Threat-intelligence feed
C2 ServersLast verified Page fetched
Feodo Tracker is a c2 servers threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for Feodo Tracker.
Feodo Tracker is the abuse.ch feed dedicated to tracking botnet command-and-control infrastructure for the Feodo / Emotet / Heodo / Dridex banking-trojan family and its successors. It enumerates IP addresses confirmed to be hosting active C2 servers for these families, sourced from abuse.ch's malware sandbox runs, partner submissions, and direct campaign tracking. Each entry carries the malware family name and a first-seen timestamp; the list is one of the most surgical C2 feeds available because abuse.ch curates entries individually. It is indexed here because Feodo Tracker is a routine citation in cybercrime indictments and threat-intel reports.
FEED_SOURCE node confirmed. WhisperGraph carries this feed under the same category (C2 Servers) as the editorial entry above. The graph identifier abuse-ch-feodo-tracker matches the live f.id property.
Live indicator listings: not yet available. WhisperGraph's LISTED_INedge is virtual and not enumerable from the feed side — there is no query-tractable way today to fetch the IPs and hostnames listed in this feed without first visiting every candidate indicator. Indicator-anchored queries work in the opposite direction (see the Cypher snippet below) and the directory's individual IP and host pages surface their feed memberships individually. Per-feed enumeration (an indicator count and sample of representative indicators) is on the roadmap.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "Feodo Tracker"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "Feodo Tracker"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from Feodo Tracker into adjacent entities.