https://act.gcai.dev/index.php?action=history&feed=atom&title=C2_Intel_FeedsC2 Intel Feeds - Revision history2026-05-08T07:07:50ZRevision history for this page on the wikiMediaWiki 1.39.3https://act.gcai.dev/index.php?title=C2_Intel_Feeds&diff=13061&oldid=prevGlobalcyberalliance: Created via script2024-07-04T02:59:51Z<p>Created via script</p>
<p><b>New page</b></p><div>=Description=<br />
<br />
Automatically created C2 Feeds | Also posted via @drb_ra<br />
<br />
<br />
Feeds ( Source/Raw Data courtesy of Censys - https://censys.io/ )<br />
<br />
<br />
Search 2.0 has massively improved detection rates on non-standard ports. Great job Censys Team!<br />
<br />
<br />
By default C2s seen active in the last 7 days are added to the main feed files. There is also a 30 day feed for any C2 seen live in the last 30 days.<br />
<br />
<br />
* C2 IPs - Live C2 IP (no frontend or CDN IPs - All bad)<br />
* C2 Domains - All domain names extracted from implants, including domain fronting values and fake Host headers (High abuse of MS, Apple and Google).<br />
* C2 Domains Filtered - Excludes several domains abused in domain fronting, along with fake headers for popular sites. Current filter list see: exclusions.rex file<br />
* C2 Domains with URL - Same as domains and domains filtered but including an extra column with the URI path of the C2<br />
* C2 Domains with URL and IP - Same as domains and domains filtered but including an extra column with the URI path of the C2 and another with the C2 IP<br />
* Unverified C2 IPs - Live C2 IPs based simply on the Censys search/query no validation can easily be performed or further configuration extracted. Some however are extremely accurate.<br />
<br />
=More Information=<br />
<br />
<b>URL:</b> https://github.com/drb-ra/C2IntelFeeds<br />
<br><br><br />
<b>Maintenance Status:</b> Active <br />
<br><br><br />
<b>Last Updated Date:</b> Every 7 days <br />
<br><br><br />
<b>Formats Available:</b> See website. <br />
<br><br><br />
<b>Social Media Links:</b> https://github.com/drb-ra/C2Intel <br />
<br><br><br />
<b>Contact Information:</b> Unknown <br />
<br><br><br />
<b>Single or Multiple:</b> Single <br />
<br><br><br />
<b>License Information:</b> See website. <br />
<br><br><br />
<br />
[[Category:Feeds & Sources - T3C]]<br />
[[Category:C2 Detection]]<br />
[[Category:Network Security]]<br />
[[Category:Malware]]<br />
[[Category:Enrichment]]<br />
[[Category:Collaborative Security]]<br />
[[Category:Incident Response]]</div>Globalcyberalliance