Source-aware records
Aligned arrays keep each list, category, maintainer, URL and source date together. Repeated contributions remain intact.
Inspect the schema → OPEN SOURCE / IP REPUTATION
IP intelligence.
One database.
FireHOL blocklists, compiled into a single MMDB. Look up IPv4 and IPv6 addresses while keeping the sources behind every match.
RUST GENERATORDEEP MERGEGZIP LEVEL 9
SOURCE FILES149.ipset + .netset
CONTRIBUTIONS7.99MDuplicates preserved
STORED PREFIXES3.83MIPv4 + IPv6 networks
SCHEDULEHourlyAt minute 17 UTC
Counts describe the verified 05 Oct 2026 source snapshot; they are not live counters. Scheduled runs can be delayed by GitHub.
01 / BUILT FOR LOOKUPS
[ provenance preserved ]Context behind every IP.
Overlaps included
More-specific networks inherit broader source contributions. Deep merging keeps the full source context for a match.
Follow the pipeline →Verified before upload
Rust and independent MaxMind readers validate the MMDB. The archive is decompressed and checked against its original SHA-256.
Download verified files →02 / DATABASE DISTRIBUTIONTwo files.
Two files.
One source snapshot.
Choose the original database or download the smaller gzip-9 archive. Stable URLs always point to the rolling release.
Verified snapshot · 05 Oct 2026Release notes ↗
READY TO READ
Original MMDB
The database for direct use with compatible MaxMind DB readers.
136.51 MBfirehol-blocklist-ipsets.mmdb
Download MMDB ↓SHA-256
164d9e105c3acbd0ab19c39987fe688df4dc88dc376faa55bc4a9bb52300cb7fSMALLER DOWNLOAD
Compressed archive
Maximum gzip level 9. Contains only the same validated MMDB file.
53.60 MBfirehol-blocklist-ipsets.mmdb.tar.gz
Download tar.gz ↓SHA-256
f07d6f17e09d31b69f3c25e1f80c2e0deb14d3d7c59de63293dbc2b85dc2f8e9LESS TO TRANSFER60.74% smaller
82.91 MB saved per download · decimal MB
TERMINAL / QUICK START
Download. Extract. Read.
● ● ● shell / download
curl -fL --retry 3 -o firehol-blocklist-ipsets.mmdb.tar.gz \
https://github.com/0x00F6/blocklist-ipsets/releases/download/firehol-blocklist-ipsets/firehol-blocklist-ipsets.mmdb.tar.gz
tar -xzf firehol-blocklist-ipsets.mmdb.tar.gz● ● ● python / lookup
# Install once: python3 -m pip install maxminddb
import maxminddb
with maxminddb.open_database("firehol-blocklist-ipsets.mmdb") as db:
record = db.get("1.1.1.1")
print(record) # Source arrays if listed; None if no match.Snapshot date, not build time
build_epoch is the committer timestamp of the exact FireHOL source commit.
- Source date (UTC)
- 2026-10-05 09:17:32 UTC
- build_epoch
- 1791191852
- Source commit
- 3417de0f1f36 ↗
One rolling release
Each successful build publishes a new release with both files, then retires the previous release. The publication date is renewed and the download links stay the same. GitHub's automatic source-code archives contain repository sources; use the MMDB download buttons above for the generated database.
Showing the last verified snapshot. Live release details are requested when this page loads.
03 / SOURCE TO DATABASETraceable inputs.
Traceable inputs.
Verified output.
An hourly GitHub Actions workflow mirrors FireHOL, builds unpublished snapshots and publishes both validated downloads.
Mirror the upstream commit
main is an exact commit-level mirror of FireHOL's master. The generator checks out the verified immutable SHA. Pipeline code lives on the default mmdb-pipeline branch.
Parse in parallel
Rayon parses .ipset and .netset files recursively. *_country directories, hidden directories and symlinks are excluded. Bare addresses become /32 or /128.
Preserve the contributions
Batched external sorting and explicit ancestor propagation retain overlapping sources. A single libmaxminddb-rs writer uses MergeStrategy::DeepMerge with aligned arrays and duplicates.
Verify, compress and publish
Rust and independent MaxMind readers check the database and source timestamp. The gzip-9 archive passes a CRC and SHA-256 round trip. Both files are confirmed in the new published release before the previous release is deleted. The stable tag is then reassigned to the replacement.
Retries that follow publication
An unchanged source skips compilation only when both assets exist and publication is complete. Missing assets or a pending replacement trigger another build, including a failed forced rebuild of the same commit. Interrupted publication or tag handover resumes on the next run.
Inspect GitHub Actions ↗Measured on a real snapshot
The 05 Oct 2026 snapshot passed 866 independent lookups. The original production generation took 4.77 seconds with 905,268 KiB peak resident memory. Measurements depend on the runner and input data.
The final writer trie is in memory. Total memory grows with distinct prefixes and metadata combinations.
04 / RECORD PROVENANCEEvery source.
Every source.
Kept in context.
Record fields are parallel arrays. Values at the same index belong to the same contribution, including repeated sources.
● ● ● illustrative record / not a live lookup
{
"files": ["feodo.ipset", "ipsum_7.ipset"],
"categories": ["malware", "abuse"],
"maintainers": ["Abuse.ch", "stamparm"],
"maintainer_urls": ["https://feodotracker.abuse.ch/", ""],
"source_urls": [
"https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt",
""
],
"source_file_dates": ["2026-03-12T07:15:03Z", ""],
"versions": ["549", ""]
}| Field | Meaning |
|---|---|
files | Contributing source file names |
categories | Canonical categories such as malware, abuse, botnet and spam |
maintainers | Source maintainer names |
maintainer_urls | Maintainer website URLs |
source_urls | Original feed URLs |
source_file_dates | Source header dates; recognized UTC dates normalized to ISO 8601 |
versions | Source header version values |
Alignment is part of the format
Missing optional metadata uses an empty string. Duplicates remain in place, and update frequency is never stored. Array ordering is deterministic.
Global MMDB metadata
database_type: firehol-blocklist-ipsetsip_version: 6 (IPv4 + IPv6)languages: ["en"]binary format: 2.0
Node count and record size are computed by the writer. build_epoch follows the source commit's committer date.