---
name: c2intelfeeds-ingestion
description: "How to get C2IntelFeeds data into a pandas DataFrame and Parquet: access, the request, the format, limits, quirks and terms."
---

# Load C2IntelFeeds IP indicators into pandas and Parquet

Source entry: https://signal-lab-jet.vercel.app/datasets/c2intelfeeds
Provider: https://github.com/drb-ra/C2IntelFeeds
Checked against the provider's documentation: 2026-11-01

## Access
- No account or key. The repository publishes direct raw CSV, JSON and plain-text feed files.
- Use is limited to non-commercial purposes under CC BY-NC-SA 4.0.

## Request
```bash
curl 'https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/IPC2s.csv'
```

## Format
CSV with an ip column and an ioc label describing the possible C2 framework association.

## Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
```python
"""C2IntelFeeds recent C2 IP feed -> pandas -> Parquet. No key."""
import io
import requests
import pandas as pd

URL = "https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/IPC2s.csv"
r = requests.get(URL, headers={"User-Agent": "SignalLabCheck/1.0"}, timeout=30)
r.raise_for_status()
df = pd.read_csv(io.StringIO(r.text)).rename(columns={"#ip": "ip"})
df.to_parquet("c2intelfeeds_ips.parquet", index=False)
print(len(df), "C2 IP indicators", df["ioc"].nunique(), "distinct labels")
```
Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 123 C2 IP indicators 1 distinct labels

## Limits
- Rate limit: Not stated.
- The selected feed is the recent/default IP feed; separate 30-day and 90-day files are available.
- The licence permits non-commercial use and requires attribution and share-alike for adaptations.

## Quirks
- The first CSV header is #ip; rename it to ip after parsing.
- Verified feeds have extra validation, but the labels still describe possible C2 and can be wrong or stale.
- Do not connect to any listed IP, domain, URL or host; process only the feed file.

## Terms and attribution
- CC BY-NC-SA 4.0 permits non-commercial reuse with attribution and share-alike conditions.
- The provider supplies the feeds as-is for defensive and research purposes.
- Terms page: https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/License.md

## Sources
- https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/README.md: "Feeds are updated automatically and primarily reflect **recent activity**."
- https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/README.md: "The time window refers to **last observed activity**, not creation date."
- https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/README.md: "**Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0)**"

## Help improve this skill
Missing a source, or see something to improve? Call the MCP tool suggest_source or feedback (or POST /api/suggest or /api/feedback). Reviewed ideas: https://signal-lab-jet.vercel.app/agent-suggestions

Information for educational purposes only. Free tiers, limits and licenses belong to the providers and may change; check the provider's own terms before using the data.