Threat-intelligence feed
C2 ServersLast verified Page fetched
C2 Tracker is a c2 servers threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for C2 Tracker.
C2 Tracker is the all-tools view from the open-source C2-Tracker project, which scans the public internet on a continuous schedule for known command-and-control framework fingerprints. The feed enumerates IP addresses currently serving Cobalt Strike, Sliver, Brute Ratel, Mythic, Havoc, and similar offensive-security frameworks; detection is via JARM fingerprints, TLS certificate patterns, and protocol-level banner inspection. The all-tools rollup is the union of the per-framework feeds. It is indexed here because the underlying scanner-driven methodology produces reasonably current and verifiable indicators of active offensive infrastructure.
FEED_SOURCE node not currently in WhisperGraph. The editorial entry for C2 Trackeris committed to the directory but the corresponding graph node is missing — typically a transient state during the threat-feed import pipeline's between-runs window. The page will reconcile on the next revalidation.
Live indicator listings: not yet available. WhisperGraph's LISTED_INedge is virtual and not enumerable from the feed side — there is no query-tractable way today to fetch the IPs and hostnames listed in this feed without first visiting every candidate indicator. Indicator-anchored queries work in the opposite direction (see the Cypher snippet below) and the directory's individual IP and host pages surface their feed memberships individually. Per-feed enumeration (an indicator count and sample of representative indicators) is on the roadmap.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "C2 Tracker"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "C2 Tracker"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from C2 Tracker into adjacent entities.