Skip to content
Osint Daily
SponsoredOctoProbe house ad, 300 by 250 pixels, published 16 Oct 2026. Still frame of the square with the OctoProbe wordmark and the line One workspace for the investigation.
Osint Daily cover for Feodo Tracker, under Threat intelligence, published 23 Oct 2026. The right side crops the listing capture. abuse.ch botnet C2 list. The active set was empty.

01 · Product name

Feodo Tracker

abuse.ch botnet C2 list. The active set was empty.

Published by abuse.ch.

FreeThreat intelligence

In short

Feodo Tracker is the botnet command-and-control list abuse.ch publishes at feodotracker.abuse.ch. On 23 Oct 2026 the statistics page said 7'980 botnet C&C servers tracked, named the United States as the top country, and named AS14618 AMAZON-AES as the top network. The FAQ said the datasets are currently empty after takedowns including Emotet in 2021 and Operation Endgame in 2024. The about page says the data is free. No dollar and no SPDX field were printed. A row is a lead, not a method.

Website

Product pricing strategy

02

Free

Feodo Tracker printed no dollar price on 23 Oct 2026. The about page says any data offered here is available for free, and that a vendor may use it for commercical and non-commercial purposes without any limitation. No SPDX field was printed on the about page, the FAQ, or the statistics page. Free on the about page is that sentence. It is not a license identifier this listing invents. The 7'980 figure is the statistics page's tracked-server total. The FAQ's 2,000 – 3,000 figure is the Spamhaus Botnet C2 IPs dataset, which the FAQ says is a different set. Neither number is a fee. The about page tells questions to Spamhaus Technology. This review did not open a paid Spamhaus checkout.

Utility and features

03

The statistics page says Botnet C&C Servers tracked 7'980, with the page's apostrophe as the thousands separator. Top Botnet C&C Country is United States (US). Top Botnet C&C Network is AS14618 AMAZON-AES. The chart sentence says the chart shows the number of active botnet C&Cs over time (past 30 days). The hosting-network table is labeled as counting online and offline botnet C&C servers. Rank 1 is AS5384 EMIRATES-INTERNET AE 304. Rank 2 is AS577 BACOM CA 248. Rank 3 is AS2856 BT-UK-AS GB 242. Rank 4 is AS16276 OVH FR 165. Rank 5 is AS3215 France Telecom - Orange FR 141. Rank 6 is AS8151 Uninet S.A. de C.V. MX 135. A second table, counting online servers only, begins rank 1 AS14618 AMAZON-AES US 1.

  • Tracked total is 7'980. The statistics page printed 7'980 botnet C&C servers tracked, top country United States (US), top network AS14618 AMAZON-AES.
  • FAQ says the datasets are empty. The FAQ names the Emotet 2021 and Operation Endgame 2024 takedowns and says no active C2 remains for these families.
  • Spamhaus is a different count. The FAQ's Botnet C2 IPs dataset, formerly BCL, is approximately 2,000 – 3,000 entries, up to 50 new detections every 24 hours.

The FAQ says the datasets are currently empty because of takedowns, including Emotet in 2021 and Operation Endgame in 2024, and that there are no active botnet C2 servers associated with these malware families at the moment. The same FAQ points to a different Spamhaus dataset, Botnet C2 IPs, formerly BCL, of approximately 2,000 – 3,000 entries, with up to 50 new detections every 24 hours. The about page says that at the time being (2018), Dridex and Emotet (aka Heodo) are still active and actively being tracker by Feodo Tracker. It says any data offered here is available for free, and that a vendor may use the data for both, commercical and non-commercial purpose without any limitation. Those spellings are the page's.

  1. 1

    Quote 7'980 from the statistics total. Do not call it the active-set size the FAQ described as empty.

  2. 2

    Keep the online-and-offline hosting ranks apart from the online-only row that starts at AS14618 with 1.

  3. 3

    Leave the Spamhaus 2,000 – 3,000 range on the FAQ's other dataset. Do not merge it into Feodo Tracker.

Caveats

04

Four sentences disagree, and they stay apart. 7'980 is the statistics total of botnet C&C servers tracked. The FAQ says the Feodo Tracker datasets are currently empty and that there are no active botnet C2 servers for these families. The past-30-days chart sat on zero in the frame captured the same day. The online-only hosting table still begins with AS14618 and the count 1. Do not average those, and do not call 7'980 the active set.

The hosting table that starts at AS5384 with 304 counts online and offline servers. It is not the online-only table. The Spamhaus range of approximately 2,000 – 3,000 is the FAQ's other dataset. The about page's 2018 sentence, including the words actively being tracker, is dated by the page itself. A C2 address on a blocklist is a lead for someone defending a network they hold. It is not a procedure for contacting a server.

Screenshots

05

Feodo Tracker 30-day C2 chart. Statistics at https://feodotracker.abuse.ch/statistics/ on 23 Oct 2026. The banner says the datasets are empty. The chart is active botnet C&Cs over the past 30 days. Captured 2026-10-23. Source
Feodo Tracker tracked-server block. The same statistics page on 23 Oct 2026, after a scroll toward the 7'980 tracked-server line. The empty-dataset banner and the 30-day chart remain in the frame. Captured 2026-10-23. Source

Potential use cases

06

  • The tracked total is about to be called the live botnet size. On 23 Oct 2026 the statistics page said 7'980 botnet C&C servers tracked. The FAQ said the datasets are currently empty after takedowns including Emotet in 2021 and Operation Endgame in 2024. The past-30-days chart sat on zero. The online-only hosting table still began at AS14618 with the count 1. Quote the sentence you mean.
  • The hosting ranks are about to be merged. The table that starts AS5384 EMIRATES-INTERNET at 304 counts online and offline servers. The table that starts AS14618 at 1 counts online servers only. Rank, ASN, and count stay on the table that printed them. The FAQ's Spamhaus range of approximately 2,000 – 3,000 is a different dataset.
  • A blocklist row is about to grow a contact step. The about page says the data is available for free and that vendors may use it, in the page's spelling, for commercical and non-commercial purposes. No dollar and no SPDX field were printed. An address on the list is a lead for a network you defend. It is not a procedure for reaching the host.

Hard cases

The case where the first result is easy to over-read.

7'980 is called the active set

7'980 is the statistics page's tracked-server total, printed with an apostrophe. The FAQ says there are no active botnet C2 servers for these families. The chart of the past 30 days sat on zero. Using 7'980 as the live count contradicts the FAQ.

Questions

Is Feodo Tracker free?

The about page says the data is available for free and that vendors may use it for commercical and non-commercial purposes without any limitation. No dollar price and no SPDX field were printed on 23 Oct 2026.

Why do the statistics and the FAQ disagree?

The statistics page says 7'980 servers tracked. The FAQ says the datasets are currently empty and that no active C2 remains for these families. The online-only table begins at 1. Quote the sentence you mean.

Citations

07

Titled sources. These public pages are what the quotes on this listing come from.

When this listing changes, the letter says so.

Developments in OSINT. Confirm from your inbox before the first issue.

Only for this letter. Privacy

Related tools

Freemium

ThreatFox

abuse.ch IOC sharing. Statistics page opened.

Threat intelligenceAPI
View listing
Freemium

URLhaus

abuse.ch and Spamhaus malware-URL sharing.

Threat intelligenceAPI
View listing
Freemium

MalwareBazaar

A public exchange for malware samples and their hashes.

Threat intelligenceGUI
View listing