Suricata and IP blacklist

Ah, never knew about the ipv4.hdr buffer. Very interesting.

The issue, however is that you are matching against the raw ipv4 header.
This means that the source and destination IP is not represented as a plaintext IP.
If you want a rule to match traffic towards 8.8.8.8 for instance you need a rule with ipv4.hdr; content:"|08 08 08 08|"; as you are matching the binary content directly.