How do you proactively hunt C2 infrastructure?

Proactive C2 infrastructure hunting finds and blocks servers before the first beacon by mining external data: certificate transparency (crt.sh) for lookalike certs, newly-registered-domain feeds for fresh C2/phishing domains, passive DNS for domains co-hosted with known-bad IPs, and Shodan/Censys (JARM, banners) for default team servers. Start from one indicator and pivot across passive DNS, shared certificates and WHOIS clustering to map the campaign, confirm candidates, then operationalise as proxy/firewall blocks and SIEM watchlists, weighting risk by hosting patterns.

Proactive C2 Infrastructure Hunting with Scan and Cert Data

Reactive detection waits for a beacon; proactive infrastructure hunting finds the C2 server first. By mining certificate transparency, newly-registered domains, passive DNS and internet-scan data, and by recognising adversary hosting patterns, you can pre-emptively block staging infrastructure and feed your own detections with high-confidence indicators.

Signals at a Glance

Data source	What it finds	Action
Certificate transparency (crt.sh)	Lookalike/typosquat certs for your brand	Block + takedown
Newly-registered domains (NRD feeds)	Fresh phishing/C2 domains	Pre-emptive proxy block
Passive DNS	Domains sharing an IP with known-bad	Pivot + block
Shodan/Censys (JARM, banners)	Default C2 team servers	Confirm + block
Hosting heuristics	Bulletproof/VPS patterns	Risk-weight

Pivoting on Indicators

Start from one known indicator and expand. A single C2 IP yields co-hosted domains (passive DNS), shared certificates (Censys) and registration patterns (WHOIS) that reveal the wider campaign:

# Pivot workflow (pseudo)
seed_ip = "<known C2 IP>"
#  1) passive DNS: domains that resolved to seed_ip  -> candidate_domains
#  2) crt.sh: certificates on seed_ip / candidate_domains -> shared serials/issuers
#  3) Censys: other IPs presenting those certs or the same JARM -> new_ips
#  4) WHOIS/RDAP: registrant, registrar, created date clustering
#  5) output high-confidence indicators -> proxy/firewall block + TIP
# Re-run on a schedule; each confirmed node seeds the next pivot.

Pre-emptive Controls

Block or sinkhole newly-registered domains for high-risk categories at the proxy — most legitimate business rarely needs a domain in its first days.
Watch certificate transparency for lookalikes of your own domains and executives' names, and action takedowns early.
Feed confirmed infrastructure into your SIEM as a watchlist so any internal contact fires immediately.
Weight risk by hosting: bulletproof hosts, abused VPS ranges and fast-flux patterns raise confidence.

Vetted sources

Use crt.sh and certificate-transparency monitoring, newly-registered-domain feeds, passive DNS (community/commercial), and Shodan/Censys for scan-based pivots. Confirm before blocking to avoid false positives, and operationalise the output as proxy blocks and SIEM watchlists rather than one-off lookups.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Pivoting on Indicators

Pre-emptive Controls

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

JARM C2 Hunting