IOCs by window
0
IOCs tagged #C2
31
IOCs tagged #C2
112
IOCs tagged #C2
2,209
IOCs tagged #C2
Counts as of 2026-10-29. Regenerated daily.
About #C2
- Definition: Infrastructure an attacker uses to keep a covert channel to infected hosts.
- MITRE: Tactic
TA0011 (Command and Control). - Frameworks: Cobalt Strike Beacon, Sliver, Mythic, Havoc, Empire, custom implants.
- Setups: One VPS listener, or a chain of redirectors, fronting domains and CDN.
- Detection: DNS reputation, JA3/JA4, beacon jitter, certificate transparency, YARA.
- References: MITRE ATT&CK TA0011 · see also tag-specific pages for #cobaltstrike, #sliver, #mythic, #havoc.
Recent IOCs tagged #C2
Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/c2.
| Date | Type | Value | Source |
|---|---|---|---|
| url | |||
| ip | |||
| ip | |||
| sha256 | |||
| ip | |||
| ip | |||
| ip | |||
| ip | |||
| ip | |||
| ip |
Related tags
Frequently asked questions
What is C2 (Command and Control)?
The channel attackers use to talk to infected hosts. MITRE ATT&CK lists its techniques under tactic TA0011.
Which C2 frameworks generate the most IOCs on TweetFeed?
Cobalt Strike, Sliver, Mythic, Havoc and custom implants. The first four have their own tags; #c2 covers anything researchers flag as C2.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this C2 subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
C2 IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.