Hysen Labsfirehol-mirror
Cron caching of https://iplists.firehol.org (without private networks a.k.a RFC1918)
Firehol mirror repackages IP blocklists without private ranges
borestad/firehol-mirror is a cron-driven cache of the FireHOL IP lists with private (RFC1918) addresses stripped out. It also archives stale lists and normalizes netset and ipset formats.
Why the mirror exists
The README lists the project goals as removing all private IPs, auto archiving deprecated blocklists older than one month, and applying a proper TTL so it does not spam iplists.firehol.org. It also fixes inconsistencies between .netset files, which contain subnets, and .ipset files, which contain single IPs. The author frames git as a more efficient protocol for fetching text files than repeated HTTP pulls.
How it helps consumers
Beyond mirroring, the project enables static analysis and aims to prevent false positives by cleaning the data. It also detects which upstream blocklists are lagging behind their source, so users can spot stale feeds. Because the lists are kept in git, consumers can fetch diffs and history instead of re-downloading whole files on every update.
Attribution
The README closes by giving all credit to FireHOL and the maintainers of the underlying blocklists. The project presents itself as a mirror with extra cleanup steps rather than an original source of threat intelligence, and the cleanup work is what distinguishes it from pulling the FireHOL lists directly.
Editorial conclusion
The repository credits FireHOL and the blocklist maintainers for the underlying data while adding private-range filtering and staleness handling.
Community notes