Using the PCA IP blocklist and CVE feed: the files

Copy-paste files for the tutorial: pull the alliance IP blocklist into nginx or an ipset, keep it up to date with a systemd timer or a cron line. Version 1.0, 2026-11-11. Licence: CC BY 4.0, credit Port Cyber Alliance and link to the tutorial.

pca-blocklist-pull.sh: Pulls the list, checks every entry, applies it to nginx (nginx) or to two ipsets (ipset); applies nothing on a non-200 answer or an unexpected line.
pca-blocklist.service: systemd oneshot service that runs the script.
pca-blocklist.timer: systemd timer: every six hours, randomised by up to 15 minutes, catches up after downtime.
pca-blocklist.cron: The same schedule as an /etc/cron.d/ line, for hosts without systemd.
pca-ip-blocklist-cve-feed-howto.yaml: The single source of the tutorial page and of these files.

You need a member API key: accounts are opened on request, see Get started. The script reads the key from /etc/pca/api-key (mode 600) and sends it with curl -H @file, so it never shows in the process list.

What the API served when we measured (11 November 2026, 02:49 UTC)

format	HTTP	Content-Type	What you get
`json`	200	`application/json`	an object « blocklist » with one record per entry: ip, cidr, source, reason, first_seen, last_seen, active
`csv`	200	`text/csv`	a header line « ip,cidr,source,reason,last_seen », then one quoted line per entry
`nginx`	200	`text/plain`	one « deny <address or range>; » line per entry
`htaccess`	200	`text/plain`	one « Deny from <address or range> » line per entry (Apache 2.2 syntax)
`iptables`	200	`text/plain`	one « iptables -A INPUT -s <address or range> -j DROP » line per entry

Any other value of format gets a 422 with the list of accepted values; a call without a key, or with a revoked key, gets a 401. The test key's /whoami answered a quota of 1,000 GET calls a day.

The list held 2 entries (1 address, 1 range, source declared). Both entries sit in address blocks that RFC 5737 reserves for documentation (192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24): they are examples and are never routed on the Internet, so blocking them changes nothing on your network. No open blocklist source is connected to the aggregator yet.

The CVE feed served 0 entries. The first collection read 200 records from the US National Vulnerability Database (NVD), all published between 1988 and 1997. None of them concerns the watched software, so the feed answered an empty list. Reading the recent records is the next step on our side.

Sources

RFC 5737, IPv4 Address Blocks Reserved for Documentation, January 2010: https://www.rfc-editor.org/rfc/rfc5737
NVD, Vulnerability APIs (CVE API 2.0), read on 11 November 2026: https://nvd.nist.gov/developers/vulnerabilities
nginx, module ngx_http_access_module (allow and deny), read on 11 November 2026: https://nginx.org/en/docs/http/ngx_http_access_module.html
systemd.timer manual page, read on 11 November 2026: https://www.freedesktop.org/software/systemd/man/latest/systemd.timer.html
ipset manual page (ipset swap, hash:net), read on 11 November 2026: https://ipset.netfilter.org/ipset.man.html

Licence

Creative Commons Attribution 4.0 International. The files are provided as is, without warranty. Test them on a non-production host first; blocking an address can cut legitimate traffic, so keep an allowlist for your partners and a way to roll back. Generic: no client, port or vendor is named, no figure is invented.