Data Products

C2 Feeds

Command & control infrastructure

Track active C2 infrastructure in real-time. Identify Cobalt Strike, Metasploit, and other framework servers before they're used in attacks.

Get C2 FeedFeed Documentation
50K+
Active C2s
50+
Frameworks
Hourly
Updates
2yr
History

Key Features

Everything you need to protect your infrastructure and users

Framework Detection

Identify Cobalt Strike, Metasploit, Sliver, and more.

Active Verification

All C2s verified active within 24 hours.

IP & Domain Data

Both IP addresses and domain names tracked.

SSL Fingerprints

JARM and JA3 fingerprints for identification.

Malware Families

Associated malware campaigns and actors.

Historical Data

First seen, last seen, and activity timeline.

Use Cases

How security teams use this tool

Firewall Blocking

Proactively block C2 infrastructure.

Threat Detection

Alert on connections to known C2 servers.

Incident Response

Identify C2 during malware investigations.

Threat Hunting

Search for C2 beacons in your environment.

Frequently Asked Questions

What C2 frameworks do you track?
Cobalt Strike, Metasploit, Brute Ratel, Sliver, and 50+ other frameworks and custom C2.
How do you detect C2 servers?
Active scanning, traffic analysis, SSL certificate patterns, and honeypot data.
How often are C2 feeds updated?
Feeds are updated hourly with active C2 servers verified within the last 24 hours.
Can I get historical C2 data?
Yes, we retain 2 years of C2 data including when servers were first/last seen active.

Related Tools

C2 Detection

C2 analysis

Blocklists

IP blocklists

Malware Detection

Malware intel

Ready to Get Started?

Join thousands of security teams using isMalicious to protect their infrastructure.

Start Free TrialContact Sales