ThreatHive.net

Block ThreatHive IPs on a UniFi gateway

UniFi Network can download IP lists from a URL and use them in firewall policies. Each list is capped at 100,000 entries, so the ThreatHive blocklist is also published in 100,000-address parts that fit.

UniFi Network
11.0 or later
UniFi OS
6.0.10 or later
Address family
IPv4 only
Entries per list
100,000 max

Feed URLs

Each part is a plain text file with one IPv4 address per line. Together, the parts contain the same addresses as the full blocklist.

Part A
https://threathive.net/hiveblocklist-100k-a.txt
Part B
https://threathive.net/hiveblocklist-100k-b.txt
Part C
https://threathive.net/hiveblocklist-100k-c.txt

The blocklist currently holds about 170,000 addresses, so parts A and B carry entries today. Part C fills once the list grows past 200,000. Add all three now and you won't need to change the setup later.

If your controller reports a failed update for part C while it is still empty, leave it out for now and add it when it has entries. New parts are announced in the news section.

Setup

  1. Check your versions Dynamic network lists arrived in UniFi Network 11. Confirm the gateway runs UniFi Network 11.0 or later on UniFi OS 6.0.10 or later, and update it first if it doesn't. The gateway also needs outbound HTTPS access to threathive.net to download the lists.
  2. Create a network list for part A In UniFi Network, go to Networks › Network Lists and click Create New. Fill in:
    NameThreatHive A
    TypeIP (IPv4)
    SourceDynamic
    URLhttps://threathive.net/hiveblocklist-100k-a.txt
    Refresh interval24 hours
    Save the list. UniFi downloads it straight away and then on the interval you picked.
  3. Repeat for parts B and C Create two more lists the same way, named ThreatHive B and ThreatHive C, using the -b.txt and -c.txt URLs.
  4. Block inbound traffic from the lists Open the firewall policy table (Settings › Policy Engine) and click Create Policy:
    NameBlock ThreatHive inbound
    ActionBlock
    Source zoneExternal
    SourceIP, then select the network lists ThreatHive A, B and C
    Destination zoneInternal, plus any other zone you expose (DMZ, Hotspot)
    DestinationAny
    ProtocolAll
    LoggingOn, if you want to see hits
  5. Block outbound traffic to the lists Create a second policy for the other direction. This stops devices on your network from connecting to listed hosts, which is where a compromised device would send its traffic.
    NameBlock ThreatHive outbound
    ActionBlock
    Source zoneInternal (and any other internal zones)
    SourceAny
    Destination zoneExternal
    DestinationIP, then select ThreatHive A, B and C
    ProtocolAll
  6. Check policy order UniFi evaluates policies from the top. Make sure both ThreatHive policies sit above any custom allow policy that covers the same zones, or the allow rule will match first.
  7. Verify Open each network list and confirm it shows downloaded entries. From a device on your LAN, ping an address from part A: the request should time out, and with logging on, the hit appears in the gateway's traffic and firewall logs.

Things to know

  • Update interval. ThreatHive updates the list every 15 minutes, but UniFi's shortest refresh interval is 24 hours. A UniFi gateway can therefore be up to a day behind the live feed. UniFi shows an alert if a scheduled download fails.
  • Total entry limit. UniFi also limits the total number of entries across all network lists on a gateway (500,000 at the time of writing). If you already use other large lists, count them in.
  • IPv6. The ThreatHive blocklist contains IPv4 addresses only. Don't select these lists in IPv6 policies.
  • Menu names. Labels can shift between UniFi Network releases. If a field above is named slightly differently on your controller, pick the closest match.
  • False positives. If an address you need is blocked, check it with the IP lookup and email [email protected] for removal.

Last reviewed 4 November 2026. Questions or corrections: [email protected].