This IP list is a composition of other IP lists.

An ipset made from blocklists that track attacks, spyware, viruses. It includes IPs that have been reported or detected in the last 30 days.

It includes the following IP lists:

- bruteforceblocker — danger.rulez.sk IPs detected performing SSH bruteforce attacks.
- ciarmy — ciarmy.com collective intelligence, a scoring system for IP addresses based on the volume and frequency of unwanted traffic.
- dshield_30d — All IPs reported by dshield (SANS Internet Storm Center) over the last 30 days.
- myip — myip.ms blacklist of IPs identified as web bots, crawlers, and spammers.
- vxvault — VxVault the latest malware hosting IPs.

This list casts a wider net than firehol_level2 and may include some false positives, especially for IPs that were flagged weeks ago but may no longer be malicious.

See also: firehol_level1, firehol_level2, firehol_level4.