{"uid":"cap_vZCWf7A_C-G--iu_pFWFf","slug":"sitecheck-web-intel-feodo-tracker-c2-blocklist-lookup-fa897413","name":"SiteCheck Web Intel – Feodo Tracker C2 Blocklist Lookup","description":"Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware family, country, AS and first and last seen dates. Covers only the C2 servers this feed tracks.","url":"https://api.webintel-api.workers.dev/api/security/feodotracker-c2?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 address such as 162.243.103.246 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_yJafcKhh1437hCKnaKx1P","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist and returns threat details including port, online status, malware family, country, AS, and first/last seen dates.","exampleAgentPrompt":"Can you check whether 162.243.103.246 is listed as a botnet command-and-control server on the Feodo Tracker — I want to know the malware family, port, and whether it's currently online.","exampleUseCases":[{"title":"Triage suspicious outbound connection","prompt":"One of our servers was caught making outbound calls to 185.220.101.45 — can you check if that IP is a known C2 server on the Feodo Tracker and tell me what malware family it's tied to?"},{"title":"SOC alert enrichment for Emotet","prompt":"We got a SIEM alert flagging 91.121.55.168 as potentially malicious — look it up on the Feodo botnet blocklist and tell me if it's Emotet or QakBot infrastructure, along with when it was first seen."},{"title":"Block-list pre-publication validation","prompt":"Before we push our firewall rules, can you verify that 203.0.113.72 is actually listed on the Feodo Tracker C2 feed and confirm its current online status and the port it's using?"}],"resultDescription":"Returns whether the queried IPv4 address is present in the Feodo Tracker C2 blocklist. On a hit, provides: the C2 port number, current online status, identified malware family (e.g. Emotet, QakBot), country of origin, autonomous system number and holder name, and the first and last dates the IP was observed as a C2 server. Returns no match if the IP is not in the feed.","failureModes":["IP not found in Feodo Tracker feed — returns no-hit response rather than an error","IPv6 or malformed IP address supplied — returns validation error","Feodo Tracker feed temporarily unavailable — upstream data fetch failure","IP was previously listed but aged out of the feed — false negative possible","Feed only covers Feodo-tracked families; other malware C2s will not be flagged"],"whenToPreferThis":"Use this endpoint when you specifically need to check an IP against the abuse.ch Feodo Tracker feed for Emotet, QakBot, and related botnet C2 infrastructure. Prefer this over generic IP reputation services when you need structured threat intel including port, malware family, and timeline data from the Feodo feed specifically. If you need broader abuse reporting (e.g. SSH brute force, spam), use the Blocklist.de endpoint instead.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-25T12:31:28.639Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-feodo-tracker-c2-blocklist-lookup-fa897413"}