Frequently Asked Questions (FAQ)

The Feodo Tracker datasets are empty - is that right?

The Feodo Tracker datasets are currently empty thanks to various successful takedowns conducted by Law Enforcement Agencies, including Emotet in 2021 and Operation Endgame in 2024, which targeted the malware families tracked by Feodo Tracker. As a result, there are no active botnet C2 servers at the moment assocaited with these malware families, which is why the datasets are currently empty.

If you are looking for additional datasets to protect your organization/users from botnet C2 communications, we recommend contacting Spamhaus about their Botnet Controller List (BCL), which is e.g. available through a BGP feed.

We at abuse.ch work closely with Spamhaus to maintain this BCL dataset, which contains single IPv4 addresses hosting active botnet C2s. The status of these botnet controllers is re-evaluated several times a day to identify active botnet controllers only. This dataset contains approximately 800 – 2,500 entries, with up to 50 new detections every 24 hours, and is available in various formats.