# Country-level CIDR feeds from ebrasha/cidr-ip-ranges-by-country: hourly IPv4 and IPv6 blocks for firewall and geolocation work > A GitHub repository that publishes per-country CIDR ranges for IPv4 and IPv6, refreshed hourly. It is useful for firewall rules and geolocation, but you must verify its data provenance and licensing before relying on it. **ebrasha/cidr-ip-ranges-by-country** — CIDR IP ranges by country for geolocation, firewall rules, network filtering, and cybersecurity – updated hourly for IPv4 and IPv6. Curated by EbraSha – Abdal Security Group - Repository: https://github.com/ebrasha/cidr-ip-ranges-by-country - Stars: 106 · Forks: 25 - Language: Unknown - License: not declared - Published: 2026-08-21 · Updated: 2026-08-21 · Language: en - Canonical page: https://hysenlabs.com/projects/ebrasha-cidr-ip-ranges-by-country ## What this repository actually provides The project is a flat collection of text files, one directory per country, each containing two files: one for IPv4 CIDR ranges and one for IPv6. The file names follow a pattern like *-ipv4-Hackers.Zone.txt and *-ipv6-Hackers.Zone.txt. The README states the repository is updated every hour, which is the core selling point for anyone who needs current ranges for geolocation or firewall rules. There is no code, no API, and no tooling. It is purely data. The target user is a network administrator or security engineer who wants to block or allow traffic by country, or who needs a quick way to map an IP address to a country without running a full geolocation service. ## How the data is organized and what the file names tell you The structure is simple: navigate to a country directory, pick the IPv4 or IPv6 file, and use its contents. The README gives no example of the file format, but the naming convention suggests each line is a CIDR block, such as 1.0.0.0/24. The 'Hackers.Zone' suffix in the file names is a clue to the original data source, but the README never names that source. This is a significant gap. You cannot verify whether the ranges come from regional internet registries, a commercial geolocation database, or a community project. That matters because CIDR ranges for a country can change when an ISP reallocates address space, and an hourly update only helps if the upstream source is itself accurate. ## Getting the data: no install, just clone or download There is no installation step. You clone the repository or download the files directly. The README shows no command, but the standard git workflow applies: git clone https://github.com/ebrasha/cidr-ip-ranges-by-country.git. After that, you can read a specific file, for example a file in the directory for the United States, and feed its lines into a firewall script or a geolocation lookup. Because the files are plain text, you can also fetch them over HTTP using raw URLs, which makes automation straightforward. However, the README does not document a stable URL pattern for raw files, so you would need to inspect the repository layout on GitHub to construct those URLs. That is a minor hurdle, but one the author could have addressed with a single example. ## The hourly update claim: what it does and does not mean The README states the repository is updated every hour, but it does not explain how that update happens. There is no visible automation in the README, no mention of a CI pipeline, and no release history retrieved. The last push is unknown. That means you cannot confirm the hourly cadence without checking the repository's commit history yourself. Even if the repository is updated hourly, the data quality depends on the upstream source. If the source is a static list that changes rarely, hourly updates add little value. If the source is dynamic, hourly updates could help you react to new allocations or reassignments. The README gives you no way to tell which case applies. For a security use case, that uncertainty matters because a stale or incomplete range could let traffic bypass your rules. ## Where this dataset falls short The most obvious limitation is the lack of licensing information. The repository lists no license, which means you have no legal clarity on how you can use the data. For internal testing, that may be acceptable, but for redistribution or commercial use, it is a blocker. The README also gives no accuracy guarantees, no coverage statistics, and no method for verifying that a given IP address maps to the correct country. Country-level geolocation is inherently approximate, especially for IP ranges that span borders or are assigned to international organizations. The repository does not address these nuances. It is also not a tool: there is no script to merge ranges, no deduplication logic, and no way to query the data programmatically beyond reading the text files. If you need to process thousands of ranges, you will have to write your own parser. ## Alternatives with a different approach A well-known alternative is the MaxMind GeoLite2 databases, which provide IP-to-country mapping in a binary format with a library for lookup. The difference in approach is that MaxMind offers a structured database with a query API, whereas this repository offers raw CIDR lists. MaxMind also publishes a license and a clear update schedule, though it requires an account and a license key for downloads. Another alternative is the ip2country projects that aggregate ranges from regional registries, such as the 'ip-location-db' on GitHub, which provides CSV and MMDB formats. The key difference is that those projects often document their data sources and provide scripts to regenerate the data. This repository does neither. If you need auditability and a clear license, those alternatives are safer. If you just want a quick list to block a country in a firewall, this repository may be enough. ## Maintenance and upgrade considerations Because the repository is just text files, maintenance cost is low on your side. You can automate downloads with a cron job that fetches the raw files every hour, matching the stated update cadence. However, you must handle file changes carefully. If a file is replaced, you need to reload your firewall rules or update your geolocation cache. There is no versioning or changelog in the README, so you cannot easily track what changed between updates. That makes debugging harder if a range disappears or appears unexpectedly. The license issue also affects maintenance: if the author later changes the data source or the license, you have no contractual protection. You should also consider that the repository is maintained by a single individual, Ebrahim Shafiei, as stated in the README. That is not a problem by itself, but it means the project's continuity depends on one person. Check the commit history and the last push date before you build a production pipeline around it. ## Conclusion Adopt ebrasha/cidr-ip-ranges-by-country if you need quick, hourly-refreshed country-level CIDR lists for firewall rules, network filtering, or geolocation prototypes, and if you can tolerate the uncertainty around data sources and licensing. Do not use it for production geolocation or compliance-critical filtering without first auditing the ranges against a known-good source, because the README gives no indication of which upstream registries or allocation lists feed the files. Before deployment, verify the license (the repository declares none), check the freshness of individual files (the hourly update claim is not backed by timestamps in the README), and test a sample of ranges against your own routing or geolocation data. If those checks pass, the repo offers a convenient, directory-based structure with separate IPv4 and IPv6 files per country, but treat it as a starting point rather than a definitive database. ## FAQ ### What is the CIDR IP range? This repository stores them as CIDR ranges rather than individual addresses, in plain text files grouped by country, with one file for IPv4 and one for IPv6 inside each country directory. It covers all countries and the text says it is updated every hour. ### Can you provide a list of IP addresses by country? That is what the repository is. Each country has its own directory holding an IPv4 file and an IPv6 file whose names end in the same fixed suffix, with the country code as the only variable part, and the lists are updated every hour. ### How to determine country of origin IP address? The ranges are organised by country for exactly this purpose, and the stated uses include geolocation, firewall rules, network filtering and cybersecurity. Beyond choosing the file for a country, the readme gives no lookup steps and no statement about how the country attribution is derived. ### How to check if IP is in CIDR range? The repository hands you the ranges and stops there. The usage section only says to open the country directory and pick the IPv4 or IPv6 file, and the deliverable is a set of text files rather than a tool, so the comparison itself is left to your own matching code. ## Sources - [Official README](https://github.com/ebrasha/cidr-ip-ranges-by-country#readme) - [Project repository](https://github.com/ebrasha/cidr-ip-ranges-by-country) - [README](https://github.com/ebrasha/cidr-ip-ranges-by-country/blob/master/README.md) - [Releases](https://github.com/ebrasha/cidr-ip-ranges-by-country/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/ebrasha-cidr-ip-ranges-by-country