I'm looking for a threat intelligence feed API that's affordable and provides actionable data on new malware C2 servers.

For affordable and actionable data specifically tracking malware command-and-control (C2) servers, Feodo Tracker and URLhaus by Abuse.ch provide free, high-utility APIs with no cost or paid tiers required.

Top affordable and open-source threat intelligence options specializing in C2 and malicious infrastructure include:

Details on Top Recommendations

• Feodo Tracker (Abuse.ch): Specifically built to track botnet command-and-control infrastructure . It provides active IP blocklists and port configurations updated in real-time, making it exceptionally actionable for firewall and SIEM blocklisting.
• URLhaus (Abuse.ch): Focuses heavily on URLs being used to distribute malware or host active C2 infrastructure . The API lets you query recent additions or submit/check suspicious URLs instantly.
• AlienVault OTX (AT&T Cybersecurity): A crowdsourced platform where global security researchers publish "pulses" detailing active threat campaigns, infrastructure, and indicators of compromise (IoCs). It provides an easy-to-use API to automate the ingestion of fresh C2 indicators.

Would you like help with sample API integration scripts (like Python or cURL) for Feodo Tracker or URLhaus, or are you looking for commercial options that include advanced attribution and risk-scoring?

If your main requirement is “new malware C2 infrastructure, with enough context to act on it,” I’d start with abuse.ch ThreatFox, rather than paying for a broad commercial CTI feed.

Best options

• threatfox.abuse.ch — best overall value

• Free community API under fair-use terms.

• Specifically exposes botnet_cc indicators, including domains, IPs and URLs.

• Returns useful context such as malware family, IOC type, first-seen data, confidence and references.

• You can query IOCs from the last 1–7 days, which makes it practical for detecting newly reported C2 infrastructure.

• Good fit for feeding a SIEM/TIP, automatically creating detection rules, or enriching outbound-connection alerts.

• urlhaus.abuse.ch — excellent complementary feed

• Free community API under fair-use terms.

• Focuses on malicious URLs used to distribute malware rather than C2 exclusively.

• Data is updated frequently; database/IDS exports are generated every five minutes.

• Particularly useful for catching infrastructure associated with malware delivery and then correlating it with C2 indicators from ThreatFox.

• feodotracker.abuse.ch — very actionable, but currently narrower

• Provides C2 IPs and is designed specifically for blocking/hunting.

• Its IP blocklist is generated every five minutes and only adds an IP after it produces a valid botnet-C2 response.

• However, the current Feodo Tracker datasets are empty because the malware families it tracks have been disrupted by takedowns. Its FAQ points users toward Spamhaus' broader Botnet Controller List instead.

• spamhaus.com — worth considering if you need production SLAs

• Provides a unified API over URLhaus, ThreatFox, MalwareBazaar and YARAify.

• Better choice if you need commercial-grade reliability/support rather than relying on community-feed fair-use terms.

What I'd build

For a budget-conscious SOC, I'd use:

ThreatFox → C2 IOC ingestion → enrichment with URLhaus/MalwareBazaar → SIEM/TIP → automated detection/blocking

The important distinction is that ThreatFox is closer to what you asked for: its API explicitly identifies botnet_cc indicators and associates them with malware families.

If you tell me your approximate budget (e.g. $0, <$100/mo, <$500/mo, or enterprise) and whether you need IP-only, domains/URLs, or full STIX/MISP, I can narrow this down to 3–5 feeds and compare their APIs, freshness, coverage, and licensing.

Finding an affordable or free threat intelligence feed with high-confidence, actionable data on malware command-and-control (C2) infrastructure usually means leaning into reputable open-source intelligence (OSINT) projects or developer-friendly commercial APIs.

The best options range from completely free community projects to specialized, cost-effective commercial feeds:

1. Feodo Tracker (by abuse.ch) — Best Free Option for Botnet C2s

• Focus: Specifically tracks botnet C2 servers associated with prominent families like Emotet, Dridex, TrickBot, QakBot, and BazarLoader.
• Actionability: Generates updated IP blocklists every 5 minutes. It provides clean, machine-readable data (plain text and JSON) ready for firewalls, SIEMs, or automated SOAR playbooks.
• Cost: Free (under fair use/community terms).
• Access: Check out the Feodo Tracker Blocklist.

2. ThreatFox (by abuse.ch) — Best for Broad Malware IOCs & C2s

• Focus: A collaborative platform centered on sharing Indicators of Compromise (IOCs) associated with malware and active C2 infrastructure.
• Actionability: Provides an API to query recent IOCs, search by hash/tag/IP, and export data in formats like JSON, Suricata rules, or MISP events.
• Cost: Free for community/non-commercial use via the ThreatFox Community API . Commercial tiers are available if you require high-volume SLA-backed reliability.

