Skip to content
Install MCP

Threat feed

FireHOL Anonymous

Last fetched

Proxies · refreshed hourly · last verified

FireHOL Anonymous is a Proxies threat-intelligence feed, refreshed hourly, indexed by WhisperGraph.

What is FireHOL Anonymous

FireHOL Anonymous is the anonymising-infrastructure rollup from the FireHOL IP lists project. It aggregates known Tor exit nodes, public open proxies, and known commercial VPN egress IPs from a curated set of upstream feeds. The intent is operational: many fraud-prevention and abuse-response teams want to flag (not necessarily block) traffic from known anonymising infrastructure, and a single combined list reduces feed-management overhead. The feed is intentionally broader than any individual upstream — sub-feeds covering only Tor or only commercial VPNs are also published separately. It is indexed here as a record for anonymous-traffic policy decisions.

Source
https://iplists.firehol.org/
Refresh cadence
hourly

Category drift. The curated category for this feed is Proxies, while WhisperGraph currently files it under proxies.

Indicators currently listed

Indicators currently listed is temporarily unavailable.

The graph did not answer within the page budget. Refresh in a moment to retry — fresh data is fetched on the next visit.

Related pages

Pivot from FireHOL Anonymous into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.