Threat-intelligence feed
C2 ServersLast verified Page fetched
Feodo Tracker is a c2 servers threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for Feodo Tracker.
Feodo Tracker is the abuse.ch feed dedicated to tracking botnet command-and-control infrastructure for the Feodo / Emotet / Heodo / Dridex banking-trojan family and its successors. It enumerates IP addresses confirmed to be hosting active C2 servers for these families, sourced from abuse.ch's malware sandbox runs, partner submissions, and direct campaign tracking. Each entry carries the malware family name and a first-seen timestamp; the list is one of the most surgical C2 feeds available because abuse.ch curates entries individually. It is indexed here because Feodo Tracker is a routine citation in cybercrime indictments and threat-intel reports.
Live data unavailable. WhisperGraph returned an error (WhisperGraph 524) while looking up this FEED_SOURCE node. The editorial content above is authoritative; the live-data check will retry on the next page revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "Feodo Tracker"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "Feodo Tracker"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from Feodo Tracker into adjacent entities.