This IP list is a composition of other IP lists.

An ipset made from blocklists that track attacks, but may include a large number of false positives.

It includes the following IP lists:

- blocklist_net_ua — blocklist.net.ua IPs that have been observed performing attacks, collected by Ukrainian honeypots.
- botscout_30d — BotScout IPs of bots caught registering on forums and polluting databases over the last 30 days.
- cybercrime — CyberCrime IPs used by malware Command and Control servers.
- iblocklist_hijacked — iBlocklist list of hijacked IP ranges.
- iblocklist_spyware — iBlocklist list of IPs associated with known spyware.
- iblocklist_webexploit — iBlocklist list of IPs associated with web exploits.

This is the most aggressive of the firehol levels. It includes lists that may have significant false positive rates. Use with caution and only if you understand the risk.

See also: firehol_level1, firehol_level2, firehol_level3.