Enterprise Shield — ASN Blocklist

Category breakdown

Full blocklist

No entries match that filter.

About this list

This is the list of Autonomous System Numbers (ASNs) currently blocked by Enterprise Shield, the self-hosted iptables/ipset firewall running in front of this server. Each ASN below is resolved to a set of CIDR blocks and collapsed to the smallest efficient set of supernets before being deployed at the firewall.

New ASNs are added with shield.py add-asn <ASN> --permanent, which appends them to the raw blocklist file. A companion classification script (classify_new_asns.py) runs before this page is generated each day: it looks up every newly-added ASN via a tiered WHOIS → RDAP → RADB fallback chain, determines its owning organization and country, and files it into the correct category below — the same categories a human reviewer would use. The same script also sweeps for orphaned or duplicate entries and re-resolves any ASN still on file as “Unknown”, so the list here always reflects a fully-processed, de-duplicated file.

File format: one ASN per line, either bare (12345) or AS-prefixed (AS12345). A line commented out with a leading # is disabled — kept for reference but not enforced at the firewall. Entries under “Flagged for review” are commented out pending manual verification that they aren't collateral damage.

Blocklist file last reorganized: 2026-11-02 · Page generated: 2026-11-03 15:10 UTC

Not included: Cloud / CDN infrastructure

The ASNs below are deliberately excluded from the blocklist above. They belong to hyperscalers and CDNs (Microsoft Azure, Amazon AWS, Oracle Cloud, Google Cloud, Cloudflare, Akamai/Linode) that are far too large to block wholesale without heavy collateral damage. Traffic from these networks is instead handled by separate, distinct firewall rules that allow some traffic through up to a volume threshold, or that rely on fail2ban jails to catch individually abusive clients. They are unique to those rules and are not part of, and do not count toward, the 1123-ASN total above.

Country-level blocks

Separately from the per-ASN list, Enterprise Shield also blocks entire countries at the firewall. These blocks are independent of, and layered on top of, the ASN-level rules above.

Programmatic access

asn_list.txt is a plain list of every enforced ASN on this page — the active blocklist entries above plus the excluded Cloud/Azure/Cloudflare ASNs, merged into one deduplicated, numerically-sorted list of bare integers, one per line, no comments, no AS prefix, no country blocks. It's meant to be trivial to pull into a script and use as a filter list.

Recipes below fetch asn_list.txt live from this server, so the array is always current as of your script's last run. Swap in a local path instead if you'd rather work from a downloaded copy.

import urllib.request
url = "https://performancezen.com/blocklist/asn_list.txt"
with urllib.request.urlopen(url) as f:
    asns = [int(line) for line in f if line.strip()]

const asns = (await (await fetch('https://performancezen.com/blocklist/asn_list.txt')).text())
  .split(/\r?\n/).map(l => l.trim()).filter(Boolean).map(Number);

// Node 18+ has fetch() built in
const asns = (await (await fetch('https://performancezen.com/blocklist/asn_list.txt')).text())
  .split(/\r?\n/).map(l => l.trim()).filter(Boolean).map(Number);

$asns = array_map('intval', file('https://performancezen.com/blocklist/asn_list.txt',
    FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES));

mapfile -t asns < <(curl -s https://performancezen.com/blocklist/asn_list.txt)
# ${asns[@]} is now the array; ${#asns[@]} is its length

$asns = (Invoke-WebRequest -Uri "https://performancezen.com/blocklist/asn_list.txt").Content `
    -split '\r?\n' | Where-Object { $_.Trim() -ne '' } | ForEach-Object { [int]$_ }

require 'open-uri'
asns = URI.open('https://performancezen.com/blocklist/asn_list.txt')
  .readlines.map(&:strip).reject(&:empty?).map(&:to_i)

use HTTP::Tiny;
my $res = HTTP::Tiny->new->get('https://performancezen.com/blocklist/asn_list.txt');
my @asns = map { 0 + $_ } grep { /\S/ } split /\r?\n/, $res->{content};

resp, _ := http.Get("https://performancezen.com/blocklist/asn_list.txt")
defer resp.Body.Close()
var asns []int
scanner := bufio.NewScanner(resp.Body)
for scanner.Scan() {
    line := strings.TrimSpace(scanner.Text())
    if line == "" {
        continue
    }
    n, _ := strconv.Atoi(line)
    asns = append(asns, n)
}

asns <- as.integer(readLines("https://performancezen.com/blocklist/asn_list.txt"))
asns <- asns[!is.na(asns)]

using HTTP
resp = HTTP.get("https://performancezen.com/blocklist/asn_list.txt")
asns = parse.(Int, filter(!isempty, strip.(readlines(IOBuffer(resp.body)))))