Next free-source hunt
We check for new free data every weekday.
Datasets / Cyber Threat
github.com/

C2IntelFeeds

FreeNon-commercial onlyauth: noneCC-BY-NC-SA-4.0#cyber-threat#threat-intel#blocklists#network-data✓ verified Nov 1, 2026

C2IntelFeeds

Keyless C2IntelFeeds CSV, JSON and plain-text feeds describe suspected or confirmed command-and-control IPs, domains, hostnames, URL paths, IP-port pairs and configuration metadata. Fields vary by feed and can include first-seen time, listener IP, port, ASN, HTTP headers, TLS data and framework labels; no key is needed.

Required Attribution:

Required: "Attribution required". Retain creator and licence notices and link to the source when sharing.

Coverage

The feeds derive from large-scale internet scanning and mostly represent last-observed activity in rolling 7-day, 30-day and 90-day windows. They update automatically, but the provider does not state an exact publication interval.

Verdict

This is defensive data for IOC enrichment, threat hunting, network monitoring and detection engineering around possible C2 infrastructure. Verified feeds receive additional validation and exclude known benign infrastructure, while unverified fingerprint matches can contain false positives. The windows track last observation rather than infrastructure creation, and reused or compromised infrastructure can be misattributed. Do not visit or fetch listed URLs, domains or hosts; ingest only the repository feed files.

Get the free weekly email

Free weekly email of newly verified free data. Unsubscribe by emailing us.

By entering your email and clicking Subscribe, you agree to receive the Signal Lab weekly email from Quantum Data Technologies Ltd., 3200-650 West Georgia Street, Vancouver, BC V6B 4P7, Canada (signal-lab@qdt.ai). You can unsubscribe at any time: reply "unsubscribe" to any email or write to signal-lab@qdt.ai. See our Privacy Policy.

Use in your agent

Load C2IntelFeeds IP indicators into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.

Raw skill file (/skills/c2intelfeeds.md)Also in our MCP server: call get_ingestion_skill with {"slug": "c2intelfeeds"}.

Access

  • No account or key. The repository publishes direct raw CSV, JSON and plain-text feed files.
  • Use is limited to non-commercial purposes under CC BY-NC-SA 4.0.

Request

bash
curl 'https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/IPC2s.csv'

Format

CSV with an ip column and an ioc label describing the possible C2 framework association.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

python
"""C2IntelFeeds recent C2 IP feed -> pandas -> Parquet. No key."""
import io
import requests
import pandas as pd

URL = "https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/IPC2s.csv"
r = requests.get(URL, headers={"User-Agent": "SignalLabCheck/1.0"}, timeout=30)
r.raise_for_status()
df = pd.read_csv(io.StringIO(r.text)).rename(columns={"#ip": "ip"})
df.to_parquet("c2intelfeeds_ips.parquet", index=False)
print(len(df), "C2 IP indicators", df["ioc"].nunique(), "distinct labels")

Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 123 C2 IP indicators 1 distinct labels

Limits

  • Rate limit: Not stated.
  • The selected feed is the recent/default IP feed; separate 30-day and 90-day files are available.
  • The licence permits non-commercial use and requires attribution and share-alike for adaptations.

Quirks

  • The first CSV header is #ip; rename it to ip after parsing.
  • Verified feeds have extra validation, but the labels still describe possible C2 and can be wrong or stale.
  • Do not connect to any listed IP, domain, URL or host; process only the feed file.

Terms and attribution

  • CC BY-NC-SA 4.0 permits non-commercial reuse with attribution and share-alike conditions.
  • The provider supplies the feeds as-is for defensive and research purposes.

Sources

Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer

Related entries