Archivedc2findermellow-hype/c2finderLook for un-sinkholed C&C IPs in your Bro logs (from Bambanek Consulting C&C master list)intrusion-detectionioc-managementlog-analysis+3