CVEHarbor Threat IP Intelligence | 2026-10-28T17:58:02.803589+00:00
Permanent logical group: Suspicious IP Block
Cumulative indexed IPs: 20
New since prior published snapshot: 0
REVIEW ONLY: reported indicators are NOT approved firewall blocks.
Do not apply blindly. Check allowlists, cloud/VPN ownership and your logs.
No rules or policies are created or enabled. No old IPs are removed.
The incremental file is not a comparison against your firewall.
If you skipped an update, use the cumulative file and reconcile existing objects.
Collection timestamps are NOT verified source last-seen times.

Sophos Firewall uses an XML API, NOT FortiGate CLI syntax.
Templates below contain placeholders, not credentials.
Use a trusted management host and an authenticated POST to /webconsole/APIController.
Ensure the firewall XML API supports this request on your firmware.
Submit the XML portion as ONE request and inspect the API response.
Add / update host objects only after admin review.
Never overwrite an existing group HostList without reading its current members.
No firewall rule is created or activated.

===== XML REQUEST START =====
<Request>
  <Login>
    <Username>REPLACE_ADMIN_USERNAME</Username>
    <Password>REPLACE_ADMIN_PASSWORD</Password>
  </Login>
  <Set operation="add">
  </Set>
</Request>
===== XML REQUEST END =====

IMPORTANT: Host creation above does NOT add hosts to an existing group.
Sophos group updates can REPLACE the complete HostList.
Read the existing IPHostGroup named 'Suspicious IP Block' using the XML API.
Merge the newly created host names with ALL existing members, deduplicate,
then submit an IPHostGroup edit with that complete merged HostList.
Do not issue a group edit containing only the new IPs.
New host names to merge: