https://act.gcai.dev/index.php?action=history&feed=atom&title=MontysecurityMontysecurity - Revision history2026-05-07T23:01:48ZRevision history for this page on the wikiMediaWiki 1.39.3https://act.gcai.dev/index.php?title=Montysecurity&diff=13097&oldid=prevGlobalcyberalliance: Created via script2024-07-04T03:00:05Z<p>Created via script</p>
<p><b>New page</b></p><div>=Description=<br />
<br />
Free to use IOC feed for various tools/malware. It started out for just C2 tools but has morphed into tracking infostealers and botnets as well. It uses Shodan searches to collect the IPs. The most recent collection is always stored in data; the IPs are broken down by tool and there is an all.txt.<br />
<br />
<br />
The feed should update daily. Actively working on making the backend more reliable<br />
<br />
<br />
Honorable Mentions<br />
<br />
<br />
Many of the Shodan queries have been sourced from other CTI researchers:<br />
<br />
<br />
* BushidoToken<br />
* Michael Koczwara<br />
* ViriBack<br />
* Gi7W0rm<br />
* @Glacius_<br />
<br />
<br />
Huge shoutout to them!<br />
<br />
<br />
Thanks to BertJanCyber for creating the KQL query for ingesting this feed<br />
<br />
<br />
And finally, thanks to Y_nexro for creating C2Live in order to visualize the data<br />
<br />
=More Information=<br />
<br />
<b>URL:</b> https://github.com/montysecurity/C2-Tracker/tree/main<br />
<br><br><br />
<b>Maintenance Status:</b> Active <br />
<br><br><br />
<b>Last Updated Date:</b> < 1 year <br />
<br><br><br />
<b>Formats Available:</b> TXT <br />
<br><br><br />
<b>Social Media Links:</b> https://twitter.com/_montysecurity <br />
<br><br><br />
<b>Contact Information:</b> Unknown <br />
<br><br><br />
<b>Single or Multiple:</b> Single <br />
<br><br><br />
<b>License Information:</b> See website. <br />
<br><br><br />
<br />
[[Category:Feeds & Sources - T3C]]<br />
[[Category:Indicators of Compromise (IOC)]]</div>Globalcyberalliance