Threat-intelligence feed
C2 ServersLast verified Page fetched
C2 Tracker is a c2 servers threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for C2 Tracker.
C2 Tracker is the all-tools view from the open-source C2-Tracker project, which scans the public internet on a continuous schedule for known command-and-control framework fingerprints. The feed enumerates IP addresses currently serving Cobalt Strike, Sliver, Brute Ratel, Mythic, Havoc, and similar offensive-security frameworks; detection is via JARM fingerprints, TLS certificate patterns, and protocol-level banner inspection. The all-tools rollup is the union of the per-framework feeds. It is indexed here because the underlying scanner-driven methodology produces reasonably current and verifiable indicators of active offensive infrastructure.
FEED_SOURCE node not currently in WhisperGraph. The editorial entry for C2 Trackeris committed to the directory but the corresponding graph node is missing — typically a transient state during the threat-feed import pipeline's between-runs window. The page will reconcile on the next revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "C2 Tracker"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "C2 Tracker"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from C2 Tracker into adjacent entities.