What blacklists for NGINX do you use, and should you use them?

Question

Nginx

The story is this: my ISP sent me a complaint saying:

"Але! Тут тебя вроде как дудосят? Ты че-то будешь делать с этим?!"
Ну и я - как простой обыватель интернетов, полез в гугль, перелопатил несколько статтей по этой тематике на хабре ну и парочку из-за бугра, настроил соответствующим образом nginx и используя утилиту, которая читает логи nginx, перебанил все адреса этого нехорошего дядьки, у которого ничего не получилось (я надеюсь. Эни вэй: желаю ему всего хорошего - "как говориться денег нет, но вы держитесь").
Паралельно, я нашел несколько ресурсов, которые предоставляют списки множества адресов по разным категориям, разного слоя интернет жуликов и бандитов(в том числе и ТОR сети из которой мало что полезного может прийти на сервак).

Actually the question itself:
1) Which of the following resources do you use yourself and which categories of them: www.stopforumspam.com/
www.badips.com/get/list/nginx/1
iplists.firehol.org/
2
) I can nail it myself, but can you share a ready-made bash / python script for compiling such lists for nginx include? )
3) There was a misunderstanding: in the process of blocking: when I added the ip of the evil guy to hosts.deny in the form:

ALL:111.111.111.111

I reloaded nginx, and the villain keeps banging on nginx! Why is that? Did I spell it wrong?
Sincerely ;)

Answer 1

Because using nginx to filter a DDoS attack is useless, your network channel will clog faster than these packets will reach nginx

Answer 2

0. You can use something like cloudflare. At the same time to change a hoster, time asks such questions.
1. In fact, there is little benefit from using these services, it’s better to see point 0 then.
2. There is fail2ban, for example, you can write rules for it depending on the application. And you don't need to include it in nginx, it's better to block it at the firewall level.
3. "I reloaded nginx, and the villain keeps banging on nginx! Why is that? Did I spell it wrong?"
Nginx does not use tcp-wrappers. And it's not a system level lock like iptables. This is an attempt to give a general configuration for programs, but only works for those that support it. But even those that support it often need to be configured to use this mechanism. I recommend reading more about what it is in general and how it works.