jmousqueton / c2-tracker

C2 tracker using Shodan based on Montysecurity C2-Tracker

C2 Tracker

This repo is a modified fork of Montysecurity C2-Tracker

C2-Tracker mines various C2/malware IPs from Shodan. Most of the searches used were sourced from Michael Koczwara's and @BushidoToken's (Will's) research (see references below). Huge thanks to the both of them!

What is tracked?

• C2's
  • Cobalt Strike
  • Metasploit Framework
  • Covenant
  • Mythic
  • Brute Ratel C4
  • Posh
  • Sliver
  • Deimos
  • PANDA
  • NimPlant C2
  • Havoc C2
• Malware
  • AcidRain Stealer
  • Misha Stealer (AKA Grand Misha)
  • Patriot Stealer
  • RAXNET Bitcoin Stealer
  • Titan Stealer
  • Collector Stealer
  • Mystic Stealer
• Tools
  • Hashcat Cracking Tool
  • BurpSuite
  • PowerSploit
  • XMRig Monero Cryptominer
  • GoPhish

Current State

This script uses GithubAction nightly to automatically update the files in data.

Running Locally

However if you want to host a private version, put your Shodan API key in an environment variable called SHODAN_API_KEY

echo SHODAN_API_KEY=API_KEY >> .env
source .env
python3 -m pip install -r requirements.txt
python3 tracker.py

References

• Hunting C2 with Shodan by Michael Koczwara
• Hunting Cobalt Strike C2 with Shodan by Michael Koczwara
• This tweet
• BushidoToken's OSINT-SearchOperators
• This tweet
• This tweet
• This tweet