Threat feed
Brute Force Blocker
Last fetched
Brute Force · refreshed hourly · last verified
Brute Force Blocker is a Brute Force threat-intelligence feed, refreshed hourly, indexed by WhisperGraph. WhisperGraph currently records 671 indicators listed by it.
What is Brute Force Blocker
Brute Force Blocker is a long-running OpenBSD-derived community feed of IP addresses observed performing SSH brute-force attacks against participating hosts. The collection mechanism is a small reporting daemon that watches authentication logs and submits offending IPs to the central project; the published list is the union of all participants' reports over a rolling window. The feed has a reputation for low false positives because the contributing population skews toward administrators of internet-exposed BSD and Linux servers — the exact environments where SSH brute force is most disruptive. It is indexed here as a stable, decade-old record for SSH abuse research.
- Refresh cadence
- hourly
Category drift. The curated category for this feed is Brute Force, while WhisperGraph currently files it under bruteforce.
Indicators currently listed
671 indicators across 2 node types.
PREFIX · 1
Related pages
Pivot from Brute Force Blocker into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.