# Feodo Tracker C2 Scraper (`parseforge/feodo-tracker-c2-scraper`) Actor

Fetches the abuse.ch Feodo Tracker botnet C2 blocklist. Choose full or recommended list, filter by malware family, status, and country, and export IP indicators as a flat dataset.

- **URL**: https://apify.com/parseforge/feodo-tracker-c2-scraper.md
- **Developed by:** [ParseForge](https://apify.com/parseforge) (community)
- **Categories:** Other, Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $6.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

[![ParseForge](https://raw.githubusercontent.com/ParseForge/apify-assets/main/banner.jpg)](https://apify.com/parseforge?fpr=vmoqkp)

### Feodo Tracker C2 Scraper

**Scrape the Feodo Tracker C2 blocklist from abuse.ch, pulling the full or recommended IP list with malware family, status, and country filters.** Every row returns the IP, port, malware family, last-seen timestamp, and hosting details. No API key needed. Export to JSON, CSV, Excel, or XML.

Feodo Tracker by abuse.ch is a free, community-driven blocklist of botnet command and control servers. Security teams need this data in their SIEM, firewall, or threat intel platform, but manually downloading and parsing CSV feeds breaks automation. This Actor fetches the live blocklist on a schedule, applies your filters, and hands you a clean dataset ready for block rules.

| Who uses it | What they scrape Feodo Tracker for |
|---|---|
| SOC analysts | Ingest the latest C2 IPs into a SIEM watchlist to detect compromised hosts beaconing out. |
| Threat intelligence teams | Enrich internal alerts with up-to-date malware family and C2 infrastructure data. |
| Network security engineers | Automate firewall block rule updates from the curated recommended blocklist. |

### What it does

This Actor collects IP-based C2 server indicators from the abuse.ch Feodo Tracker feed and returns each one as a flat row with its malware family, status, and network metadata.

- 🛡️ **Curated blocklist:** Pull the recommended subset that abuse.ch advises for active blocking, reducing false positives.
- 📋 **Full blocklist:** Fetch every tracked botnet C2 server for broadest coverage and research.
- 🦠 **Malware family filter:** Narrow results to a specific threat like Emotet, QakBot, or Dridex with a partial, case-insensitive match.
- 🌍 **Country filter:** Restrict C2 servers to a specific hosting country using a two-letter ISO code, for example US, RU, or CN.
- 🔴 **Status filter:** Collect only online C2s actively responding, only offline sinkholed ones, or both.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

### What you can do with Feodo Tracker data

**🚨 Automate firewall block rules.**

A network engineer runs the Actor daily for the recommended blocklist, filters for online C2s, and pushes the IP list to a firewall address group via API.

**🔍 Hunt for Emotet infections.**

A SOC analyst pulls the full blocklist filtered by malware family 'Emotet' and status 'online', then cross-references the IPs against outbound connection logs.

**🌐 Map C2 infrastructure by country.**

A threat researcher collects all C2 servers hosted in a specific country to track the geographic distribution of botnet infrastructure over time.

**📊 Feed a threat intel platform.**

A threat intel team schedules the Actor to push fresh Feodo Tracker indicators into their TIP, enriching internal events with malware family context.

### Why choose this scraper

|  | What you get |
|---|---|
| **No API key** | Fetches the public abuse.ch feed directly with no registration or authentication. |
| **Fixed schema** | Every row delivers the same fields: IP, port, malware family, status, and timestamps. |
| **Schedulable** | Run on a cron to keep firewall rules and watchlists continuously updated. |
| **Filter at source** | Malware, status, and country filters reduce dataset size before it hits your storage. |

### How it compares

This Actor focuses exclusively on the Feodo Tracker feed with direct filters. The Threat Intel IOC Feed Aggregator normalizes six feeds at once and adds cross-feed corroboration.

| Feature | ParseForge | Threat Intel IOC Feed Aggregator |
|---|---|---|
| Dedicated Feodo Tracker feed | Yes, full and recommended blocklists | Yes, as one of six feeds |
| Malware family filter | Yes, partial case-insensitive match | Not listed |
| C2 online/offline status filter | Yes | Not listed |
| Country filter by ISO code | Yes | Not listed |
| Cross-feed IOC corroboration | No, single feed only | Yes |
| Delta mode for new IOCs only | No | Yes |

### Configure the run

Drive the Actor by choosing the full or recommended blocklist, then narrow results with optional malware family, online status, and country filters that run as each indicator is read so only matches reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

```json
{
  "maxItems": 10
}
```

A larger pull:

```json
{
  "maxItems": 200
}
```

### Pricing

Pay-per-result: **$0.008 per result** collected. You pay only for the results written to your dataset.

| Results collected | Approximate cost |
|---|---|
| 100 results | $0.80 |
| 1,000 results | $8.00 |
| 10,000 results | $80.00 |

New Apify accounts start with $5 in free credit.

### Free users

Free-plan runs return up to 10 results as a preview. [Upgrade your Apify plan](https://console.apify.com/sign-up?fpr=vmoqkp) to collect up to 1,000,000 results per run.

