Documentation

Everything you need to point a firewall at a HubIPList feed and keep it updated automatically.

Quick start

Create a list in the console, pick your firewall vendor, and copy the URL it gives you. The feed refreshes on its own; your firewall pulls it on the schedule you set.

Firewall integration

Replace YOUR-LIST with the identifier shown in the console.

Palo Alto Networks (PAN-OS)

External Dynamic List

Go to Objects → External Dynamic Lists and click Add.
Set Type to IP List and paste the feed URL below into Source.
Choose a Repeat interval of hourly or five minutes.
Click Test Source URL to confirm the firewall can reach it, then Commit.
Reference the list in a security policy rule as a source or destination address.

Feed URL

https://hubiplist.com/feeds/YOUR-LIST/paloalto.txt

Fortinet FortiGate

External IP Feed (Threat Feed)

Go to Security Fabric → External Connectors and add an IP Address threat feed.
Paste the feed URL below into the URI of external resource field.
Set Refresh Rate to 5 minutes or more.
Use View Entries to confirm the addresses are loading.
Reference the connector as an address object in a firewall policy.

Feed URL

https://hubiplist.com/feeds/YOUR-LIST/fortigate.txt

SonicWall

Dynamic External Address Group (DEAG)

Go to Object → Match Objects → Addresses and create a Dynamic External Address Group.
Paste the feed URL below and set the download interval.
Save and wait for the first download to complete.
Use the group in an access rule.

Feed URL

https://hubiplist.com/feeds/YOUR-LIST/sonicwall.txt

Check Point

External Network Feed

In SmartConsole go to Security Policies → Shared Policies → Updatable Objects.
Add an External Network Feed and paste the feed URL below.
Set the format to Flat list and the refresh interval.
Install policy for the change to take effect.

Feed URL

https://hubiplist.com/feeds/YOUR-LIST/checkpoint.txt

Linux (nftables / ipset)

set import

Download the feed with curl on a schedule (cron or a systemd timer).
Load the addresses into a named set and reference that set from your rules.
Keep the previous set until the new one loads: a failed download should never empty your blocklist.

Feed URL

https://hubiplist.com/feeds/YOUR-LIST/nftables.txt

Feed formats

Every list is served in several formats. The extension decides what you get.

`.txt`	One address or CIDR per line. Works with every vendor above.
`.csv`	Address, source and first seen date. For spreadsheets and reports.
`.json`	Structured output with provenance for automation.

Public catalogue

Fifty provider ranges are published without an account — Cloudflare, AWS, Azure, Google Cloud, Fastly and more. Use them to allow legitimate infrastructure instead of blocking it by accident.

https://hubiplist.com/lists/cloudflare
https://hubiplist.com/lists/fastly
https://hubiplist.com/lists/bunny

API

Read-only endpoints, no authentication required.

`GET`	`/api/search?ip=1.1.1.1`	Full investigation of one address.
`GET`	`/api/providers`	Public provider catalogue.
`GET`	`/api/my-ip`	The caller’s own public address.
`GET`	`/api/intel/summary`	Indicator counts per source.

Rate limits

Feeds allow 20 requests per 10 seconds per IP. A firewall pulling every 5–60 minutes is far below that. Searches are limited to 30 per minute.