Threat feed
FireHOL Level 2
Last fetched
General Blacklists · refreshed hourly · last verified
FireHOL Level 2 is a General Blacklists threat-intelligence feed, refreshed hourly, indexed by WhisperGraph.
Live data for this page is temporarily unavailable.
The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.
What is FireHOL Level 2
FireHOL Level 2 is the moderate-aggressiveness tier of the FireHOL IP lists project. It extends Level 1 with additional upstream feeds that add coverage of recently-observed scanners, brute-force sources, and short-lived abuse infrastructure — at the cost of a measurably higher false-positive rate than the Level 1 baseline. Level 2 is typically deployed as an outbound-egress filter or as an alerting overlay rather than an inbound default-block, because the broader coverage occasionally catches legitimate traffic from misconfigured or temporarily-misused IPs. It is indexed here as a useful midpoint between conservative Level 1 and aggressive Level 3.
- Refresh cadence
- hourly
Indicators currently listed
Related pages
Pivot from FireHOL Level 2 into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.