Skip to content
Install MCP

Threat feed

FireHOL Level 2

Last fetched

General Blacklists · refreshed hourly · last verified

FireHOL Level 2 is a General Blacklists threat-intelligence feed, refreshed hourly, indexed by WhisperGraph.

What is FireHOL Level 2

FireHOL Level 2 is the moderate-aggressiveness tier of the FireHOL IP lists project. It extends Level 1 with additional upstream feeds that add coverage of recently-observed scanners, brute-force sources, and short-lived abuse infrastructure — at the cost of a measurably higher false-positive rate than the Level 1 baseline. Level 2 is typically deployed as an outbound-egress filter or as an alerting overlay rather than an inbound default-block, because the broader coverage occasionally catches legitimate traffic from misconfigured or temporarily-misused IPs. It is indexed here as a useful midpoint between conservative Level 1 and aggressive Level 3.

Source
https://iplists.firehol.org/
Refresh cadence
hourly

Category drift. The curated category for this feed is General Blacklists, while WhisperGraph currently files it under blacklists.

Indicators currently listed

Indicators currently listed is temporarily unavailable.

The graph did not answer within the page budget. Refresh in a moment to retry — fresh data is fetched on the next visit.

Related pages

Pivot from FireHOL Level 2 into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.