Skip to content
Install MCP

Threat feed

Botvrij Dst IPs

Last fetched

C2 Servers · refreshed daily · last verified

Botvrij Dst IPs is a C2 Servers threat-intelligence feed, refreshed daily, indexed by WhisperGraph. WhisperGraph currently records 1 indicator listed by it.

What is Botvrij Dst IPs

Botvrij Dst IPs is the destination-IP component of the Botvrij.eu open IOC project, complementary to the Domains feed. It catalogues IP addresses observed acting as command-and-control endpoints, malware-distribution servers, or exfiltration sinks during sandbox runs and member-SOC investigations. Records originate in MISP events maintained by the Dutch CERT-NL community and partner CERTs across Europe. The feed is most useful as outbound-egress filtering at proxy and firewall layers, and as a SIEM enrichment overlay for endpoint connection logs. It is indexed here because it is a widely-cited C2-tracking feed in the European response community.

Source
https://www.botvrij.eu/
Refresh cadence
daily

Category drift. The curated category for this feed is C2 Servers, while WhisperGraph currently files it under c2.

Indicators currently listed

1 indicator across 1 node type.

IPV4 · 1

Related pages

Pivot from Botvrij Dst IPs into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.