Skip to content
Install MCP

Threat feed

FireHOL Level 1

Last fetched

General Blacklists · refreshed hourly · last verified

FireHOL Level 1 is a General Blacklists threat-intelligence feed, refreshed hourly, indexed by WhisperGraph.

Live data for this page is temporarily unavailable.

The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.

What is FireHOL Level 1

FireHOL Level 1 is the most conservative tier of the FireHOL IP lists project — a high-confidence deny-list intended for safe deployment as a default-block at perimeter firewalls. It is composed of upstream feeds with extremely low false-positive rates: bogon address ranges, Spamhaus DROP and EDROP, dshield.org's recommended block list, and a small number of similarly stable sources. Level 2 and Level 3 add progressively more aggressive sources at the cost of higher false-positive rates. Level 1 is the most commonly deployed of the three because the false-positive risk is low enough that operators feel comfortable blocking on it without a manual review step.

Source
https://iplists.firehol.org/
Refresh cadence
hourly

Indicators currently listed

Related pages

Pivot from FireHOL Level 1 into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.