Skip to content
Install MCP

Threat feed

DShield Recommended Block List

Last fetched

General Blacklists · refreshed daily · last verified

DShield Recommended Block List is a General Blacklists threat-intelligence feed, refreshed daily, indexed by WhisperGraph. WhisperGraph currently records 59 indicators listed by it.

What is DShield Recommended Block List

DShield Recommended Block List is the SANS Internet Storm Center's curated set of network blocks its analysts recommend blocking outright, derived from DShield's crowd-sourced firewall-log submission network — one of the longest-running distributed intrusion-detection data-sharing projects on the internet. Inclusion requires sustained, corroborated abuse evidence across many contributing sensors rather than a single report, which keeps the false-positive rate low enough that the list is a common default-block reference in perimeter firewall configurations. It has been a fixture of the SANS/DShield ecosystem for over two decades. It is indexed here as one of the most established general-purpose block-list references available.

Source
https://www.dshield.org/
Refresh cadence
daily

Category drift. The curated category for this feed is General Blacklists, while WhisperGraph currently files it under blacklists.

Indicators currently listed

59 indicators across 1 node type.

PREFIX · 59

Related pages

Pivot from DShield Recommended Block List into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.