Threat-intelligence feed
General BlacklistsLast verified Page fetched
FireHOL Level 1 is a general blacklists threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for FireHOL Level 1.
FireHOL Level 1 is the most conservative tier of the FireHOL IP lists project — a high-confidence deny-list intended for safe deployment as a default-block at perimeter firewalls. It is composed of upstream feeds with extremely low false-positive rates: bogon address ranges, Spamhaus DROP and EDROP, dshield.org's recommended block list, and a small number of similarly stable sources. Level 2 and Level 3 add progressively more aggressive sources at the cost of higher false-positive rates. Level 1 is the most commonly deployed of the three because the false-positive risk is low enough that operators feel comfortable blocking on it without a manual review step.
Live data unavailable. WhisperGraph returned an error (WhisperGraph 524) while looking up this FEED_SOURCE node. The editorial content above is authoritative; the live-data check will retry on the next page revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "FireHOL Level 1"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "FireHOL Level 1"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from FireHOL Level 1 into adjacent entities.