C2IntelFeeds publishes automatically generated feeds of suspected C2 IPs, domains and configurations for defenders conducting authorized threat hunting and detection engineering.
| Tool | drb-ra/C2IntelFeeds — automatically generated C2 threat intelligence feeds derived from large-scale internet scanning |
| Category | Threat intelligence / IOC feed repository |
| Primary Use | Ingesting curated C2 IP and domain feeds into SIEM, EDR and firewall pipelines for hunting and IOC enrichment |
| Safe Use | Strictly defensive: threat hunting, network monitoring and detection engineering on networks and systems you are authorized to defend |
| Telemetry Note | This is a defender-side tool; it leaves no footprint on your infrastructure, but unvalidated blocking of feed entries may affect legitimate traffic, so local validation is recommended |
C2IntelFeeds is one of those rare repositories that flips the usual economics of threat intelligence: instead of selling access to a curated IOC platform, it publishes automatically generated Command-and-Control feeds as plain text, CSV and JSON files directly on GitHub. With 741 stars and a default branch of master, the project has quietly become a fixture for defenders who want fresh C2 indicators without negotiating vendor contracts. The feeds are derived from large-scale internet scanning — historically Censys, and from May 2026 onward raw data provided courtesy of Modat — and are explicitly scoped to identifying real C2 infrastructure rather than malware samples. That framing matters: this is infrastructure intelligence, not sample intelligence, and it slots cleanly into network-centric detection workflows.
The core value proposition is automation. Feeds refresh continuously and are sliced into 7-day, 30-day and 90-day windows, where the window refers to last observed activity rather than creation date. This is a thoughtful design choice for defenders: a 7-day feed surfaces currently-live infrastructure worth immediate correlation, while the 30- and 90-day variants support historical hunts against retained telemetry. If your organization keeps 90 days of firewall or proxy logs, the long-tail feeds let you retro-hunt for callbacks that predate your awareness of the campaign. The repository structure is intentionally boring — simple formats, stable paths — which is exactly what you want when wiring a cron job or a SIEM lookup into it.
What elevates C2IntelFeeds above a raw scan dump is its two-tier verification model. Verified feeds have undergone additional validation and exclude known benign infrastructure, covering validated C2 IPs, domains extracted from known implants, filtered variants with high-false-positive domains removed, and richer combinations of domains plus URI paths plus resolved IPs. Unverified feeds, by contrast, are generated purely from fingerprint matches and may contain false positives; the README is unusually candid about this, recommending local validation before acting on them. The README also points to the three most practical entry points for newcomers: the IPC2s.csv C2 IP list, domainC2s-filter-abused.csv for filtered domains, and the unverified IP feed, each with 30-day counterparts.
The most analytically interesting part of the README is the table of Modat search queries, which effectively documents the fingerprinting methodology behind every feed. Each C2 framework has a signature: Sliver is detected via certificate issuer and subject common names of operators and multiplayer combined with a specific banner.sha256 hash; Covenant via CN=Covenant certificates or a Kestrel-based web title; Mythic via certificate organization fields and a known banner hash; AsyncRAT via self-signed AsyncRAT Server certificate fields; and Remcos via a fixed JARM fingerprint. Reading these queries is a free education in how offensive tooling leaks identity through TLS certificates, JARM hashes, HTTP response headers, body hashes and service banners.
The framework coverage is impressively broad and not limited to commercial red-team kits. Alongside Brute Ratel C4, Nighthawk C2, Havoc and DeimosC2, the table includes commodity RAT families like DcRat, CHAOS, Pupy and NetSupport Manager, phishing infrastructure tools such as Evilginx and EvilGoPhish, and even legitimate security tooling like Interactsh, BurpSuite Collaborator, Ligolo-ng and Pyramid. The inclusion of legitimate pentest tooling in a defender feed is a deliberate trade-off: it means the feed will flag authorized assessments too, something blue teams should factor in before treating a hit as hostile. Several entries are marked [TBC] or [REDACTED], indicating ongoing work and queries the author has chosen not to disclose — presumably to extend the shelf life of those detections against operator countermeasures.
Beyond IPs and domains, the repository extracts C2 configuration metadata where available, published in CSV and JSON. Typical fields include first-seen timestamps, the true listener IP, port, jitter and sleep timers, ASN and network information, HTTP host headers, TLS certificate data, user-agent strings and optional public keys. For detection engineers this is gold: sleep and jitter values inform realistic thresholding for beacon detection, host headers enable precise TLS inspection rules, and user-agent strings can be dropped straight into proxy alerting logic. The configuration feeds essentially invert the adversary's own tradecraft back into detection content.
False-positive handling deserves specific attention because it is where most community feeds fail. C2IntelFeeds ships an exclusion file, exclusions.rex, which removes known CDN and domain-fronting services, common shared hosting providers and frequently benign infrastructure; filtered feeds apply these exclusions automatically. The dominant language marker of REXX in the repository metadata hints that this filtering pipeline is the actual codebase — an unusual and somewhat archaic choice, but a working one. Domain data in unverified feeds is validated against associated IP data at publish time to improve accuracy, an extra cross-check that reduces the usual noise from scan-artifact false positives.
Integration guidance in the README is refreshingly concrete. The feeds are explicitly designed for SIEM ingestion into platforms like Splunk, Sentinel and Elastic, for EDR enrichment, threat-hunting queries, network detections, firewall and proxy monitoring, and IOC correlation pipelines. Because everything ships in simple text formats, automating a pull into a lookup table or threat intel store requires no special client. A supplementary pair of VPN exit-node and residential-proxy feeds adds context for outbound traffic analysis, helping reduce detection noise and identify infrastructure abuse — useful when trying to distinguish anomalous egress from routine privacy tooling.
The licensing and disclaimers shape how you can realistically deploy this. The project is released under CC BY-NC-SA 4.0, meaning attribution is required, commercial use is prohibited, and derivatives must be share-alike — commercial MSSP operations should read that carefully before baking the feeds into a paid service. The disclaimer is appropriately sober: data is provided as-is, with no guarantee of accuracy or completeness, and infrastructure may be compromised, misattributed or reused. That last point is operationally critical, since attacker C2 nodes sometimes sit on compromised hosting whose real owner is a victim, not a collaborator.
For defenders and authorized security teams, C2IntelFeeds is best treated as a high-quality enrichment source rather than an autopilot blocklist. The verified feeds are reliable enough for alerting and hunting; the unverified tiers should inform investigations, not trigger automated containment. The project also publishes updates via its author's Twitter presence and offers a WebUI, lowering the barrier for analysts who prefer browsing before ingesting. As an educational artifact, the Modat query table alone justifies a read: it is a compact catalog of how modern C2 frameworks betray themselves on the open internet, and a template for building your own scanning detections in defensive, authorized environments.
drb-ra/C2IntelFeeds.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.