Your Cloudflare Blocklist Is Probably Frozen. Ours Was: 6,889 Entries, Untouched Since June 1. Here Is the Hourly Fix With Tools You Already Own.
Most teams that run Cloudflare have an IP list behind a firewall rule. Someone loaded it once, maybe from a threat feed, maybe by hand after a bad week, and the rule has been blocking ever since. Ours was no different. Today we read it back from Cloudflare's API: 6,889 entries, last modified June 1. The token meant to keep it current had stopped working months ago, and nothing told us. It was still blocking hundreds of requests a day. Of 40 addresses it blocked yesterday, 34 were no longer in our own threat feed. This post covers how we found it, how we replaced it with an hourly reload from the same feed our subscribers use, and how to do the same with the tools you already have.
How a blocklist freezes without anyone noticing
Three things lined up.
We moved our live IP blocking into Edge Shield, the open-source Cloudflare Worker we publish, back in May. The old list kept its firewall rule, and nobody went back to it.
The automation that was supposed to keep the list fresh used a token that could not touch lists. We made a new token in early October. That one was dead too. Cloudflare answers "Invalid API Token" to it today.
A firewall rule that blocks from a stale list still blocks. The dashboard shows activity, so it looks healthy. Activity only tells you the rule matches something. It does not tell you the list is current.
What gave it away was a comparison, not an alert. We were checking which layer blocked what over one day, and the old list turned out to be the biggest single blocker: 431 requests. When we looked up the addresses it was blocking, almost none were things our feed still considered bad.
The fix, step by step
This is what now runs against our own Cloudflare account every hour. You can rebuild it with a scheduled job and Cloudflare's API.
Make a token that can only touch lists. In Cloudflare, create a custom API token with one permission: Account, Account Filter Lists, Edit. Before you use it, ask Cloudflare's token-verify endpoint for its status. It returns the token's start and end dates. Our first replacement token came back valid for a single day in May 2027 because of a date-picker slip. It would have failed silently, just like the last one.
Pull your feed. Use the same IP file you would give any other tool. We pull our own list at confidence 80 and above, the floor we block at on our own sites.
Validate every line. A Cloudflare IP list takes single IPv4 and IPv6 addresses and ranges from IPv4 /8 to /32 and IPv6 /12 to /128. Drop anything else.
Protect yourself. Remove your own office and server addresses, Cloudflare's shared Workers range, and public DNS resolvers before anything reaches the list. A blocklist that blocks your own monitoring is worse than none.
Refuse on bad input. If the feed comes back empty or far shorter than usual, write nothing. A broken feed should never be able to wipe your list.
Replace the whole list, never append. Cloudflare's bulk replace swaps every item in one operation. Appending is how lists collect years of dead entries.
Read it back. When the bulk operation finishes, fetch the list and compare its item count and modified date with what you sent. If they do not match, the run failed, whatever the API said earlier.
Then point a WAF custom rule at it. The expression is ip.src in $your_list_name with the Block action. Our first run took the list from 6,889 entries to 2,977, and the modified date moved from June 1 to today.
Things that will bite you
WAF rules run before Workers. A request your list blocks never reaches a Worker on the same route, so it will not show up in that Worker's logs. Count blocks where they happen.
Cloudflare will not delete a list that a rule still uses. That is a good safety rail. To retire a list cleanly, empty it first. It stops matching right away, and you can remove the rule and the list at leisure. We retired a second old list exactly that way today.
Lists have per-plan limits. The list we use caps at 10,000 entries. Check yours before your feed outgrows it, and keep the highest-confidence entries if you have to trim.
Watch the modified date, not the count. A frozen list keeps its count forever. The date is the honest signal.
Not on Cloudflare?
The same loop works on gear you already run. pfSense and OPNsense URL-table aliases, FortiGate external threat feeds and Palo Alto external dynamic lists all pull an IP list over HTTPS on a schedule. Set the refresh interval, and then check the date of the last successful pull, because that is the number that goes stale without telling you. If you have a SIEM, have it alert when a blocklist has not changed in a day.
Why we keep writing about our own mistakes
We sell this feed. The most useful thing we can show you is that we load it into our own firewall the same way we tell you to, and what happened the months we did not. Every number in this post is read back from Cloudflare, not taken from a dashboard.
The free key that pulls our IP list into Cloudflare, your firewall or your SIEM is at https://analytics.dugganusa.com/stix/register?utm_source=blog&utm_campaign=cloudflare-blocklist-frozen
If this was useful, or if it was not, the rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=your-cloudflare-blocklist-is-probably-frozen-ours-was-6-889-entries-untouched-since-june-1-here
Comments