hiding behind the Cloudflare Warp VPN service. Cloudflare is a part of the Hyperscaler ruleset that begins dropping traffic once a limit for connections per minute is reached.

    One thing that you will notice is that there is no single Cloudflare Warp IP in the top IP list; this attack is so distributed that it would fall below the detection of individual CIDR block level monitoring.

    Another surge shows a completely different source: The AbuseIPDB ruleset. This is based on the top 10K IPs available for adding to rulesets from the AbuseIPDB API.

    While smaller in volume, it is very interesting to see that the firewall is able to segment this. This example also shows a mega bot server that drove all of the traffic from a single IP.

    It should also be pointed out that this was caught by the AbuseIPDB rules, not the Hyperscaler rules. AbuseIPDB rules precede the Hyperscaler rules for this very purpose: Abusive IPs, regardless of the source, should be blocked.

    Overall, this is a very interesting dataset to watch, observing all the attempts to scan, exploit, or attack a single home-hosted web server without a CDN. At this scale for a single server, I appreciate the work that bot mitigation and protection services do for the customers I work with daily.

  • Enterprise Shield – The Evolution – Part 2: The System

    Now that you have seen the why of Enterprise Shield, this post presents the how. By migrating from a simple set of SHELL scripts and flat files, things get more complex, but also far more manageable and scalable.

    Also, by adding in a reporting capability, it is very easy to track who is trying to get in and report on volume, location, network, and type of attack.

    1. The Firewall Architecture: Chains and Sets

    1.1 How Traffic Flows

    Every inbound packet passes through this evaluation sequence before anything else happens. Enterprise Shield inserts itself at position 1 of the INPUT chain, ahead of UFW’s rules.

    Inbound Packet (any source)
         │
         ▼
┌─────────────────────────────┐
│        INPUT chain          │  ← UFW manages this
│  [position 1] SHIELD-LOGIC ─┼──────────────────────────────────────────┐
│  [position 2+] UFW rules    │                                          │
└─────────────────────────────┘                                          │
                                                                         ▼
                                              ┌──────────────────────────────────────────┐
                                              │           SHIELD-LOGIC chain             │
                                              │                                          │
                                              │  1. ESTABLISHED/RELATED → ACCEPT         │
                                              │     (existing connections pass through)  │
                                              │                                          │
                                              │  2. loopback (lo) → ACCEPT               │
                                              │                                          │
                                              │  3. LAN + own IP → ACCEPT                │
                                              │     (192.168.x.x, 127.x.x.x, public IP)  │
                                              │                                          │
                                              │  4. shield_allow → ACCEPT                │
                                              │     (manually whitelisted CIDRs/IPs)     │
                                              │                                          │
                                              │  5. shield_abuseipdb → DROP + LOG        │
                                              │     (AbuseIPDB flagged IPs, ≥90 score)   │
                                              │                                          │
                                              │  6. shield_block → DROP + LOG            │
                                              │     (ASN blocks + country blocks)        │
                                              │                                          │
                                              │  7. shield_penalty → DROP + LOG          │
                                              │     (time-limited penalty box)           │
                                              │                                          │
                                              │  8. shield_azure → AZURE-RATELIMIT       │
                                              │     (AS8075 / Microsoft Azure)           │
                                              │                                          │
                                              │  9. shield_hyperscaler → CLOUD-RATELIMIT │
                                              │     (AWS, GCP, Oracle, Cloudflare)       │
                                              │                                          │
                                              │ 10. RETURN → UFW handles remaining       │
                                              └──────────────────────────────────────────┘

    Critical ordering note: shield_abuseipdb fires before the Azure and hyperscaler rate-limit rules (steps 8-9). This means a known-bad Azure IP is dropped outright rather than merely rate-limited. This was an explicit design
    decision made during the final production verification.

    1.2 The Rate-Limit Chains

    Traffic that matches Azure or hyperscaler ipsets is not simply blocked — it would break Bingbot (which runs on AS8075) and legitimate cloud-based monitoring tools. Instead, it flows into dedicated rate-limit chains:

    AZURE-RATELIMIT chain
├── hashlimit: 3 connections/minute per source IP, burst 2
├── If within limit: ACCEPT
└── If over limit: DROP + LOG [SHIELD_AZURE_LIMIT]

CLOUD-RATELIMIT chain
├── hashlimit: 20 connections/minute per source IP, burst 8
├── If within limit: ACCEPT
└── If over limit: DROP + LOG [SHIELD_CLOUD_LIMIT]

    Azure gets a tighter limit (3/min) because it’s the most frequently abused hyperscaler ASN against this server. AWS/GCP/Oracle/Cloudflare get more headroom (20/min) to accommodate legitimate crawler and monitoring traffic.

