I am not familiar with Firehol, so I might be missing something, but isn't this already solved in a (potentially) more powerful, mature and standardized way by DNS RPZ (Response Policy Zones, [1])? Well-established resolvers like Unbound fully support integrating multiple block lists (like oisd.nl, energized.pro, abuse.ch, etc), keeping them up-to-date via zone transfers or HTTPS download, see [2].

[1] https://www.isc.org/rpz/ [2] https://unbound.docs.nlnetlabs.nl/en/latest/topics/filtering...

But why? Firehol seems entirely dead at this point.

Take a look at the bug reports on github, on the IP address change metric, and research the people behind it. They seem to have moved on. It's not being maintained, and still pulls from defunct lists, dead lists, and so on.

Interesting. Why not offer the db as files to download for faster local lookup though? That's what geoip databases do (for a price).

dig 199.195.253.247 @ipshield.dev +short

Apparently, Tor Exit nodes are under safe category.

I would rather have a API than digging around to find out abusive IPs