Sterlabs IOC feed.

1. In Fireware Web UI, go to Firewall › Aliases and click Add. In Policy Manager it's Setup › Aliases.
2. Name the alias, for example Sterlabs-IOC, then click Add to add a member.
3. Set the member type to IP Address/Domain Feed.
4. Paste your unique combined feed URL into Host URL. Set Refresh Interval to 60 minutes (the default).
5. Set Authentication Type to None for a token URL. To use your portal login instead, choose HTTP and enter your username and password. Click OK, then Save.
6. Add the alias to the Blocked Sites list, or put it in the From list of a deny policy (inbound) and the To list of a deny policy (outbound).

If a sync fails, the Firebox keeps the last good list, including across reboots.

1. Go to Firewall › Aliases (Web UI) or Setup › Aliases (Policy Manager) and click Add.
2. Name it Sterlabs-IOC-Domains, click Add, and choose IP Address/Domain Feed.
3. Paste your unique domain feed URL into Host URL and set Refresh Interval to 60 minutes. Set Authentication Type to None for a token URL, or HTTP with your portal login. Click OK, then Save.
4. Add the alias to the Blocked Sites list, or to the To list of an outbound deny policy.

WatchGuard accepts domains and wildcard domains in the same alias type it uses for IPs. Domain feeds hold fewer entries than IP feeds.

1. In UniFi Network, go to Networks › Network Lists and click Create New.
2. Name the list, for example Sterlabs IOC. Set Type to IP and Source to Dynamic.
3. Paste your unique IPv4 feed URL. Set the refresh interval to 24 hours and save.
4. Open the zone-based firewall policies (under Settings › Policy Engine or Settings › Security, depending on version) and create a Block policy: source zone External, source Sterlabs IOC, destination zone Internal.
5. Create the same policy with destination zone Gateway to protect the gateway itself.
6. Create an outbound Block policy: source zone Internal, destination zone External, destination Sterlabs IOC. Move all three above any allow rules.

A UniFi IP list holds IPv4 or IPv6, not both. UniFi alerts you if a dynamic list fails to update. If you use IPv6, repeat steps 1–3 with your unique IPv6 feed URL and add matching block policies for it.

1. Go to Networks › Network Lists and click Create New.
2. Name it Sterlabs IOC Domains. Set Type to Domain and Source to Dynamic.
3. Paste your unique domain feed URL, set the refresh interval to 24 hours, and save.
4. Create an outbound Block policy: source zone Internal, destination zone External, destination Sterlabs IOC Domains. Move it above your allow rules.

UniFi blocks a domain by resolving it to IPs, which can also block legitimate sites on shared hosting or CDNs. For cleaner domain blocking, load the same URL into a DNS filter such as Pi-hole or AdGuard Home and point your clients at it.

1. Go to Object › Match Objects › Dynamic Group and click Add.
2. Enter a name, for example SterlabsIOC. SonicOS adds the DEAG_ prefix on save. Set Zone Assignment to WAN.
3. Leave FQDN off. Turn on Periodic Download and set Download Interval to 1 hour.
4. Set Protocol to HTTPS and paste your unique IPv4 feed URL into URL Name. Click Save.
5. Go to Policy › Rules and Policies › Access Rules. Add a Deny rule from WAN to Any with the DEAG as the Source.
6. Add a second Deny rule from LAN to WAN with the DEAG as the Destination. Place both above your allow rules.

SonicOS builds a read-only address group from the feed and refreshes it on the interval you set. If you use IPv6, add a second Dynamic Group with your unique IPv6 feed URL and block it the same way.

1. Go to Object › Match Objects › Dynamic Group and click Add.
2. Name it SterlabsIOCDomains and set Zone Assignment to WAN.
3. Turn FQDN on. Turn on Periodic Download and set the interval to 1 hour.
4. Set Protocol to HTTPS, paste your unique domain feed URL into URL Name, and click Save.
5. Add a Deny access rule from LAN to WAN with the domain group as the Destination. Place it above your allow rules.

Keep domains in their own group. SonicWall advises against mixing domains and IPs, and it doesn't accept wildcards.

1. Go to Security Fabric › External Connectors and click Create New.
2. Under Threat Feeds, choose IP Address.
3. Name it Sterlabs-IOC, paste your unique IPv4 feed URL into URI of external resource, and set Refresh Rate to 60 minutes. Click OK.
4. Open the connector and click View Entries to confirm the IPs loaded as valid.
5. Go to Policy & Objects › Firewall Policy. Create an inbound policy with Action: Deny and the feed as Source.
6. Create an outbound Deny policy with the feed as Destination. Move both to the top of the list.

