Skip to content
Install MCP

Threat feed

Botvrij URLs

Last fetched

Malicious Domains · refreshed daily · last verified

Botvrij URLs is a Malicious Domains threat-intelligence feed, refreshed daily, indexed by WhisperGraph.

What is Botvrij URLs

Botvrij URLs is the full-URL component of the Botvrij.eu open IOC project, complementary to the Domains and Dst IPs feeds already indexed here. It catalogues specific URLs — not just hosts — observed serving payloads, hosting phishing kits, or acting as exfiltration endpoints, sourced from the same Dutch CERT-NL community MISP exchanges and sandbox pipelines as its sibling feeds. The path-level detail is useful on shared or compromised legitimate hosting, where a host-level block would be too broad. It is indexed here as the URL-specific slice of a widely-cited European open IOC project.

Source
https://www.botvrij.eu/
Refresh cadence
daily

Category drift. The curated category for this feed is Malicious Domains, while WhisperGraph currently files it under c2.

Indicators currently listed

No indicator in WhisperGraph currently links to Botvrij URLs. That is not the same as the feed being empty — the graph indexes a subset of every feed’s published entries.

Related pages

Pivot from Botvrij URLs into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.