[firehol_level3]: github.com (140.82.121.3) is listed

[hsiewert]

140.82.121.3 is github.com and is in firehol_level3

NetRange: 140.82.112.0 - 140.82.127.255 CIDR: 140.82.112.0/20 NetName: GITHU NetHandle: NET-140-82-112-0-1 Parent: NET140 (NET-140-0-0-0-0) NetType: Direct Assignment OriginAS: AS36459 Organization: GitHub, Inc. (GITHU) RegDate: 2018-04-25 Updated: 2019-06-20 Ref: https://rdap.arin.net/registry/ip/140.82.112.0

OrgName: GitHub, Inc. OrgId: GITHU Address: 88 Colin P Kelly Jr Street City: San Francisco StateProv: CA PostalCode: 94107 Country: US RegDate: 2012-10-22 Updated: 2021-05-20 Comment: https://github.com Comment: Please contact us directly for matters pertaining to abuse. Comment: Urgent matters including DDoS are handled 24x7. Ref: https://rdap.arin.net/registry/entity/GITHU

OrgAbuseHandle: GITHU1-ARIN OrgAbuseName: GitHub Abuse OrgAbusePhone: +1-415-857-5430 OrgAbuseEmail:
OrgAbuseRef: https://rdap.arin.net/registry/entity/GITHU1-ARIN

OrgNOCHandle: GITHU-ARIN OrgNOCName: GitHub Ops OrgNOCPhone: +1-415-735-4488 OrgNOCEmail:
OrgNOCRef: https://rdap.arin.net/registry/entity/GITHU-ARIN

OrgTechHandle: GITHU-ARIN OrgTechName: GitHub Ops OrgTechPhone: +1-415-735-4488 OrgTechEmail:
OrgTechRef: https://rdap.arin.net/registry/entity/GITHU-ARIN

[maverick85]

Coming across this issue as well.

[pradig]

Same here, I did a policy rule on my DNS to resolve GitHub.com with 140.82.121.4 as long as 140.82.121.3 is listed, and it works like a charm now. It also possible to put a temporary line in your /etc/hosts.

[maverick85]

I disabled the level3 ipset still have level1 and 2. In the past the level3 list had more false positives, in the meanwhile it got better, but it seems it decided to act up again.

[adrianrudnik]

Just happend again, 140.82.121.3 is found within https://iplists.firehol.org/files/firehol_level3.netset

# Version         : 41250
# This File Date  : Tue Jun 28 10:12:19 UTC 2022

[adrianrudnik]

And again

# Version         : 41282
# This File Date  : Fri Jul  1 20:12:33 UTC 2022

Seems like the source is vxvault that gets imported into level 3, not sure why.

[gempa-stephan]

Once more

# Version         : 42668
# This File Date  : Mon Nov 14 13:12:58 UTC 2022

[pfactum]

Happened for 140.82.121.4 today.