Feodotracker

Connects Claude to abuse.ch's Feodo Tracker, a live feed of botnet command-and-control IP addresses. You get four tools: list the current blocklist with optional filters for malware family or status, check if a specific IPv4 is flagged, pull entries first seen in the last N hours, or grab the aggressive blocklist that includes older and lower-confidence indicators. Useful when you're triaging suspicious IPs, building security automation, or need real-time botnet intelligence without leaving your MCP workflow. Part of the Pipeworx gateway, so you can query it directly or use ask_pipeworx to retrieve blocklist data in plain English.