HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
firehol
blocklist-ipsets
Shell2018–2026
firehol / blocklist-ipsets

blocklist-ipsets

ipsets dynamically updated with firehol's update-ipsets.sh script

Security & Privacy
Explore on GitHubRead Hacker News discussions
2Distinct people
26Mentions
0Explicit recommenders
4KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

ipsets dynamically updated with firehol's update-ipsets.sh script

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 9:01:12 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year26 dated mentions

Observed mentions: 2018-08-08 17:08:51 UTC to 2026-09-11 12:05:20 UTC.

0123452018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC321
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC202
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC211
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC505
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC404
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC303
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC303
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC303

What Hacker News says

3 sources
LinuxBender·Feb 20, 2023
FWIW all of those IP's are in FireHol 30 day netset [1] from the FireHol Repo [2] They are known abusers and safe to null route if you happen to run your own mail servers, blogs, etc... wc -l firehol_abusers* 7260 firehol_abusers_1d.netset 184010 firehol_abusers_30d.netset # first grep for any IP's you care about and then: for Ip in $(cat firehol_abusers_30d.netset);do ip route add blackhole "${Ip}" 2>/dev/null;done If that cuts down on the noise then create a startup script to do this on reboot. The first time this should be done from a web console vs. ssh in case the list contains your own IP address or gateway. Why ip route vs ipset or iptables? Far less CPU load than netfilter. A more generic way to keep many bots out is to redirect anything other than HTTP/2.0 to a password protected listener. T
Read the rest
his will block Google bots as they still do not support HTTP/2.0 but will also block a majority of the problematic bots. [1] - https://github.com/firehol/blocklist-ipsets/blob/master/fire... [2] - https://github.com/firehol/blocklist-ipsets
In Ask HN: What are these strange random strings spamming my blog?
LinuxBender·Jan 29, 2023
fun way to mess with these people? To some extent yes, give them a status 200 for anything they send at you, especially for your default catch-all domain/IP/virtual-host. In NGinx this looks like error_page 404 500 501 502 503 504 =200 /some_generic_message.html; I would personally just disable fail2ban. It just consumes more CPU especially if using it with iptables. If using ip route blackhole {ip} its not as bad but still a waste of time in my opinion. There are enough known compromised hosts out there to add millions of entries to your routing table ahead of time. [1] Add headers and content to the generic message file that has links to URL's like WordPress, wp_login.php, wp-story.php, js/file-uploader, nf_tracking.php, about.php, wp-reset.php and others. To minimize writes on your disk, set custom logs for your default virtu
Read the rest
al-host/IP/domains to either write into a tmpfs ram disk or to /dev/null once you get bored watching them. If writing to tmpfs be sure to set up a more frequent log rotation and less retention. Be sure to also set the HTTP keepalive time very low so they are not wasting your resources. No need to tarpit them, most of the code used by these bots will time out after a few seconds. [Edit] I should add, these are not hackers you are messing with. They are just parasitical script-kiddies that prey on the weak, most often using their batches of WordPress hosts as jump-off points and watering hole phishing sites to scam the elderly out of their life savings. Making them lose money would be great too! That's much harder. Most of the IP's you see do not belong to the attacker. The attacker is likely using a set of Command and Control C&C nodes that control a swath of end-user PC's and Wordpress servers infected with malware. Anything you do will cost them nothing but it might slow their threads down a little. The only way to make them lose money would be to find who is controlling the C&C nodes, gather evidence and have law enforcement take them down. To do this one would have to break the law by hacking into the compromised host and see what C&C nodes it is dialing home to, then hack into those hosts and see who is connecting to them. They could be using Tor but most people are lazy enough to not do this. [1] - https://github.com/firehol/blocklist-ipsets.git
In Ask HN: Best Way to Mess with Hackers?
LinuxBender·Jan 11, 2023
Tor exits are tracked longer term here [1] and in a few other block-list repos. The data is built from Tor's exit node list [2] An IP can also be queried in ExoneraTor [3] to see if it was ever a Tor exit node. Could all of this could be added to the tool? [1] - https://github.com/firehol/blocklist-ipsets [2] - https://check.torproject.org/exit-addresses [3] - https://support.torproject.org/glossary/exonerator/
In Show HN: A Golang package and tool to detect Tor exit IP addresses

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.