    Known limitation: HTTP/1.1 keep-alive connections bypass the hashlimit entirely because ESTABLISHED,RELATED packets are accepted at step 1 before they ever reach the rate-limit chains. This is a fundamental iptables constraint, not a bug in Enterprise Shield.

    1.3 The Seven ipsets

    ┌─────────────────-─┬───────────────┬────────────────────────────────────────┐
│ ipset name        │ type          │ contents                               │
├──────────────────-┼───────────────┼────────────────────────────────────────┤
│ shield_allow      │ hash:net      │ Manually whitelisted CIDRs/IPs         │
│ shield_abuseipdb  │ hash:net      │ AbuseIPDB flagged IPs (score ≥ 90)     │
│ shield_block      │ hash:net      │ ASN blocks + 43-country blocks         │
│ shield_penalty    │ hash:net      │ Time-limited penalty box               │
│ shield_azure      │ hash:net      │ AS8075 (Microsoft Azure) CIDRs         │
│ shield_hyperscaler│  hash:net     │ AWS, GCP, Oracle, Cloudflare CIDRs     │
│ shield_country    │ hash:net      │ Country blocks (may merge with _block) │
└──────────────────-┴───────────────┴────────────────────────────────────────┘

All sets: maxelem 1000000, hashsize 131072
Total entries across all sets: ~500,000 CIDRs

    1.4 The LOG Rules and Tag Format

    Every DROP action in SHIELD-LOGIC includes a LOG rule that fires first. Each log message is tagged so rsyslog can route it:

    TagMeaning
    [SHIELD_BLOCK]Dropped by shield_block (ASN or country)
    [SHIELD_ABUSEIPDB]Dropped by shield_abuseipdb
    [SHIELD_PENALTY]Dropped by shield_penalty (penalty box)
    [SHIELD_AZURE_LIMIT]Rate-limited by AZURE-RATELIMIT chain
    [SHIELD_CLOUD_LIMIT]Rate-limited by CLOUD-RATELIMIT chain

    The log line format from iptables looks like:

    Jun 03 14:22:11 creaky2 kernel: [SHIELD_BLOCK] IN=eth0 OUT= SRC=185.220.101.47 DST=x.x.x.x PROTO=TCP DPT=443 ...

    rsyslog matches on [SHIELD_ prefix and routes to /var/log/enterprise_shield/hits.log, which hits_parser.py then consumes every 5 minutes.

    2. The Database Schema

    The SQLite database is the authoritative state of the entire system. If you have the database, you can reconstruct everything.

    2.1 Schema Overview

    shield.db
│
├── cidr_blocks          ← every CIDR the system manages
├── asn_registry         ← all 447+ ASNs with their classification
├── country_registry     ← 43 countries with ETag cache
├── abuseipdb_entries    ← per-IP AbuseIPDB data, independent lifecycle
├── firewall_hits        ← raw parsed hits from rsyslog (rolling window)
├── hits_hourly          ← aggregated hourly rollup (long-term storage)
├── ip_enrichment        ← per-IP enrichment cache (ip-api.com, Shodan)
├── campaigns            ← computed attack campaign groupings (rebuilt each run)
└── system_state         ← all runtime state: timestamps, flags, hashes

    2.2 cidr_blocks — The Core Table

    CREATE TABLE cidr_blocks (
    id              INTEGER PRIMARY KEY,
    cidr            TEXT NOT NULL,          -- e.g. "185.220.0.0/16"
    source          TEXT NOT NULL,          -- 'asn', 'country', 'manual', 'allow'
    source_id       TEXT,                   -- ASN number or country code
    ipset_target    TEXT NOT NULL,          -- which ipset this CIDR belongs to
    first_seen      INTEGER,                -- epoch timestamp
    last_verified   INTEGER,               -- epoch of last successful WHOIS confirm
    UNIQUE(cidr, ipset_target)
);

    The ipset_target field is what drives the actual ipset membership. When the rebuild runs, it diffs this table against the live ipset state and applies only the delta.

    2.3 asn_registry — ASN Classification

    CREATE TABLE asn_registry (
    asn             TEXT PRIMARY KEY,      -- 'AS3209', 'AS8075', etc.
    name            TEXT,                  -- human-readable name from WHOIS
    classification  TEXT NOT NULL,         -- 'block', 'azure', 'hyperscaler', 'allow'
    last_whois      INTEGER,               -- epoch of last WHOIS lookup
    fail_count      INTEGER DEFAULT 0,     -- consecutive WHOIS failures
    note            TEXT                   -- operator annotation
);

    The classification field determines which ipset a CIDR ends up in. azure → shield_azure, hyperscaler → shield_hyperscaler, block → shield_block.

