C2 Feeds Command & control infrastructure
Track active C2 infrastructure in real-time. Identify Cobalt Strike, Metasploit, and other framework servers before they're used in attacks.
Monthly billing · cancel anytime
# IsMalicious.com Blocklist - IPs (All Levels)# Format: Plain# Generated: 2026-10-06T21:08:59.332387002+00:00# Total entries: 44466# Update frequency: every 12 hours# Category: C2# Threat level: All Levels# Website: https://ismalicious.com# © 2026 IsMalicious (compilation). Licensed to the downloading account under https://ismalicious.com/terms; redistribution of the compilation prohibited. Third-party entries remain under their providers' licences — see https://ismalicious.com/sources.# Filtered by category: c2154.220.94.4646.224.162.14880.98.145.41190.53.144.120
Same family, other types
- blocklist-domains-c2.txt22 476 entriesFree sample
- blocklist-urls-c2.txt20 285 entriesFree sample
15K+
Active C2s
50+
Frameworks
Hourly
Updates
2yr
History
Key features. Everything you need to protect your infrastructure and users.
Framework Detection
Identify Cobalt Strike, Metasploit, Sliver, and more.
Active Verification
All C2s verified active within 24 hours.
IP & Domain Data
Both IP addresses and domain names tracked.
SSL Fingerprints
JARM and JA3 fingerprints for identification.
Malware Families
Associated malware campaigns and actors.
Historical Data
First seen, last seen, and activity timeline.
Use cases. How security teams use this tool.
Firewall Blocking
Proactively block C2 infrastructure.
Threat Detection
Alert on connections to known C2 servers.
Incident Response
Identify C2 during malware investigations.
Threat Hunting
Search for C2 beacons in your environment.
Frequently asked questions.
What C2 frameworks do you track?
How do you detect C2 servers?
How often are C2 feeds updated?
Can I get historical C2 data?
Cite this data
These figures may be quoted in research, articles and reports. Attribute them to isMalicious with a link to this page, so readers can check the numbers at the source and see how they move.
Attribution text: Source: isMalicious, C2 Infrastructure Feed — https://ismalicious.com/data/c2-feeds
Ready to get started?
Join thousands of security teams using isMalicious to protect their infrastructure.
No credit card required · Free API key