drb-ra/c2intelfeedsAutomatically generated C2 threat intelligence feeds of IPs, domains, URL paths, and implant configuration metadata, derived from internet scanning for SIEM, EDR, and threat hunting.
Automatically created C2 Feeds | Also posted via @drb_ra
From May 1st, 2026 raw data is provided courtesy of Modat -- https://modat.io/
A special thank you not to Censys for the support provided over the last few years.
C2IntelFeeds is a collection of automatically generated Command-and-Control (C2) threat intelligence feeds derived from large-scale internet scanning data (primarily Censys).
These feeds are intended for defenders and are suitable for:
The project focuses on identifying real C2 infrastructure, not malware samples.
This repository contains multiple plain-text, CSV, and JSON feeds listing suspected or confirmed C2 infrastructure, including:
Feeds are updated automatically and primarily reflect recent activity.
Most feeds are available in two time ranges:
The time window refers to last observed activity, not creation date.
These feeds have undergone additional validation and exclude known benign infrastructure.
| Feed | Description |
|---|---|
| C2 IPs | Validated C2 server IP addresses |
| C2 Domains | Domains extracted from known C2 implants |
| C2 Domains (Filtered) | Same as above, with high-false-positive domains removed |
| C2 Domains + URL | Domains with specific C2 URI paths |
| C2 Domains + URL + IP | Domains, paths, and resolved IPs |
These feeds are generated from fingerprint matches but may contain false positives.
Domain Data is derived from scan artifacts and validated against associated IP data at publish time to improved accuracy.
| Feed | Description |
|---|---|
| Unverified C2 IPs | Potential C2 IP addresses based on scan artifacts |
| Unverified C2 Domains | Potential C2 domains based on scan artifacts |
| Unverified KVM IPs | KVM-related IP addresses based on scan artifacts |
| Unverified KVM Domains | KVM-related domains based on scan artifacts |
| Unverified RMM IPs | RMM-related IP addresses based on scan artifacts |
| Unverified RMM Domains | RMM-related domains based on scan artifacts |
| IP + Port Pairs | Destination IP and port combinations |
⚠️ Use unverified feeds cautiously. Local validation is strongly recommended.
Where possible, extracted C2 configuration metadata is included in CSV and JSON formats.
Typical fields may include:
Both standard and 30-day variants may be available.
Feeds are built using Censys search queries designed to detect known C2 frameworks by fingerprinting:
| Tool | Modat Search |
|---|---|
| Sliver | same_service(service="unknown" transport="tcp" cert.issuer.cn="operators" cert.subject.cn="multiplayer") and same_service(service="http" transport="tcp" banner.sha256=dba60000613d7556f0b129e77a9451d6ce5a83f52f2d4830314d2e6b52b7928c) |
| Covenant | same_service(cert.issuer.cn="Covenant" cert.subject.cn="Covenant" ) OR same_service(web.title="Covenant"service="http" transport="tcp" technology="Kestrel" technology="Bootstrap") |
| Brute Ratel C4 | product="Brute Ratel C4" |
| Mythic | same_service(service="http" transport="tcp" cert.issuer.org="Mythic" cert.subject.org="Mythic" ) or same_service(banner.sha256=bc7e468313dcdc814784a20b5676188d19c033a1a3d9e3ebe1ff92f006522216 product!="Mythic C2") or product="Mythic C2" |
| Deimos | same_service(service="http" transport="tcp" banner.sha256=613dfd23a3e10f890cee3032b088cfcdf1bf53ed0851e192c0c93ee59b53821a web.html.sha256=99eb12f2ab3c4866a353e098ffa3cb7a967e617c49b98480394ec5d8ea92b094 cert.issuer.org="Acme Co" cert.subject.org="Acme Co" ) |
| Nighthawk C2 | [TBC] |
| Bianlian Go Trojan | [TBC] |
| Havoc | [TBC] |
| Responder | same_service(service="smb" transport="tcp" banner~"server_guid: AAAAAAAAAAAAAAAAAAAAAO6Fq/fq9gxPkoGSR23rdqk") |
| Pupy RAT | same_service(service="unknown" transport="tcp" cert.subject.ou="CONTROL" cert.subject.org=~"^[a-zA-Z]{10}$" cert.issuer.org=~"^[a-zA-Z]{10}$") OR product="Pupy RAT" |
| Qakbot | [TBC] |
| DcRat | cert='CN=DcRat Server, OU=qwqdanchun, O=DcRat By qwqdanchun, L=SH, C=CN' |
| Viper | same_service(web.title="VIPER" web.html.sha256=771fb5f8203ca3b8c3a184ebc4347d5308fd75ad57895bc8fddebe7f355ef20a) OR same_service(service="http" transport="tcp" product="Viper RAT") |
| Supershell | same_service(service="http" transport="tcp" product="Supershell C2") |
| Pikabot | [TBC] |
| Meduza Stealer | [TBC] |
| Evilginx/EvilGoPhish | same_service(service="http" transport="tcp" (web.title~"Evilginx" or web.title~"evilgophish" or cert.issuer.org="Evilginx API")) or product="Evilginx" |
| Hookbot/Pegasus | product="HookBot" |
| AsyncRAT | cert.issuer.cn='AsyncRAT Server' and cert.subject.cn='AsyncRAT Server' |
| Remcos | same_service(service="unknown" transport="tcp" cert.jarm=00000000000000000041d41d0000001798d6156df422564fb9b667b7418e4c) |
| DanaBot | [REDACTED] |
| Rhysida Trojan | [REDACTED] |
| Oyster Backdoor | [REDACTED] |
| SocGholish | [REDACTED] |
| NetSupport Manager RAT | same_service(transport="tcp" banner~"Server: NetSupport Gateway/") |
| Geacon_Pro | [TBC] |
| Hak5 Cloud C2 | [TBC] |
| CHAOS | product="CHAOS RAT" |
| Interactsh | same_service(product="Interactsh" tag="Security Tool") or banner~"interactsh" or same_service(port=53 service="dns" banner.sha256=7e04d9c09faea19579f0f8dfa02a45633401b8502e58cb323748665ef6a367ad) |
| BurpSuite Collaborator | product="BurpSuite Collaborator" |
| Reverse SSH | [REDACTED] |
| wstunnel | [REDACTED] |
| Ligolo-ng | [REDACTED] |
| Ransomhub Python C2 | [REDACTED] |
| Pyramid | [REDACTED] |
| VPN Themed Phishing | [REDACTED] |
| StealC v2 | [TBC] |
| AdaptixC2 | [REDACTED] |
| Matanbuchus | [REDACTED] |
| Pywssocks | [REDACTED] |
The repository includes an exclusion file: exclusions.rex