    2.4 abuseipdb_entries — Separate Lifecycle

    CREATE TABLE abuseipdb_entries (
    ip              TEXT PRIMARY KEY,
    abuse_score     INTEGER,              -- 0-100 confidence score
    country_code    TEXT,
    last_seen       TEXT,                 -- from AbuseIPDB's "lastReportedAt"
    refreshed_at    INTEGER,             -- epoch of our last fetch
    in_ipset        INTEGER DEFAULT 0    -- currently loaded into shield_abuseipdb?
);

    AbuseIPDB entries are refreshed 5× daily (at 00:00, 05:00, 10:00, 15:00, 20:00 UTC) because of the free tier’s rate limit on the blacklist endpoint. The confidence threshold is 90 — only IPs with a score of 90 or above are loaded into the ipset. The table currently holds ~10,000 entries.

    2.5 firewall_hits and hits_hourly — The Hit Pipeline

    CREATE TABLE firewall_hits (
    id          INTEGER PRIMARY KEY,
    hit_time    INTEGER NOT NULL,         -- epoch timestamp
    src_ip      TEXT NOT NULL,
    dst_port    INTEGER,
    protocol    TEXT,
    shield_tag  TEXT,                     -- SHIELD_BLOCK, SHIELD_ABUSEIPDB, etc.
    log_line    TEXT                      -- raw log line for debugging
);

CREATE TABLE hits_hourly (
    hour_bucket INTEGER NOT NULL,         -- epoch rounded to hour
    src_ip      TEXT NOT NULL,
    shield_tag  TEXT NOT NULL,
    hit_count   INTEGER DEFAULT 0,
    PRIMARY KEY (hour_bucket, src_ip, shield_tag)
);

    Raw hits accumulate in firewall_hits. The hits_rollup.py job runs at 03:00 daily and aggregates rows older than RAW_RETENTION_DAYS (default: 3 days) into hits_hourly, then deletes the raw rows. hits_hourly retains data for AGGREGATE_RETENTION_DAYS (default: 365 days).

    2.6 system_state — No More Flat Files

    CREATE TABLE system_state (
    key     TEXT PRIMARY KEY,
    value   TEXT
);

-- Key entries:
-- 'last_rebuild_time'      : epoch of last successful rebuild
-- 'last_entry_count'       : CIDR count at last successful rebuild
-- 'rebuild_in_progress'    : '1' if a rebuild is currently running (crash detection)
-- 'last_public_ip'         : server's external IP at last rebuild
-- 'config_hash'            : SHA-256 of /etc/enterprise_shield/config.conf
-- 'last_abuseipdb_refresh' : epoch of last AbuseIPDB refresh
-- 'hits_parser_position'   : byte offset in hits.log (resume parsing from here)

    The rebuild_in_progress flag is the crash recovery mechanism. If the system reboots
    mid-rebuild, restore.py detects this flag on boot and triggers a full rebuild before
    loading ipsets.

    3. The Rebuild Flow

    3.1 Nightly Rebuild (shield.py rebuild)

    [cron: 30 2 * * *]
         │
         ▼
┌─────────────────────────────────────┐
│  Acquire PID lock                   │
│  Set rebuild_in_progress = 1 in DB  │
└─────────────────────────────────────┘
         │
         ▼
┌─────────────────────────────────────┐
│  Check config SHA-256 hash          │
│  If changed: re-import config file  │
│  Destroy any orphan staging ipsets  │
└─────────────────────────────────────┘
         │
         ▼
┌─────────────────────────────────────┐
│  WHOIS refresh (only stale ASNs)    │
│  Staleness threshold: 14 days       │
│  Typically 2-5 ASNs per night       │
│  On failure: keep existing CIDRs,   │
│  increment fail_count               │
└─────────────────────────────────────┘
         │
         ▼
┌─────────────────────────────────────┐
│  Country block refresh              │
│  ETag conditional GET to GitHub     │
│  304 Not Modified: skip download    │
│  200 OK: parse and update DB        │
└─────────────────────────────────────┘
         │
         ▼
┌─────────────────────────────────────┐
│  Compute delta                      │
│  DB state vs. live ipset state      │
│  Entries to ADD: new CIDRs in DB    │
│  Entries to DELETE: removed CIDRs   │
└─────────────────────────────────────┘
         │
         ▼
┌─────────────────────────────────────┐
│  DELTA SAFETY CHECK                 │
│  New count < (last × 0.95)?         │
│  YES → ABORT, preserve current set  │
│  NO  → proceed                      │
└─────────────────────────────────────┘
         │
         ▼
┌─────────────────────────────────────┐
│  Apply delta to staging ipsets      │
│  ipset swap staging → live (atomic) │
│  ipset destroy staging sets         │
└─────────────────────────────────────┘
         │
         ▼
┌─────────────────────────────────────┐
│  Update DB:                         │
│  - last_rebuild_time                │
│  - last_entry_count                 │
│  - rebuild_in_progress = 0          │
│  Release PID lock                   │
└─────────────────────────────────────┘

