Threat-intelligence feed
Brute ForceLast verified Page fetched
Blocklist.de SSH is a brute force threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for Blocklist.de SSH.
Blocklist.de SSH is the SSH-targeting subset of the Blocklist.de fail2ban federation. It aggregates IPs reported by participating administrators as having attempted SSH brute-force or password-spray attacks against their hosts; entries arrive in near-real-time and roll off the list when reports stop. The feed is widely used by individual server operators as a free deny-list for cloud and on-premises SSH gateways, frequently in combination with cloud-provider native firewalls. It is indexed here as a record because SSH brute force is one of the most commonly cited threat categories in incident reports.
FEED_SOURCE node not currently in WhisperGraph. The editorial entry for Blocklist.de SSHis committed to the directory but the corresponding graph node is missing — typically a transient state during the threat-feed import pipeline's between-runs window. The page will reconcile on the next revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "Blocklist.de SSH"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "Blocklist.de SSH"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from Blocklist.de SSH into adjacent entities.