Threat feed
C2 Intel 30d
Last fetched
C2 Servers · refreshed daily · last verified
C2 Intel 30d is a C2 Servers threat-intelligence feed, refreshed daily, indexed by WhisperGraph.
Live data for this page is temporarily unavailable.
The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.
What is C2 Intel 30d
C2 Intel 30d is a 30-day rolling view of command-and-control infrastructure tracked by the C2IntelFeeds project. The feed enumerates IP addresses observed hosting C2 panels, beacon callbacks, and lateral-movement relays, derived from a combination of public sandbox runs, JARM fingerprint clustering, and TLS-certificate pivoting. The 30-day window keeps the corpus tight: entries that age out are dropped rather than retained as historical records, so the feed reflects currently-live infrastructure rather than archival material. It is indexed here because it is widely cited in red-team reporting and SOC-tool evaluations.
- Refresh cadence
- daily
Indicators currently listed
Related pages
Pivot from C2 Intel 30d into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.