Blocklist-ipsets is a repository of dynamically updated IP blocklists maintained through FireHOL's update-ipsets.sh script.
The project aggregates IP blocklists from multiple sources to help organizations defend against distributed attacks, malware, command-and-control infrastructure, and other abuses. Rather than manually tracking individual blocklists from different providers, the tool consolidates them into a single repository that updates automatically via cron job. Users can pull the repository regularly to refresh all lists at once, providing a unified approach to incorporating shared threat intelligence into firewall rules. The lists cover categories including known attack sources, malware infrastructure, open proxies, and other abuse vectors.
Organizations should use this tool if they operate firewalls that support ipsets and want to leverage community-maintained threat intelligence without managing multiple list sources independently. The project is particularly suited to teams that prefer centralized list management and can tolerate daily update frequency. The accompanying website at iplists.firehol.org provides direct access to individual files and comparison information to help users select appropriate lists for their security posture.
The project maintains a stable update cadence with automated daily refreshes driven by cron-based execution of the update script. Development activity centers on the automated pipeline that fetches, processes, and commits blocklist updates to the repository, with the tool's self-maintaining character reflected in its reliance on scheduled script execution rather than manual intervention.