    3.2 The Atomic Swap

    The ipset swap is the critical section of the rebuild. The live set is never empty:

    shield_block_staging (new CIDRs)
         │
         │  ipset swap shield_block_staging shield_block
         ▼
shield_block (now has new CIDRs — atomically)
         │
         │  ipset destroy shield_block_staging
         ▼
(staging set gone)

    If the swap fails for any reason, the original shield_block is untouched and the staging set is left for cleanup on the next run.

    4. The Boot Persistence Architecture

    This is one of the most critical (and most debugged) parts of the system. Getting the ordering wrong leaves the server unprotected between reboot and first cron run.

    4.1 The Two-Service Boot Sequence

    Boot sequence:

kernel loads
    │
    ▼
systemd-modules-load.service     ← ensures ip_tables, ip_set kernel modules are loaded
    │
    ▼
local-fs.target                  ← ensures /var/lib/enterprise_shield/ is mounted
    │
    ▼
enterprise-shield-ipset-restore.service    ← runs restore.py --ipsets-only
    │  Loads all 7 ipsets from SQLite
    │  Sets ipsets before UFW needs them
    │
    ▼
ufw.service                      ← UFW loads its rules
    │  The ipsets now exist when UFW's before.rules references them
    │
    ▼
enterprise-shield-chain-restore.service   ← runs restore.py --chains-only
       Rebuilds SHIELD-LOGIC, AZURE-RATELIMIT, CLOUD-RATELIMIT chains
       Inserts "INPUT -j SHIELD-LOGIC" at position 1
       Uses --noflush so UFW's chains are preserved

    4.2 Why the Ordering Matters

    ServiceMust run BEFOREMust run AFTER
    ipset-restoreufw.servicesystemd-modules-load, local-fs.target
    chain-restore(nothing)ufw.service, ipset-restore

    The DefaultDependencies=no setting is not used (a lesson learned from a failed boot cycle) — it was removed too aggressively early and prevented the kernel module loading dependency from being honoured.

    4.3 What restore.py Does

    # restore.py --ipsets-only
for each ipset in [shield_allow, shield_abuseipdb, shield_block,
                   shield_penalty, shield_azure, shield_hyperscaler]:
    create ipset if not exists
    bulk-load CIDRs from cidr_blocks WHERE ipset_target = ipset

# restore.py --chains-only
create SHIELD-LOGIC chain (flush if exists)
add ESTABLISHED/RELATED ACCEPT rule
add loopback ACCEPT rule
add LAN + own IP ACCEPT rule  (reads last_public_ip from system_state)
add shield_allow ACCEPT rule
add shield_abuseipdb DROP+LOG rule
add shield_block DROP+LOG rule
add shield_penalty DROP+LOG rule
add shield_azure → AZURE-RATELIMIT rule
add shield_hyperscaler → CLOUD-RATELIMIT rule
create AZURE-RATELIMIT chain with hashlimit rules
create CLOUD-RATELIMIT chain with hashlimit rules
iptables -I INPUT 1 -j SHIELD-LOGIC

    4.4 Crash Recovery

    If the server loses power mid-rebuild:

    Next boot
    │
    ▼
enterprise-shield-ipset-restore.service
    │
    ▼
restore.py checks system_state WHERE key='rebuild_in_progress'
    │
    ├── value = '0': normal restore from DB
    │
    └── value = '1': CRASH DETECTED
             │
             ▼
        Log CRITICAL to /var/log/enterprise_shield/restore.log
        Load last known-good CIDRs from DB (last successfully committed state)
        Continue with normal restore
        Set rebuild_in_progress = 0

    The last known-good state is whatever was in the database at the time of the crash. Because the DB commit happens after the ipset swap succeeds, any incomplete rebuild simply means the previous night’s CIDRs are loaded — which is correct behaviour.

