Feodo Tracker C2 Scraper

Feodo Tracker C2 Scraper

Scrape the Feodo Tracker C2 blocklist from abuse.ch, pulling the full or recommended IP list with malware family, status, and country filters. Every row returns the IP, port, malware family, last-seen timestamp, and hosting details. No API key needed. Export to JSON, CSV, Excel, or XML.

Feodo Tracker by abuse.ch is a free, community-driven blocklist of botnet command and control servers. Security teams need this data in their SIEM, firewall, or threat intel platform, but manually downloading and parsing CSV feeds breaks automation. This Actor fetches the live blocklist on a schedule, applies your filters, and hands you a clean dataset ready for block rules.

Who uses it	What they scrape Feodo Tracker for
SOC analysts	Ingest the latest C2 IPs into a SIEM watchlist to detect compromised hosts beaconing out.
Threat intelligence teams	Enrich internal alerts with up-to-date malware family and C2 infrastructure data.
Network security engineers	Automate firewall block rule updates from the curated recommended blocklist.

What it does

This Actor collects IP-based C2 server indicators from the abuse.ch Feodo Tracker feed and returns each one as a flat row with its malware family, status, and network metadata.

• 🛡️ Curated blocklist: Pull the recommended subset that abuse.ch advises for active blocking, reducing false positives.
• 📋 Full blocklist: Fetch every tracked botnet C2 server for broadest coverage and research.
• 🦠 Malware family filter: Narrow results to a specific threat like Emotet, QakBot, or Dridex with a partial, case-insensitive match.
• 🌍 Country filter: Restrict C2 servers to a specific hosting country using a two-letter ISO code, for example US, RU, or CN.
• 🔴 Status filter: Collect only online C2s actively responding, only offline sinkholed ones, or both.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with Feodo Tracker data

🚨 Automate firewall block rules.

A network engineer runs the Actor daily for the recommended blocklist, filters for online C2s, and pushes the IP list to a firewall address group via API.

🔍 Hunt for Emotet infections.

A SOC analyst pulls the full blocklist filtered by malware family 'Emotet' and status 'online', then cross-references the IPs against outbound connection logs.

🌐 Map C2 infrastructure by country.

A threat researcher collects all C2 servers hosted in a specific country to track the geographic distribution of botnet infrastructure over time.

📊 Feed a threat intel platform.

A threat intel team schedules the Actor to push fresh Feodo Tracker indicators into their TIP, enriching internal events with malware family context.

Why choose this scraper

	What you get
No API key	Fetches the public abuse.ch feed directly with no registration or authentication.
Fixed schema	Every row delivers the same fields: IP, port, malware family, status, and timestamps.
Schedulable	Run on a cron to keep firewall rules and watchlists continuously updated.
Filter at source	Malware, status, and country filters reduce dataset size before it hits your storage.

How it compares

This Actor focuses exclusively on the Feodo Tracker feed with direct filters. The Threat Intel IOC Feed Aggregator normalizes six feeds at once and adds cross-feed corroboration.

Feature	ParseForge	Threat Intel IOC Feed Aggregator
Dedicated Feodo Tracker feed	Yes, full and recommended blocklists	Yes, as one of six feeds
Malware family filter	Yes, partial case-insensitive match	Not listed
C2 online/offline status filter	Yes	Not listed
Country filter by ISO code	Yes	Not listed
Cross-feed IOC corroboration	No, single feed only	Yes
Delta mode for new IOCs only	No	Yes

Configure the run

Drive the Actor by choosing the full or recommended blocklist, then narrow results with optional malware family, online status, and country filters that run as each indicator is read so only matches reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

{
  "maxItems": 10
}

A larger pull:

{
  "maxItems": 200
}

Pricing

Pay-per-result: $0.008 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$0.80
1,000 results	$8.00
10,000 results	$80.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the Feodo Tracker C2 Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to Feodo Tracker through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/feodo-tracker-c2-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check your filter combinations. A very specific malware family filter combined with a narrow country code or 'offline' status can return zero matches. Try broadening one filter at a time.

The run failed with an error.

The abuse.ch feed may be temporarily unavailable. Retry the run after a few minutes. If the problem persists, check the Apify log for the specific HTTP error code.

My country filter is not working.

Ensure you are using a valid two-letter ISO 3166-1 alpha-2 country code, for example 'US' not 'USA', and 'GB' not 'UK'.

The malware family filter returns unexpected results.

The filter is a partial, case-insensitive match. Searching for 'emotet' will also match 'emotet_epoch4'. Use a more specific string if you need an exact match.

I need more fields than what the Actor returns.

This Actor returns the standard Feodo Tracker CSV fields. For enriched data like ASN or reverse DNS, you could chain this Actor's output into an IP enrichment actor.

FAQ

Question	Answer
What is the difference between the full and recommended blocklists?	The full blocklist contains every C2 server Feodo Tracker has ever tracked. The recommended blocklist is a curated subset that abuse.ch suggests for active blocking, with a lower false positive rate.
Do I need an API key from abuse.ch?	No. This Actor reads the public CSV feeds that abuse.ch publishes freely. No registration, API key, or authentication is required.
How often is the Feodo Tracker data updated?	abuse.ch updates the blocklists continuously. Schedule this Actor to run hourly or daily to keep your dataset in sync with the latest C2 indicators.
Can I filter by a specific malware family?	Yes. Use the malware family filter with a partial, case-insensitive string like 'emotet' or 'qakbot' to return only C2 servers tied to that family.
What does the status filter do?	It lets you collect only online C2 servers that are actively responding, only offline servers that have been sinkholed, or both.
How do I filter by country?	Provide a two-letter ISO country code like 'US', 'RU', or 'CN' in the country filter field. The Actor will return only C2 servers hosted in that country.
What export formats are supported?	You can export your dataset to JSON, CSV, Excel, or XML from the Apify dataset tab.
Can I run this on a schedule?	Yes. Apify actors support cron schedules. Set it to run hourly or daily to keep your blocklists and watchlists continuously updated.
Is there a limit on how many C2 servers I can collect?	You can set a maximum up to 1,000,000 rows per run. The full blocklist typically contains a few thousand entries, so this is more than enough.
Does this Actor deduplicate entries?	The Feodo Tracker feed itself does not contain duplicates per IP. If you need cross-feed deduplication, consider a multi-feed aggregator.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by abuse.ch. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.