FIREHOL LEVELS 1,2,3,4 COLLECTIVELY BLOCKS MORE THAN 1000 CLOUDFLARE'S IPS. PEOPLE WHO USE CLOUDFLARE'S DNS PROXY FOR THEIR WEBSITES, WHICH HALF OF THE WORLDS WEBSITES USES, GETS AESSAGE SAYING THAT THEIR WEBSITE IS OFFLINE BY CLOUDFLARE ... PLEASE REMOVE THEM ASAP. FIND THEIR NETBLOCKS/IP RANGES ON THEIR WEBSITE. https://www.cloudflare.com/...

Hi can you add my personal list? It contains bad crawler ip address, update frequence 10 min, expiration entries 1 day.

https://www.texilee.it/bad-...

My ipblock made it out to firehol list 4. Weird, my network is not used for anything weird. I am trying to figure out who to contact to investigate this.

Why is 10.0.0.0/8 on the list ?! no rfc1918 addressses should be on this list!! Can cause major outage.

Why is the IP of github.com on this list?!

8.8.8.8 made it to firehol_3 today

The openbl.org has been discontinued since 2017, please remove it (and if you're user ignore it)

What is your policy on classifying dynamic IP ranges? My ADSL IP just
landed on a list (not sure how to look up which list it originated
from)

My feeling is, the only acceptable classification for dyn-ip is that they are indeed dynamic.

Also,
is there a way to query your list to determine where my entry
originated from? I like to contact the upstream source and inquire about
their policy on dynamic IP.
I only know that my IP apparently was a TOR exit node at some point.

I found https://api.incolumitas.com...
But it doesn't give any context on where the entry came from.

Hi,
Can you add CloudFilt lists ? https://cloudfilt.com/
They are really good, based on the behavior of the users clients to the solution.
Thank you

Hello , i think there is an issue in https://raw.githubuserconte... , it contain a subnet 0.0.0.0/8 ... are you sure this is the right entry there ?

Hello. We are MONITORAPP AICC.(https://aicc.monitorapp.com)
We also want to contribute to the data we analyzed.
Can you tell us the procedure?
we would like to talk to you by email. (aicc@monitorapp.com)
Thank you!

https://github.com/oklokl/a... I made a batch file that can be applied to Windows. My computer skills are not good. So I produced it with 70% of the help of others. finally applied to Windows. Thank you. Windows users, please try it a lot. I'm happy. I'm satisfied. I can't speak English. The text was produced in Seoul Korean.

Hi Ernest

You should consider getting your feeds added to the pfBlockerNG extension for the pfSense Firewall. Perhaps the different firehol_levels.

https://redmine.pfsense.org...
https://www.reddit.com/r/pf...
https://uploads.disquscdn.c...

My IP is currently listed and is a false positive. No idea what to do about this. There doesn't appear to be a way to get in contact with anyone about false positives. Somewhat horse shit. I won't be using FireHOL and I will add one testimonial telling others, these lists DO have false positives.

On the delist issue you must contact a list maintainer. Links to their websites are on every list page. Firehol only collects lists and converts them to a usable format.

Who can I contact about the website? Website or hosting (but most likely cloudflare) slows down some requests and does not allow downloading files from HTTPS links from my static IP (10-20 files are downloaded by a bot, one by one, very gently). There are no problems with other IP and proxies. Currently available download from HTTP link. Everything worked great for a year...

Answer myself: most likely the problem was due to my ISP or upstream providers. They blocked or slowed down many secure connections (possible traffic inspection).

Dear FireHol, the lists

geolite2_country/country_ng.netset
geolite2_country/continent_af.netset
seems not mantained since 2019... can we ask to remove from your site? These are blocking request from few websites from my organization (based in Italy)

Also the following sets have active source and updated now: nixspam, bruteforceblocker, sblam.

This is blocking requests to thousands of sites hosted using Vercel.com. Including sites from Uber, The Washington Post, and McDonald's.

What is the downside of blocking a fake news site like The Washington Post?

Is there any API for tihs to fetch these IP's List?

There's a "Download Local Copy" button. You can pull the IPs straight from that link. In Python, it would look like this:
import requests
response = requests.get("https://iplists.firehol.org...", allow_redirects=True)
ipList = response.content.decode().splitlines()

For the second time, there is some reason the IP to our site, 151.101.65.195 (api.redux.io) has been blacklisted with this site for crypto mining?? Clearly, this is a mistake. No such thing exists on our server. Please remove as it's affecting some of our clients. If you;re going to blacklist our site and interfere with business, there should be some way report such mistakes and get them cleared up. Thanks!

