Automatically created C2 Feeds

• Feeds ( Source/Raw Data courtesy of Censys - https://censys.io/ )

  By default C2s seen active in the last 7 days are added to the main feed files.

  • C2 IPs - Live C2 IP (no frontend or CDN IPs - All bad)
  • C2 Domains - All domain names extracted from implants, including domain fronting values and fake Host headers (High abuse of MS, Apple and Google).
  • C2 Domains Filtered - Excludes several domains abused in domain fronting, along with fake headers for popular sites. Current filter list: (^microsoft\.com|\.microsoft\.com|\.windowsupdate\.com|^apple\.com|^amazon\.com|\.apple\.com|\.amazon\.com|\.mzstatic\.com|^gmail\.com|^jquery\.com|^github\.com|\.live\.com|\.bing\.com|^google\.com|\.bloomberg\.com|\.oracle\.com|\.lenovo\.com|^a0\.awsstatic\.com|^ajax\.aspnetcd\.com|^baidu\.com|^cnn\.com|^www\.gmail\.com|^www\.bankrate\.com|^tencent\.com)
  • C2 Domains with URL - Same as domains and domains filtered but including an extra column with the URI path of the C2

  Additionally a new 30 day set of feed files was added for any C2 seen live in the last 30 days.

• VPN

  • Nord VPN Exit Nodes