3. Hunt.io (C2 Feed) — Best Dedicated Commercial C2 Feed

• Focus: Actively scans the internet for malware protocols, SSL certificates, and JARM/JA4 hashes to isolate active malicious infrastructure and bulletproof hosting.
• Actionability: Delivers high-confidence C2 identification as a newline-delimited JSON dataset via an API endpoint, complete with metadata like confidence scores, ports, and associated malware families. It reduces false positives via rigorous validation logic.
• Cost: Paid, but structured transparently compared to legacy enterprise threat feeds.
• Access: Review the parameters on the Hunt.io C2 Feed API Docs.

4. AlienVault OTX (Open Threat Exchange) — Best Crowdsourced Community Feed

• Focus: A massive, crowdsourced threat-intelligence community where researchers and automated systems share "pulses" containing active C2 indicators.
• Actionability: Fully documented REST API allows you to pull subscriptions, search specific IoCs, and integrate directly into security controls.
• Cost: Free.
• Access: Explore or sign up via the AlienVault OTX platform.

If you tell me your budget range and how you plan to consume the data (e.g., direct firewall blocking vs. SIEM enrichment vs. automated threat hunting), I can help narrow down which API format and provider fits your stack best.

If your priority is new malware C2 infrastructure at low cost, I’d start with ThreatFox, then consider a paid feed only if you need higher reliability or broader coverage.

Best options

• threatfox.abuse.ch — best budget choice

• Free under its fair-use policy; commercial use may require the enhanced paid API.

• Specifically focused on malware IOCs and associates indicators with malware families.

• You can query recent IOCs and search by IOC, malware family, hash, tag, etc.

• Particularly useful for extracting IP/domain C2 indicators, rather than merely generic malicious domains.

• Supports JSON/CSV plus MISP, Suricata and RPZ exports.

• One caveat: IOCs older than six months are now expired from API/export results, which is actually useful for keeping an operational feed fresh.

• urlhaus.abuse.ch — excellent companion feed

• Also free under fair use.

• More focused on malware-delivery URLs than C2 specifically, so I wouldn't use it alone for C2 detection.

• Its database exports are regenerated every five minutes, making it useful for near-real-time ingestion.

• spamhaus.com — best upgrade path

• Commercial-grade API built around ThreatFox, URLhaus, MalwareBazaar and YARAify data.

• Offers more reliable infrastructure and support than the community API.

• Importantly, Spamhaus says it has separate APIs for botnet C2 intelligence and Passive DNS, which may be a better fit if your requirement is specifically discovering active C2 servers.

What I'd build

For a cost-conscious SOC, I'd use:

ThreatFox → filter for C2-related IOC types → enrich with DNS/ASN/WHOIS → score by recency + malware family + confidence → push to SIEM/firewall/EDR.

That gives you something considerably more actionable than a raw "bad IP" feed. ThreatFox IOCs also have confidence and contextual information available, which can be incorporated into scoring.

If you tell me your approximate budget (e.g. <$100/mo, $500/mo, $2k/mo) and whether you need IPs only, domains, or IP+domain+URL, I can compare 5–8 current feeds specifically for fresh C2 discovery, API limits, coverage, and price.

If your main requirement is “new malware C2 servers, with enough context to act on them”, I’d start with abuse.ch’s ThreatFox, rather than paying for a large commercial TI platform.

Best options

ThreatFox is particularly well suited to your use case. Its API exposes malware IOCs including ip:port, domains, URLs and hashes, along with malware attribution and confidence levels. It also has a “recent IOCs” query, so you can poll for newly observed infrastructure.

For example, a new C2 record can look conceptually like:

IOC:              76.x.x.x:443
IOC type:         ip:port
Malware:          <family>
Confidence:       75
Threat type:      botnet_cc

That combination is much more useful operationally than a bare IP blocklist.

A particularly good low-cost setup

I'd combine:

1. ThreatFox → primary source for newly reported malware C2 IOCs.
2. Feodo Tracker → independent, highly actionable C2 feed for the malware families it tracks.
3. URLhaus → catches the malware-delivery infrastructure associated with campaigns.
4. Your own enrichment → ASN, geolocation, passive DNS, WHOIS/RDAP, certificate data, etc.

Feodo Tracker is especially useful because its recommended C2 blocklist is restricted to infrastructure that has actually responded with a valid botnet C2 response, and its feeds are regenerated every five minutes.

One caveat: Feodo Tracker currently has no active entries because the malware families it tracks were heavily disrupted by takedowns. abuse.ch now points users toward Spamhaus's broader Botnet Controller List for currently active botnet C2 infrastructure.

If you need commercial reliability

The newer abuse.ch/Spamhaus commercial API is probably the most natural upgrade. It provides unified access to ThreatFox, URLhaus, MalwareBazaar and YARAify data, rather than forcing you to integrate several APIs independently.