To protect the FortiGate itself, also reference the feed in a local-in policy from the CLI. If you use IPv6, add a second IP Address connector with your unique IPv6 feed URL and use it in the same policies.

1. Go to Security Fabric › External Connectors, click Create New, and under Threat Feeds choose Domain Name.
2. Name it Sterlabs-IOC-Domains, paste your unique domain feed URL, set the refresh rate to 60 minutes, and click OK.
3. Go to Security Profiles › DNS Filter and edit the profile you use, or create one.
4. Under FortiGuard Category Based Filter, find the feed under Remote Categories and set it to Block or Redirect to Block Portal. Click OK.
5. Apply the DNS filter profile to your outbound internet policy under Security Profiles.

This only works for DNS lookups that pass through the FortiGate, so make sure clients can't use outside DNS servers or DNS over HTTPS.

1. Go to Objects › External Dynamic Lists and click Add.
2. Name it Sterlabs-IOC and set Type to IP List.
3. Paste your unique combined feed URL into Source. Set Check for updates to Hourly.
4. Click Test Source URL to confirm it loads, then click OK.
5. Go to Policies › Security. Add a Deny rule with the list as the Source Address, and a second with it as the Destination Address. Place both above your allow rules.
6. Click Commit.

If the firewall can't reach the URL, it keeps using the last list it downloaded.

1. Go to Objects › External Dynamic Lists and click Add.
2. Name it Sterlabs-IOC-Domains, set Type to Domain List, and paste your unique domain feed URL into Source. Set updates to Hourly and click OK.
3. Go to Objects › Security Profiles › Anti-Spyware, edit your profile, and open the DNS Policies tab.
4. Add the list as an External Dynamic Lists signature source with the action set to sinkhole, and confirm sinkholing is enabled. Click OK.
5. In Policies › Security, attach the Anti-Spyware profile to your outbound rule, then click Commit.

Requires a Threat Prevention license. Clients must resolve DNS through traffic the firewall inspects.

1. In SmartConsole, open Object Explorer and choose New › More › Network Object › Network Feed.
2. Name it Sterlabs-IOC and paste your unique IPv4 feed URL into Feed URL.
3. Under Feed Parsing, set Format to Flat list, Data type to IP Address, and Delimiter to a new line. Set Ignore lines with prefix to #.
4. Under Advanced Settings, leave Authentication empty for a token URL, or enter your portal username and password. Set Check feed interval to 60 minutes.
5. Click Test Feed, pick your gateway, and confirm the IPs load. Click OK.
6. In the Access Control policy, add a Drop rule with the feed as Source and another with it as Destination. Place both above your accept rules and click Install Policy.

After the first policy install, the gateway refreshes the feed on its own with no reinstall needed, and keeps the last copy if the feed can't be reached. Each feed object holds up to 50,000 IPs. If you use IPv6, add a second Network Feed with your unique IPv6 feed URL and use it in the same rules.

1. In SmartConsole, open Object Explorer and choose New › More › Network Object › Network Feed.
2. Name it Sterlabs-IOC-Domains and paste your unique domain feed URL into Feed URL.
3. Under Feed Parsing, set Format to Flat list and Data type to Domain, with a new line as the delimiter.
4. Under Advanced Settings, leave Authentication empty for a token URL or enter your portal login, and set Check feed interval to 60 minutes. Click Test Feed, then OK.
5. Add a Drop rule with the feed as the Destination, above your accept rules, and click Install Policy.

Use a separate Network Feed object for domains rather than mixing them into the IP feed.

1. Go to Protect › Active threat response › Third-party threat feeds and click Add.
2. Name it Sterlabs IOC and set Indicator type to IPv4 address.
3. Set Action to Monitor for the first few days, so you can review hits before blocking.
4. Paste your unique IPv4 feed URL into External URL. Set Authorization to No authentication for a token URL. To use your portal login instead, choose Basic authentication and enter your username and password.
5. Keep Validate server certificate on and set Polling interval to 1 hour. Click Test connection, then Save.
6. Once you're happy with what it catches, edit the feed and change Action to Block.

For inbound NAT or WAF traffic, also turn on Remote source match (inbound traffic). That needs SFOS 22 or later.

