feodo_tracker
Retrieve active botnet command-and-control servers from Feodo Tracker, covering Emotet, Dridex, QakBot, and others. Get current C2 IPs for threat detection and blocking.
Instructions
Get active botnet C2 servers from Feodo Tracker (Emotet, Dridex, QakBot, etc.)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- src/index.ts:801-810 (handler)Handler for the feodo_tracker tool. Fetches active botnet C2 server data from the public Feodo Tracker JSON feed (ipblocklist_recommended.json) and returns it as formatted JSON.
case "feodo_tracker": { // Feodo provides JSON feed of active C2s const result = await apiRequest<unknown>( "https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.json" ); return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }], }; } - src/index.ts:352-361 (registration)Registration of the feodo_tracker tool with its name, description, and input schema (empty object, no parameters required).
// Feodo Tracker (public JSON feed - no auth required) TOOLS.push({ name: "feodo_tracker", description: "Get active botnet C2 servers from Feodo Tracker (Emotet, Dridex, QakBot, etc.)", inputSchema: { type: "object" as const, properties: {}, required: [], }, }); - src/index.ts:356-361 (schema)Input schema for feodo_tracker — accepts no parameters (empty object, no required fields).
inputSchema: { type: "object" as const, properties: {}, required: [], }, }); - src/index.ts:65-65 (helper)Service flag for Feodo Tracker — always enabled (true) since the feed is public and requires no authentication.
feodo: true, // Feodo Tracker public JSON feeds still work - src/index.ts:51-51 (helper)Base URL configuration for the Feodo Tracker service, pointing to the abuse.ch downloads directory.
feodo: "https://feodotracker.abuse.ch/downloads",