#c2
Command and Control infrastructure (URLs, IPs, domains) hosting attacker servers and beacons
IOCs by window
1
IOCs tagged #c2
49
IOCs tagged #c2
170
IOCs tagged #c2
24,483
IOCs tagged #c2
Counts as of 2026-05-16. Regenerated daily.
About #c2
- Definition: infrastructure that an adversary uses to maintain a covert channel with compromised hosts. MITRE ATT&CK tracks it as Tactic
TA0011 (Command and Control), with techniques covering application-layer protocols, encrypted channels, fast flux DNS, domain fronting and many others. - Common variants: Cobalt Strike Beacon, Sliver, Mythic, Havoc, Empire, plus bespoke implants. Infrastructure ranges from single-VPS HTTP listeners to complex chains with redirectors, fronting domains and CDN-hidden ingress.
- Detection: DNS reputation, JA3/JA4 TLS fingerprinting, beacon-jitter analysis, sinkhole + traffic-analytics, certificate transparency for short-lived certs, and YARA on memory-resident agents.
- References: MITRE ATT&CK TA0011 · see also tag-specific pages for #cobaltstrike, #sliver, #mythic, #havoc.
Recent IOCs tagged #c2
Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/c2.
| Date | Type | Value | Source |
|---|---|---|---|
| ip | |||
| domain | |||
| url | |||
| url | |||
| ip | |||
| ip | |||
| ip | |||
| sha256 | |||
| sha256 | |||
| ip |
Related tags
Frequently asked questions
What is C2 (Command and Control)?
Command and Control is the channel adversaries use to communicate with compromised hosts during an intrusion. The MITRE ATT&CK framework groups all related techniques under tactic TA0011. C2 infrastructure can be a single VPS hosting an HTTP listener, or a long chain involving redirectors, fronting domains and CDN-hidden ingress to evade detection.
Which C2 frameworks generate the most IOCs on TweetFeed?
Cobalt Strike, Sliver, Mythic, Havoc and bespoke implants dominate the corpus. Each has its own dedicated tag on TweetFeed for finer filtering: see #cobaltstrike, #sliver, #mythic, #havoc. The #c2 umbrella tag is broader and includes everything researchers flag as C2 infrastructure regardless of framework.
How is this list updated?
Every 15 minutes. The TweetFeed pipeline scrapes RSS feeds from public Twitter/X security researcher accounts and lists, extracts IOCs, tags them with the relevant malware family or threat actor, and republishes the result in CSV, JSON and RSS. C2-tagged IOCs are surfaced on this page within the next 15-minute tick. The page itself is regenerated daily by a GitHub Action.
What is the license? Can I use this commercially?
All TweetFeed IOC data, including this C2 subset, is released under CC0 1.0 Universal (Public Domain Dedication). No attribution required, no warranty. Commercial use is allowed. The TweetFeed website code and branding are not covered by CC0.
License
C2 IOC data: CC0 1.0 Public Domain. No attribution required, no warranty. Source code for the pipeline: github.com/0xDanielLopez/TweetFeed (MIT).