1. Go to Protect › Active threat response › Third-party threat feeds and click Add.
2. Name it Sterlabs IOC Domains and set Indicator type to Domain.
3. Set Action to Monitor to start, so you can review hits first.
4. Paste your unique domain feed URL into External URL. Set Authorization to No authentication for a token URL, or Basic authentication with your portal login.
5. Set Polling interval to 1 hour, click Test connection, then Save. Switch Action to Block once you're happy with the results.

Each Sophos feed holds one indicator type, so the domain feed is separate from the IP feed.

1. Go to Firewall › Aliases, open the URLs tab, and click Add.
2. Name it Sterlabs_IOC and set Type to URL Table (IPs).
3. Paste your unique combined feed URL, set the update frequency to 1 day, and click Save, then Apply Changes.
4. Go to Firewall › Rules › WAN. Add a Block rule with the alias as the Source.
5. Go to Firewall › Rules › LAN. Add a Block rule with the alias as the Destination.
6. Drag both rules above your pass rules and click Apply Changes.

For more frequent updates or many feeds, the pfBlockerNG package can also load the same URL.

1. Install the pfBlockerNG package from System › Package Manager if you haven't already.
2. Go to Firewall › pfBlockerNG › DNSBL, check Enable DNSBL, and click Save.
3. Open DNSBL Feeds (DNSBL Groups in some versions) and click Add. Name the group Sterlabs_IOC.
4. Under DNSBL Source, paste your unique domain feed URL, give it a label, and set List Action to Unbound. Set Update Frequency to Every hour and click Save.
5. Go to Firewall › pfBlockerNG › Update, choose Force and Update, and click Run.

pfBlockerNG blocks through the DNS Resolver, so clients must use pfSense for DNS.

1. Go to Firewall › Aliases and click +.
2. Name it Sterlabs_IOC and set Type to URL Table (IPs).
3. Set Refresh Frequency to 1 hour.
4. Paste your unique combined feed URL into Content. Click Save, then Apply.
5. Go to Firewall › Rules › WAN. Add a Block rule with the alias as the Source, and add a Block rule on LAN with it as the Destination.
6. Move both rules to the top and click Apply changes.

Check Firewall › Diagnostics › Aliases to see the IPs loaded into the alias.

1. Go to Services › Unbound DNS › Blocklist and check Enable.
2. Paste your unique domain feed URL into the custom blocklist URLs field. You can leave the preset lists unselected.
3. Click Apply to download the list.
4. Go to System › Settings › Cron and add a job for Update Unbound DNSBLs, for example every hour.

Unbound blocks the domains for any client using OPNsense for DNS. Field names have moved slightly between releases.

1. Firewalla can't subscribe to a feed URL yet, so there are two ways to load the list. Option A is manual and suits small lists. Option B keeps the list in sync automatically and needs Firewalla MSP.
2. Option A, manual: open your unique combined feed URL in a browser and copy the entries.
3. Log in to my.firewalla.com, go to Target Lists, and click Create Target List. Name it Sterlabs IOC, paste the entries, and save.
4. In the Firewalla app or web, go to Rules and add a Block rule with Matching set to the list, applied to all devices. If the rule offers a direction setting, choose both directions.
5. Option B, automatic (MSP): create the target list once in MSP, then run a scheduled script that downloads your unique combined feed URL and updates the list through the MSP API (PATCH /v2/target-lists/<id>) with a personal access token.
6. Point the same Block rule at the MSP target list. The script keeps it current on whatever schedule you run it.

Target lists hold about 200 entries on Firewalla Web and 2,000 on MSP, so a full feed may not fit. Firewalla has said URL import is being explored but isn't supported today.

1. Firewalla can't subscribe to a feed URL yet, so there are two ways to load the list. Option A is manual and suits small lists. Option B keeps the list in sync automatically and needs Firewalla MSP.
2. Option A, manual: open your unique domain feed URL in a browser and copy the entries.
3. Log in to my.firewalla.com, go to Target Lists, and click Create Target List. Name it Sterlabs IOC Domains, paste the entries, and save.
4. In the Firewalla app or web, go to Rules and add a Block rule with Matching set to the list, applied to all devices.
5. Option B, automatic (MSP): create the target list once in MSP, then run a scheduled script that downloads your unique domain feed URL and updates the list through the MSP API (PATCH /v2/target-lists/<id>) with a personal access token.
6. Point the same Block rule at the MSP target list. The script keeps it current on whatever schedule you run it.

Target lists accept domains, with an option to match all subdomains. Size limits are the same as for IPs: about 200 entries on Firewalla Web and 2,000 on MSP.