    5. The Hit Logging Pipeline

    iptables LOG rule fires
    │
    │  Kernel writes to syslog
    ▼
/var/log/syslog
    │
    │  rsyslog matches: if $msg contains '[SHIELD_'
    ▼
/var/log/enterprise_shield/hits.log
    │
    │  hits_parser.py runs every 5 minutes via cron
    │  Resumes from byte offset stored in system_state.hits_parser_position
    ▼
firewall_hits table (SQLite)
    │
    │  hits_rollup.py runs at 03:00 daily
    │  Aggregates rows older than RAW_RETENTION_DAYS into hits_hourly
    │  Deletes aggregated raw rows
    ▼
hits_hourly table (SQLite)
    │
    │  deep_shield.py runs every 10 minutes
    │  Queries both tables, enriches IPs, computes campaigns
    ▼
private threat analysis dashboard

    │  public_shield.py runs hourly
    ▼
https://performancezen.com/shield/public_shield.html
(public-facing summary — sanitised, no internal data)

    5.1 rsyslog Configuration

    # /etc/rsyslog.d/10-enterprise-shield.conf
:msg, contains, "[SHIELD_" /var/log/enterprise_shield/hits.log
& stop

    The & stop prevents these messages from also going into /var/log/syslog, keeping the main syslog uncluttered.

    5.2 hits_parser.py — Resumable Parsing

    The parser reads hits.log from the byte offset stored in system_state.hits_parser_position.
    On each 5-minute run, it:

    1. Opens the file, seeks to the stored position
    2. Reads all new lines since the last run
    3. Parses each [SHIELD_*] log line for SRC=, DPT=, PROTO=
    4. Inserts rows into firewall_hits
    5. Updates hits_parser_position to the new end-of-file offset

    If the log file is rotated (via logrotate), the parser detects the file is smaller than the stored offset and resets to position 0.

    6. The AbuseIPDB Integration

    AbuseIPDB operates on a completely separate lifecycle from the main rebuild:

    [cron: 0 0,5,10,15,20 * * *]  (5× daily)
         │
         ▼
abuseipdb.py refresh
    │
    ├── Query AbuseIPDB /api/v2/blacklist
    │   Parameters: confidenceMinimum=90, limit=10000
    │
    ├── Parse response → list of {ip, abuseConfidenceScore, countryCode}
    │
    ├── Diff against abuseipdb_entries table:
    │   - New IPs: INSERT into table, add to shield_abuseipdb ipset
    │   - Removed IPs: DELETE from table, remove from shield_abuseipdb ipset
    │   - Unchanged IPs: update refreshed_at timestamp only
    │
    └── Log summary: X added, Y removed, Z unchanged

    The AbuseIPDB ipset (shield_abuseipdb) is kept live-updated between the main nightly rebuilds. A known-bad IP that appears on AbuseIPDB is blocked within 5 hours maximum, without waiting for the 2:30AM rebuild.

    7. The Penalty Box

    The penalty box (shield_penalty ipset) handles time-limited blocks — typically IPs that have triggered specific application-layer rules or been manually added for investigation.

    Adding to penalty box:
    shield.py penalty add <ip> [--hours N]  (default: 24 hours)
        │
        ├── INSERT into penalty_entries table with expires_at timestamp
        └── ipset add shield_penalty <ip>

Expiry check (every 15 minutes via cron):
    penalty.py expire
        │
        ├── SELECT from penalty_entries WHERE expires_at < NOW()
        ├── For each expired entry:
        │   ipset del shield_penalty <ip>
        │   DELETE from penalty_entries
        └── Log: "Expired N penalty entries"

    The penalty box also survives reboots — restore.py loads shield_penalty from the database on boot, but only entries whose expires_at is still in the future. Expired entries are not restored.

    8. Module Structure

    All Python modules live at /usr/local/lib/enterprise_shield/:

    /usr/local/lib/enterprise_shield/
├── shield.py          ← Main CLI: rebuild, add, add-asn, check, status
├── restore.py         ← Boot restore: --ipsets-only, --chains-only
├── abuseipdb.py       ← AbuseIPDB refresh daemon
├── hits_parser.py     ← rsyslog hits.log → firewall_hits table
├── hits_rollup.py     ← firewall_hits → hits_hourly aggregation
├── penalty.py         ← Penalty box expiry
├── deep_shield.py     ← Private threat analysis dashboard generator
├── public_shield.py   ← Public summary dashboard generator
├── db.py              ← Database connection and schema management
└── config.py          ← Configuration constants and file parsing