Server without Cloudflare: blocklist + fail2ban + iptables

Option A: ipset, refresh via cron

# every 15 minutes
curl -s https://gennadii75.github.io/sml-network-v2/blocklist.txt -o /tmp/sml.txt
ipset create sml-block hash:net -exist
ipset flush sml-block
while read ip; do ipset add sml-block "$ip" -exist; done < /tmp/sml.txt
iptables -I INPUT -m set --match-set sml-block src -j DROP

Option B: fail2ban on your own logs

Let fail2ban keep catching scanners (404 bursts, wp-login brute force) as before, and hold the blocklist as a second line via ipset above. Don't feed the whole blocklist into one jail — thousands of IPs slow down restarts.

Important

The base updates roughly every 15 minutes. Don't ban whole subnets — exact IPs only. Want to earn, not just block — connect a worker.