What this ranking shows
Command and Control (C2) servers coordinate botnets and malware campaigns. Compromised systems call back to this infrastructure for instructions, payloads, data exfiltration, and attacks such as DDoS or spam.
Whatoblock's honeypot sensor network observes the chain from an inbound scanner to the C2 endpoint and any attempted malware download. The cards summarize detections, download attempts, distinct source scanners, and first- and last-seen activity.
Servers are ranked by observed malware-download activity, with detections used as additional context. The 31-day timeline separates isolated bursts from persistent infrastructure without treating activity volume as attribution.