Threat-intelligence feed
C2 ServersLast verified Page fetched
Botvrij Dst IPs is a c2 servers threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for Botvrij Dst IPs.
Botvrij Dst IPs is the destination-IP component of the Botvrij.eu open IOC project, complementary to the Domains feed. It catalogues IP addresses observed acting as command-and-control endpoints, malware-distribution servers, or exfiltration sinks during sandbox runs and member-SOC investigations. Records originate in MISP events maintained by the Dutch CERT-NL community and partner CERTs across Europe. The feed is most useful as outbound-egress filtering at proxy and firewall layers, and as a SIEM enrichment overlay for endpoint connection logs. It is indexed here because it is a widely-cited C2-tracking feed in the European response community.
Live data unavailable. WhisperGraph returned an error (WhisperGraph 524) while looking up this FEED_SOURCE node. The editorial content above is authoritative; the live-data check will retry on the next page revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "Botvrij Dst IPs"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "Botvrij Dst IPs"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from Botvrij Dst IPs into adjacent entities.