Threat feed
FireHOL Abusers 1d
Last fetched
General Blacklists · refreshed hourly · last verified
FireHOL Abusers 1d is a General Blacklists threat-intelligence feed, refreshed hourly, indexed by WhisperGraph. WhisperGraph currently records 24,034 indicators listed by it.
What is FireHOL Abusers 1d
FireHOL Abusers 1d is the 24-hour rolling abusers view from the FireHOL IP lists project. It is a meta-feed assembled from a large set of upstream community deny-lists, filtered to the IPs that have been reported as actively abusive in the last day. The 1-day window makes the list well-suited to high-confidence outbound-egress blocking where staleness is more costly than false negatives. The FireHOL project maintains the largest open catalogue of IP reputation lists and has been a fixture of the open-source threat-intel ecosystem for over a decade. It is indexed here as a baseline current-abuse view.
- Refresh cadence
- hourly
Category drift. The curated category for this feed is General Blacklists, while WhisperGraph currently files it under blacklists.
Indicators currently listed
24,034 indicators across 2 node types.
Related pages
Pivot from FireHOL Abusers 1d into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.