@pipeworx/feodotracker

Connect: https://gateway.pipeworx.io/feodotracker/mcp · Install: one-click buttons

Tools: 4

Feodo Tracker MCP — abuse.ch’s tracker of botnet command-and-control infrastructure for Dridex, Emotet, Qakbot, Heodo, TrickBot, and others. Keyless.

Tools

• list(family?, status?) — current C&C IP blocklist (entire list, optional family/status filter)
• check_ip(ip) — is the given IP currently listed as botnet C&C?
• recent(hours?) — entries first seen in the last N hours
• aggressive() — full aggressive blocklist (includes older + lower-confidence IPs)

Data source

https://feodotracker.abuse.ch/downloads/ipblocklist.json (cached 15 min by the gateway).

Tools

• list — Current C&C blocklist (optional malware-family / status filter).
• check_ip — Check whether a given IPv4 is on the current blocklist.
• recent — Blocklist entries first seen in the last N hours.
• aggressive — Full aggressive blocklist (includes older + lower-confidence IPs).