🛡️ Feodo Tracker C2 Scraper

🚀 Pull the live abuse.ch Feodo Tracker botnet C2 blocklist in one run. Get every command-and-control server with IP, port, online status, ASN, country, and malware family, ready for blocklisting and SOC enrichment.

Feodo Tracker is a public threat-intelligence project run by abuse.ch that tracks the command-and-control (C2) infrastructure behind major banking trojans and loaders such as Emotet, QakBot, Dridex, TrickBot, BumbleBee and Pikabot. This Actor fetches the official Feodo Tracker IP blocklist and returns one clean row per C2 server so security teams can ingest fresh indicators of compromise (IOCs) without scraping HTML.

This is a defensive, public-data threat-intelligence tool. Every record comes straight from the abuse.ch public download feed. Use it to feed firewall and SIEM blocklists, enrich alerts in a SOC, hunt for malicious infrastructure, or back research into botnet hosting patterns.

🎯 Target Audience	💡 Primary Use Cases
SOC and blue-team analysts	Blocklist firewalls, proxies, and DNS
Threat intelligence teams	Enrich alerts with C2 context
Incident responders	Confirm whether an IP is a known C2
Detection engineers	Build and tune IOC detections
Security researchers	Study botnet hosting and ASN trends

📋 What the Feodo Tracker C2 Scraper does

• Fetches the official abuse.ch Feodo Tracker IP blocklist (full or recommended).
• Returns one row per C2 server with IP, port, status, ASN, country, and malware family.
• Filters by malware family (for example Emotet or QakBot), online status, and country.
• Caps the number of rows returned so you can pull a quick sample or the whole list.
• Uses only the public download feed, no login, no API key, no images.

📊 Data fields

Each record includes: asName, asNumber, country, firstSeen, hostname, ipAddress, lastOnline, listType, malware, port, results, scrapedAt, status. These field names come straight from the actor's dataset schema, so what you see here is what lands in your dataset.

🚀 How to use

1. Sign in or create a free Apify account using this sign-up link.
2. Open the Feodo Tracker C2 Scraper and pick the full or recommended blocklist.
3. Optionally set a malware family, status, or country filter.
4. Set maxItems and click Start.
5. When the run finishes, browse the dataset or pull it through the API into your tools.

🔗 Recommended Actors

• URLhaus Malware URLs Scraper. Pull the abuse.ch URLhaus feed of malware distribution URLs.
• Vulnerability Security Intel Scraper. Collect structured vulnerability and security intelligence.
• GitHub Security Advisories Scraper. Track CVE-backed advisories across open source packages.
• IP Geolocation Scraper. Enrich any IP with country, ASN, and network details.
• RIPEstat Scraper. Query RIPE network and routing data for ASNs and prefixes.

💡 Pro Tip: browse the complete ParseForge collection.

⚠️ Disclaimer: This is an independent tool and is not affiliated with abuse.ch or the Feodo Tracker project. Only publicly available data is collected, and it is provided for defensive security and research purposes.

🆘 Need Help?

If you hit a bug, have questions about setup, or need a scraper we haven't built yet, open our contact form or write to parseforge@protonmail.com. We also take on paid custom data projects.

For faster answers, join our Discord. It's the best place to get support and suggest new actors.