◆ IOC feeds

abuse.ch Feodo Tracker

CC0-1.0

Botnet command-and-control IP blocklists, plus a matching Suricata/Snort ruleset, free to download with no key.

Summary

From the project’s own instructions where it documents any; otherwise a plain clone.

Download from feodotracker.abuse.ch ↗
Start from the source page, or use the commands below.

shell

$ curl -LO https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt

Active botnet C2 IPs only, the list to block on.

shell
```
$ curl -LO https://feodotracker.abuse.ch/downloads/ipblocklist.csv
```
Every C2 seen in the last 30 days, with malware family and first-seen date.

Commands are curated, not yet run by us.

jq — Stream the records one per line to see their shape before loading them anywhere.

sample.json

$ jq -c . sample.json

DuckDB — Query the file in place with SQL — DuckDB detects CSV and JSON by extension.

sample.csv

$ duckdb -c 'SELECT * FROM '\''sample.csv'\'' LIMIT 10'

ffuf — Fuzz a test target's paths with one of the collection's wordlists.

sample.txt

$ ffuf -u http://127.0.0.1:3000/FUZZ -w ./abuse-ch-feodo-tracker/Discovery/Web-Content/common.txt