# SiteCheck Web Intel – Feodo Tracker C2 Blocklist Lookup

> SiteCheck Web Intel – Feodo Tracker C2 Blocklist Lookup is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist and returns threat details including port, online status, malware family, country, AS, and first/last seen dates.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/feodotracker-c2?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-feodo-tracker-c2-blocklist-lookup-fa897413
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_vZCWf7A_C-G--iu_pFWFf

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-feodo-tracker-c2-blocklist-lookup-fa897413
```

Example prompt: Can you check whether 162.243.103.246 is listed as a botnet command-and-control server on the Feodo Tracker — I want to know the malware family, port, and whether it's currently online.

## When to prefer this

Use this endpoint when you specifically need to check an IP against the abuse.ch Feodo Tracker feed for Emotet, QakBot, and related botnet C2 infrastructure. Prefer this over generic IP reputation services when you need structured threat intel including port, malware family, and timeline data from the Feodo feed specifically. If you need broader abuse reporting (e.g. SSH brute force, spam), use the Blocklist.de endpoint instead.

## Known failure modes

- IP not found in Feodo Tracker feed — returns no-hit response rather than an error
- IPv6 or malformed IP address supplied — returns validation error
- Feodo Tracker feed temporarily unavailable — upstream data fetch failure
- IP was previously listed but aged out of the feed — false negative possible
- Feed only covers Feodo-tracked families; other malware C2s will not be flagged

## How this service works

Checks an IPv4 address against the abuse.ch Feodo Tracker botnet C2 blocklist (Emotet, QakBot and similar). A hit returns the port, online status, malware family, country, AS and first and last seen dates. Covers only the C2 servers this feed tracks.

## Output

Returns whether the queried IPv4 address is present in the Feodo Tracker C2 blocklist. On a hit, provides: the C2 port number, current online status, identified malware family (e.g. Emotet, QakBot), country of origin, autonomous system number and holder name, and the first and last dates the IP was observed as a C2 server. Returns no match if the IP is not in the feed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address such as 162.243.103.246 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-feodo-tracker-c2-blocklist-lookup-fa897413/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)