BOTNET C2 INDICATORS
A threat map that doesn't fake it.
WorldEye's Botnet C2 Servers layer plots known botnet command-and-control servers from abuse.ch Feodo Tracker — one marker per server, placed at its hosting country. No attack origins, no targets, no animated arcs.
What the data actually is
One marker per C2 server
Every marker is one known botnet command-and-control server from the source blocklist — one indicator per server, never cloned or multiplied to make the map look busier.
Hosting country
Each marker sits in the country where the server is hosted, as reported in the source record. Hosting is a fact about infrastructure — it is not an attribution of who operates the botnet.
Country-level precision
Placement is the hosting country's centroid, stated openly. The source records a country, not a street address, so the map shows country-level precision and nothing finer.
Malware family
Where the source record names the botnet or malware family associated with the server, the marker carries it — so you can see which known families the listed infrastructure belongs to.
Online or offline status
Feodo Tracker reports whether each listed server still answers. An offline C2 is a historical listing, not an active threat event — and the map keeps that distinction visible.
First seen & last online
Each indicator carries when the provider first listed the server and when it last answered, alongside the hosting network from the record. Dates from the source — nothing inferred.
How the layer works
abuse.ch Feodo Tracker publishes a botnet C2 blocklist: one row per known command-and-control server. A row says where a server is hosted, which malware family it is associated with where known, whether it still answers, which hosting network it sits on, and when it was first listed and last seen online.
WorldEye's Pro layer, Botnet C2 Servers, takes that list and plots it on the same 3D globe as everything else: one indicator per server, deduplicated, carrying only the fields the record actually contains. Placement is the centroid of the hosting country — an approximation of a field that is in the record, labeled as country-level precision wherever it appears.
The C2 layer is part of the Pro intel toolkit ($7.99/week, $13.99/month, $74.99/year). The globe itself — including live flights, satellites, weather, earthquakes, wildfires and 74,229 public cameras — is free for everyone with no account.
What this map does not show
Not attack origins
A C2 server's hosting country is not where an attacker is. Botnet operators rent ordinary hosting anywhere in the world, so the map never attributes a server to a person, a group or a government — the source record does not, either.
Not attack targets
The blocklist records the control server, not the machines it controlled or anything they were pointed at. There are no victim locations in this data, so none are drawn.
Not live attacks
A listing is not an event. Some listed servers are offline — taken down, abandoned or moved — and even an online C2 is standing infrastructure, not an attack in progress. Nothing on this layer animates an attack, because nothing in the source describes one.
No arcs, no inflated counts
Many threat maps draw dramatic arcs between invented origins and targets, and multiply indicators until the screen looks busy. This layer does neither: one marker per known server, at country-level precision, with the count equal to the number of records — nothing cloned, nothing decorated.
What it is for
Security awareness
See where known botnet infrastructure is actually hosted, and how concentrated it is in a handful of hosting countries. A grounded picture beats a scary animation for building real awareness of how botnets work.
Research
Study the geography of known C2 hosting over time: which countries and hosting networks recur in the blocklist, which malware families they are associated with, and how listings age from first seen to last online.
Education
Teach command-and-control without the fiction. The layer gives students a real, sourced dataset — known servers, real listing dates, honest precision — and a clear example of what threat data does and does not say.
Cyber threat map FAQ
Is the cyber threat map free?
The WorldEye globe itself is free — no account, no signup — including flights, satellites, weather, earthquakes, wildfires and 74,229 public cameras. The Botnet C2 Servers layer is part of WorldEye Pro, the paid intel toolkit: $7.99/week, $13.99/month or $74.99/year.
Where does the data come from?
abuse.ch Feodo Tracker, a public blocklist of known botnet command-and-control servers. WorldEye plots one indicator per listed server, carrying only the fields the record actually contains: hosting country, malware family where named, status, hosting network, and first-seen and last-online dates.
Does this map show live attacks?
No. It shows the hosting locations of known C2 servers — infrastructure that botnets use to receive instructions. It does not show attacks happening, attack origins, or attack targets, because the source data does not contain them and WorldEye does not invent them.
How precise are the locations?
Country-level only. Each marker is placed at the centroid of the server's hosting country — an openly stated approximation of the one location field the record contains. It is never presented as the server's exact position.
What is a botnet C2 server?
C2 stands for command-and-control: a server that compromised machines — the botnet — check in with to receive instructions and send results. Taking down or blocking known C2 servers is one of the main ways defenders disrupt botnets, which is why trackers like Feodo publish them.
Why are there no attack arcs like on other threat maps?
Because arcs from an attacker origin to a target would be fiction here. The source records where a C2 server is hosted — it does not record who operates it, who it attacked, or when any attack happened. A threat map that does not fake attack arcs is this page's whole point: every marker traces to a real record.
What does online versus offline mean?
Feodo Tracker reports whether a listed server still answers. Online means the C2 was reachable when last checked; offline means it has stopped answering — it may have been taken down, abandoned or moved. An offline listing is history, not a live event.
Does a marker in a country mean that country is attacking?
No. A marker means a known C2 server is hosted there — usually on ordinary commercial hosting infrastructure that anyone in the world can rent. Hosting location is not attacker attribution, and the map never presents it as such.
See the infrastructure, not the fiction
The Botnet C2 Servers layer — known servers, hosting countries, honest precision — is part of WorldEye Pro.
See Pro plansJust want to explore? Open the free globe
Explore more
Features
Everything the globe can do — free forever layers and Pro intelligence tools.
Pricing
Weekly, monthly and annual Pro plans — the Botnet C2 Servers layer is included.
Best OSINT tools
How WorldEye compares with the wider open-source intelligence toolkit.
Open the map
The free live 3D globe — flights, weather, cameras and more, no signup.