### Run it

1. [Create a free Apify account with $5 in credit](https://console.apify.com/sign-up?fpr=vmoqkp).
2. Open the [Feodo Tracker C2 Scraper](https://apify.com/parseforge/feodo-tracker-c2-scraper?fpr=vmoqkp).
3. Set your inputs and any filters, then click **Start**.
4. Export the results as CSV, Excel, JSON, or XML from the **Dataset** tab.

Run it programmatically through the [Apify API](https://docs.apify.com/api/v2) (`run-sync-get-dataset-items`) or the [ApifyClient](https://docs.apify.com/api/client/js) for JavaScript and Python.

### Use with AI agents (MCP)

Give an AI agent live access to Feodo Tracker through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

```bash
claude mcp add --transport http apify "https://mcp.apify.com/?tools=parseforge/feodo-tracker-c2-scraper"
```

Then prompt it in plain language to run the scraper and read back the results.

### Troubleshooting

**Why am I getting no results?**

Check your filter combinations. A very specific malware family filter combined with a narrow country code or 'offline' status can return zero matches. Try broadening one filter at a time.

**The run failed with an error.**

The abuse.ch feed may be temporarily unavailable. Retry the run after a few minutes. If the problem persists, check the Apify log for the specific HTTP error code.

**My country filter is not working.**

Ensure you are using a valid two-letter ISO 3166-1 alpha-2 country code, for example 'US' not 'USA', and 'GB' not 'UK'.

**The malware family filter returns unexpected results.**

The filter is a partial, case-insensitive match. Searching for 'emotet' will also match 'emotet\_epoch4'. Use a more specific string if you need an exact match.

**I need more fields than what the Actor returns.**

This Actor returns the standard Feodo Tracker CSV fields. For enriched data like ASN or reverse DNS, you could chain this Actor's output into an IP enrichment actor.

### FAQ

| Question | Answer |
|---|---|
| What is the difference between the full and recommended blocklists? | The full blocklist contains every C2 server Feodo Tracker has ever tracked. The recommended blocklist is a curated subset that abuse.ch suggests for active blocking, with a lower false positive rate. |
| Do I need an API key from abuse.ch? | No. This Actor reads the public CSV feeds that abuse.ch publishes freely. No registration, API key, or authentication is required. |
| How often is the Feodo Tracker data updated? | abuse.ch updates the blocklists continuously. Schedule this Actor to run hourly or daily to keep your dataset in sync with the latest C2 indicators. |
| Can I filter by a specific malware family? | Yes. Use the malware family filter with a partial, case-insensitive string like 'emotet' or 'qakbot' to return only C2 servers tied to that family. |
| What does the status filter do? | It lets you collect only online C2 servers that are actively responding, only offline servers that have been sinkholed, or both. |
| How do I filter by country? | Provide a two-letter ISO country code like 'US', 'RU', or 'CN' in the country filter field. The Actor will return only C2 servers hosted in that country. |
| What export formats are supported? | You can export your dataset to JSON, CSV, Excel, or XML from the Apify dataset tab. |
| Can I run this on a schedule? | Yes. Apify actors support cron schedules. Set it to run hourly or daily to keep your blocklists and watchlists continuously updated. |
| Is there a limit on how many C2 servers I can collect? | You can set a maximum up to 1,000,000 rows per run. The full blocklist typically contains a few thousand entries, so this is more than enough. |
| Does this Actor deduplicate entries? | The Feodo Tracker feed itself does not contain duplicates per IP. If you need cross-feed deduplication, consider a multi-feed aggregator. |

### Related actors

Browse the full [ParseForge collection](https://apify.com/parseforge?fpr=vmoqkp) for more scrapers.

🆘 **Need help?** Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ **Disclaimer.** This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by abuse.ch. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.

# Actor input Schema

## `listType` (type: `string`):

Which abuse.ch Feodo Tracker feed to fetch. 'Full' returns every tracked botnet C2 server. 'Recommended' returns the curated subset abuse.ch suggests for active blocking.

## `malware` (type: `string`):

Optional. Keep only C2 servers tied to this malware family, for example 'Emotet', 'QakBot', or 'Dridex'. Case insensitive, partial match. Leave empty to return every family.

## `status` (type: `string`):

Filter by C2 server status. 'Online' returns servers seen responding recently. 'Offline' returns sinkholed or dead C2s. 'Any' returns both.

## `country` (type: `string`):

Optional. Keep only C2 servers hosted in this country, given as a two letter ISO code, for example 'US', 'GB', or 'RU'. Leave empty for all countries.

## `maxItems` (type: `integer`):

How many C2 servers to collect per run.

## Actor input object example

```json
{
  "listType": "full",
  "status": "any",
  "maxItems": 10
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("parseforge/feodo-tracker-c2-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "maxItems": 10 }

# Run the Actor and wait for it to finish
run = client.actor("parseforge/feodo-tracker-c2-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 10
}' |
apify call parseforge/feodo-tracker-c2-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,parseforge/feodo-tracker-c2-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/QDY3W2eoI7dqGUcZg/builds/qI3If2dnoZjw0EUTQ/openapi.json