Threat-intelligence feed
C2 ServersLast verified Page fetched
C2 Intel 30d is a c2 servers threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for C2 Intel 30d.
C2 Intel 30d is a 30-day rolling view of command-and-control infrastructure tracked by the C2IntelFeeds project. The feed enumerates IP addresses observed hosting C2 panels, beacon callbacks, and lateral-movement relays, derived from a combination of public sandbox runs, JARM fingerprint clustering, and TLS-certificate pivoting. The 30-day window keeps the corpus tight: entries that age out are dropped rather than retained as historical records, so the feed reflects currently-live infrastructure rather than archival material. It is indexed here because it is widely cited in red-team reporting and SOC-tool evaluations.
FEED_SOURCE node not currently in WhisperGraph. The editorial entry for C2 Intel 30dis committed to the directory but the corresponding graph node is missing — typically a transient state during the threat-feed import pipeline's between-runs window. The page will reconcile on the next revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "C2 Intel 30d"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "C2 Intel 30d"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from C2 Intel 30d into adjacent entities.