Threat feed
FireHOL Level 3
Last fetched
General Blacklists · refreshed hourly · last verified
FireHOL Level 3 is a General Blacklists threat-intelligence feed, refreshed hourly, indexed by WhisperGraph. WhisperGraph currently records 34,516 indicators listed by it.
What is FireHOL Level 3
FireHOL Level 3 is the broadest tier of the FireHOL IP lists project. It extends Level 2 with additional feeds covering recently-observed abuse, mass-scanning sources, and reputation-based deny-lists with looser inclusion criteria. The trade-off is a noticeably higher false-positive rate than Level 1 or Level 2; Level 3 is best used as a SIEM enrichment overlay or alert-triage signal rather than as a default-block. Operators who deploy it at the perimeter typically pair it with a documented allow-list workflow to handle the false positives. It is indexed here because Level 3 is a frequent citation in DDoS post-mortems.
- Refresh cadence
- hourly
Category drift. The curated category for this feed is General Blacklists, while WhisperGraph currently files it under blacklists.
Indicators currently listed
34,516 indicators across 3 node types.
HOSTNAME · 1
Related pages
Pivot from FireHOL Level 3 into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.