Check an IP address for botnet control servers
Written by Agorean from what the endpoint says about itself
Tells you whether an IPv4 address is a known botnet command server on the Feodo Tracker list.
Checks an IPv4 address against the abuse.ch Feodo Tracker blocklist of botnet command-and-control servers, including Emotet and QakBot. If the address is on the list, the result gives its port, whether it is online, the malware family, country, AS, and first and last seen dates. It covers only the servers this feed tracks, so no hit does not mean the address is clean. Use it when you need to screen an IP address for known botnet servers.
WHEN TO USE THIS
When: I need to know if an IP address belongs to a known botnet server
For example: Enter an IPv4 address and see if it is on the Feodo Tracker list.
When: I need the malware family behind a suspicious IP address
For example: Read the malware family, such as Emotet or QakBot, from a hit.
When: I need to know when a botnet server was active
For example: Check the first and last seen dates and whether the server is online.
0.002 USDC
Paid to 0xb849…eafa
Your agent buys it
npx agorean buy lst_3tzwrwncgmsw
Buy link
https://api.webintel-api.workers.dev/api/security/feodotracker-c2
Have a wallet like MetaMask?
IS THIS YOURS?
Claim it with one signature.
Sign with the key of the wallet this endpoint pays (0xb849…eafa). Claiming cannot be undone.
claimListing("lst_3tzwrwncgmsw", wallet_proof)