This IP list is a composition of other IP lists.

An ipset made from blocklists that track attacks, during about the last 48 hours.

It includes the following IP lists:

- blocklist_de — blocklist.de is a free and voluntary service provided by a Fraud/Abuse-specialist, whose servers are often attacked via SSH, mail-login, FTP, webserver and other services. The mission is to report all attacks to the abuse departments of the infected PCs/servers to ensure that the host responsible for the attack is informed and opens a snort or opens a snort or snort ticket.
- dshield_1d — All IPs reported by dshield (SANS Internet Storm Center) over the last 24 hours. This typically includes 60k-120k unique IPs per day.
- greensnow — GreenSnow harvests IPs from a large number of computers located around the world. It monitors attacks and bruteforce attempts on: Scan Port, FTP, POP3, mod_security, IMAP, SMTP, SSH, cPanel, etc.

This list is suitable for servers that need to block recent attack sources without being too aggressive. It is meant to be used on top of firehol_level1.

See also: firehol_level1, firehol_level3, firehol_level4.