Rule History

SID: 900513701 • Source: abuse.ch/feodotracker

Versions (2)

Rev: 1

Feb 25, 2026, 5:35 AM

Current

Rev: 1

Jan 13, 2026, 10:34 PM

Archived

Version DetailsCurrent

Rev: 1 • Feb 25, 2026, 5:30 AM

Message:

Feodo Tracker: potential QakBot CnC Traffic detected

Rule:

alert tcp $HOME_NET any -> [34.204.119.63] 443 (msg:"Feodo Tracker: potential QakBot CnC Traffic detected"; threshold:type limit, track by_src, seconds 60, count 1; classtype:trojan-activity; reference:url, feodotracker.abuse.ch/browse/host/34.204.119.63/; sid:900513701; rev:1;)

Created:

Feb 25, 2026, 5:30 AM

Updated:

Feb 25, 2026, 5:30 AM

DB Created:

Feb 25, 2026, 5:35 AM

DB Updated:

Feb 25, 2026, 5:35 AM

Filename:

feodotracker.rules