FireHOL
Conservative firewall blocklists: Level 1 for the worst ranges, Level 2 for addresses that attacked in the last 48 hours.
- Blocklist
What it is
FireHOL maintains ready-made blocklists for firewalls. Level 1 aims for maximum protection with minimum false positives. It combines DShield, Feodo Tracker, fullbogons and Spamhaus DROP.
Level 2 adds addresses that attacked during the last 48 hours according to feeds such as Blocklist.de, DShield and GreenSnow. It is fresher and wider, so it catches more but can still hold hosts that were cleaned meanwhile.
What it checks
- Level 1: DShield, Feodo Tracker, fullbogons, Spamhaus DROP
- Level 2: attack sources of the last 48 hours (Blocklist.de, DShield, GreenSnow)
How to read the result
- Level 1 listed
- The range is a bogon, hijacked, or a known botnet / attack source. Reliable.
- Level 2 listed
- The address attacked recently. Worth caution, but it may already be cleaned.
- Not listed
- Neither level names the address.
Limits
- IPv4 only.
- Both levels hold ranges, so one bad host can list its whole subnet.
- FireHOL itself warns that every list has some false positives.
How it is used here
Both levels are shown as separate “listed / not listed” cards. Each listing adds points to the overall risk.