Threat feed
Feodo Tracker
Last fetched
C2 Servers · refreshed every 6 hours · last verified
Feodo Tracker is a C2 Servers threat-intelligence feed, refreshed every 6 hours, indexed by WhisperGraph. WhisperGraph currently records 5 indicators listed by it.
What is Feodo Tracker
Feodo Tracker is the abuse.ch feed dedicated to tracking botnet command-and-control infrastructure for the Feodo / Emotet / Heodo / Dridex banking-trojan family and its successors. It enumerates IP addresses confirmed to be hosting active C2 servers for these families, sourced from abuse.ch's malware sandbox runs, partner submissions, and direct campaign tracking. Each entry carries the malware family name and a first-seen timestamp; the list is one of the most surgical C2 feeds available because abuse.ch curates entries individually. It is indexed here because Feodo Tracker is a routine citation in cybercrime indictments and threat-intel reports.
- Refresh cadence
- every 6 hours
Category drift. The curated category for this feed is C2 Servers, while WhisperGraph currently files it under c2.
Indicators currently listed
5 indicators across 1 node type.
Related pages
Pivot from Feodo Tracker into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.