This is a very meaningful job. Can I get the previous data, such as the ip-list a week ago?

has it occurred to any of you that this site isn't maintained anymore? He formed NetData and chunked the peace sign out the window a long time ago. The three year old retentions of ips..... the flat lines in the graphs.... any of this triggering a light bulb? It's still pulling data from spamhause and a few others, you can check on github. if you are on those lists talk with them I suppose. It is aggregating a bunch of other dead lists though so good luck.

For some reason, the IP to our site, 151.101.65.195 (api.redux.io) has been blacklisted with this site for crypto mining?? Clearly, this is a mistake. No such thing exists on our server. Please remove as it's affecting some of our clients. Thanks!

I am a Windows 10 user.
(firehol_level1.netset) I'd like to use it.
Is there any way?
Thank you. :)

195.110.124.188 is the ip of the scientific journal epiprev.it. Please remove it from firehol_level1 list! Thanks.

If you are admin of that ip, make sure your systems are secured - https://www.abuseipdb.com/c...

Also, make sure you don't block traffic from your systems to firehol_level1

firehol_level1 should be used only for blocking traffic from (and not "to") internet to your edge iface. Don't blindly block the all traffic with that ipset.

Hi,
140.82.121.4 is a Github host - exclude, please

Hi, our IP 81.169.145.68 (www.sensry.net) is on the blacklist (https://github.com/Ultimate.... This is probably false positive. Could you please check and remove?

Regards
Mario (Sensry-Service-Team)

Hi, 23.227.38.65 appears in firehol_level1 and firehol_level4. This IP is of the Shopify CDN with numerous sites hosted there and can't be safely blacklisted.

Possible false positive? I'm seeing the IP that cncf.io resolves to - 23.185.0.3 - included in firehol_level1.netset

Anyway to incorporate these lists into ublock or any other browser extension?

Jesus. I know that i'm a little late to the party, but I'm STOKED to find your resources. I'm a DBA, I'd love to help with anything you guys need. i'm a bit underutilized, but this has been my best month in five years, so I'm ecstatic. I'm serious I'm crazy good with MSSQL, and a couple of other databases. Anything you guys need, i'd be glad to help wherever and whenever I can. https://DatabaseAaron.com/e...

Hi, I'm facing the same issue as ArmyG. below. IPs 23.227.38.65 and 199.34.228.76. Both in same situation as ArmyG's 89.46.108.57. All Three are listed in bambenek_c2.ipset. This list is not reliable and should be discarded. These IPs are large CDNs used by over 10,000 websites. They can't be safely blacklisted.

Goodmorning to all, i am an Internet service provider and i am using level1 list in a part of my network for testing purpose. it's a week that everithing is just going fine but i experienced just one issue related to a false positive (in my humble opinion) the ip 89.46.108.57 it's in your list but is not listed in any of delist sites i uses, so every morning i have to remove it manually because my customers have to connect to a website hosted there. Could you please help me to manage this issue ? Thank you for sharing your work , your fantastic list and thank you in advance for your help. Armando.

What is the expected download size of firehol_level1.netset? Is 40Kb the usual size?.

Hello, I cannot find any ToS for these feeds? Are they free for commercial usage as well? Please advise.

I am using the this list to protect websites mostly Wordpress. I have created a way to stop hackers from getting to the site, with this list I have 2,943,299,814,871 blocked IP address, Thank you for the list. Global Site Guard

is it possible to get ip list history?

RST Cloud free feed
https://github.com/rstcloud...

Greetings,

This list is an almost great first-pass filter for inbound and outbound traffic, but at present the stated requirement to "have no false positives. All IPs listed should be bad and should be blocked, without exceptions" appears to be violated by the inclusion of the stale bambenek_c2 malware list, which FireHOL has not been able to fetch since April 14th (123 days ago as of this post). Perhaps this issue is related to changed licensing terms by Bambenek Consulting.

1. Can this issue be solved?
2. If not, can bambenek_c2 be removed from firehol_level1?
3. Should there perhaps be a rule that any included sub-list temporarily get removed if FireHOL cannot fetch updates for some set amount of days?

Thanks much,

- Richard.

Hello Team,
This IP 118.174.21.41 is blackiisted in mxtoolbox but not present in firehol. Please let me know the reseon why it i not present here

I am at best a novice here but the main file - firehol1.netset file - currently seems very small with a short list. Is it possible the site or the file has somehow been compromised?

Awesome work. Good foundation to stop most of the riff raff!!!

Is it possible to get all lists at once? OR
Is it possible to get all lists at once with REST API ?

Is there a listing for 23.236.62.147, and if there is, why and how can we resolve it?