@pipeworx/feodotracker

Connect: https://pipeworx.io/mcp — every tool in the catalog, including @pipeworx/feodotracker’s. Install: one-click buttons

No MCP client? Skip the connection: POST https://gateway.pipeworx.io/v1/tools/search_packs {"query":"..."} to find a tool below, GET /v1/tools/<name> for its schema, POST the same URL with arguments for the data — see For AI agents.

Tools: 4

Feodo Tracker MCP — abuse.ch’s tracker of botnet command-and-control infrastructure for Dridex, Emotet, Qakbot, Heodo, TrickBot, and others. Keyless.

Tools

• list(family?, status?) — current C&C IP blocklist (entire list, optional family/status filter)
• check_ip(ip) — is the given IP currently listed as botnet C&C?
• recent(hours?) — entries first seen in the last N hours
• aggressive() — full aggressive blocklist (includes older + lower-confidence IPs)

Data source

https://feodotracker.abuse.ch/downloads/ipblocklist.json (cached 15 min by the gateway).

Tools

• list — Current C&C blocklist (optional malware-family / status filter).
• check_ip — Check whether a given IPv4 is on the current blocklist.
• recent — Blocklist entries first seen in the last N hours.
• aggressive — Full aggressive blocklist (includes older + lower-confidence IPs).