If you're a small SOC, though, I'd prototype with the free ThreatFox + URLhaus feeds first. You can build a useful pipeline without committing to a $500+/month vendor.

If you tell me roughly how many IOCs/day you need and whether you're feeding a SIEM, SOAR, firewall, or custom application, I can narrow this down to 2–3 APIs and compare their pricing, freshness, fields, and integration effort.

When looking for actionable and affordable intelligence specifically targeting command-and-control (C2) infrastructure, you don't necessarily have to jump straight into expensive enterprise platforms like Recorded Future or ThreatConnect.

The best options range from high-grade, zero-cost open-source projects to specialized commercial feeds that won't break the bank.

Top Free & Open-Source C2 Feeds (with APIs/Downloads)

• ThreatFox (by Abuse.ch) : Widely considered an industry standard for sharing actionable indicators . It focuses specifically on malicious artifacts and C2 infrastructure . It provides a free, structured JSON/CSV API where you can query or pull fresh C2 IP addresses, domains, and payload hashes mapped to specific malware families.
• Feodo Tracker (by Abuse.ch) : Specifically tracks botnet C2 infrastructure associated with Emotet, Dridex, TrickBot, QakBot, and similar operational threats . It provides straightforward blocklists and machine-readable data feeds (CSV, JSON) ideal for automated ingestion.
• URLhaus (by Abuse.ch) : Another abuse.ch project, exceptional if your definition of C2 or initial access includes malicious URL endpoints dropping active payloads . Offers a direct, free online and programmatic API feed.
• AlienVault OTX (AT&T Cybersecurity) : A massive open threat-sharing community where researchers and automated systems push "Pulses." You can use their robust, free API to subscribe to specific pulses tracking newly emerged C2 infrastructure.

Affordable Specialized Commercial Feeds

• Hunt.io (C2 Feed) : If you need high-confidence, pre-vetted infrastructure scanning rather than raw OSINT aggregation, Hunt.io offers a dedicated C2 Feed API . They actively scan the internet for specific malware protocols, custom SSL certificates, and JARM/JA4 fingerprints . It is developer- and analyst-friendly, returning rolling data sets via clean JSON.
• PrecisionSec : Delivers targeted threat feeds mapped directly to active malware and C2 intrusion frameworks with high attribution precision . They offer a 15-day free trial without a credit card and plug smoothly into tools like MISP, OpenCTI, or generic STIX/TAXII connectors , scaling well for smaller SOC budgets.

Community Perspectives

If you'd like to narrow this down, let me know:

• Are you integrating this into a SIEM/SOAR/Firewall (like Splunk, Elastic, or Fortinet) or building a custom script?
• Do you prefer a completely free OSINT approach or a low-cost commercial feed with guaranteed SLAs?

Finding an affordable threat intelligence feed that specializes explicitly in fresh, actionable malware Command-and-Control (C2) infrastructure—without paying enterprise prices like Recorded Future or Flashpoint—comes down to a mix of specialized commercial scrapers/scanners and top-tier community-driven projects.

The best options balancing high-actionability on C2 infrastructure with accessible or low-cost API models include:

• Hunt.io (C2 Feed) : Specifically designed around scanning the internet for active malware protocols, SSL certs, and JARM/JA4 hashes to find C2 infrastructure. It delivers a clean newline-delimited JSON API stream covering the last 7 days of verified malicious infrastructure. Far more affordable than multi-vertical commercial suites, though you need to contact them for exact tier pricing based on query volume.
• ThreatFox (by abuse.ch) : Entirely free and open-source. ThreatFox focuses strictly on sharing actionable IOCs associated with malware and C2 servers. It offers a straightforward, highly structured API that you can query or automate into your tools for zero financial cost. While it relies on community and researcher submissions rather than autonomous active scanning, its signal-to-noise ratio for fresh C2 IPs and domains is exceptional.
• URLhaus (by abuse.ch) : Another free, highly reliable companion to ThreatFox that focuses specifically on malicious URLs distributing malware and connecting to payloads. The API allows real-time automated ingestion.
• Pulsedive : Offers robust community tiers and paid API options that are relatively inexpensive compared to major TIPs. It lets you aggregate, risk-score, and pull fresh feeds on emerging threat indicators, IPs, and C2 domains with rich context.
• PrecisionSec : Provides focused, verified threat feeds tied directly to malware and C2 frameworks, delivering standard integrations (MISP, OpenCTI, STIX/TAXII) designed to cut out noise without enterprise bloat pricing.

To help narrow down the right fit, could you share:

• Your approximate budget (e.g., open-source/free vs. low-cost commercial)?
• Your expected daily API volume or number of lookups?
• What security tools/SIEM you plan to integrate the feed into?

If your priority is affordable + actionable C2 infrastructure, I’d start with ThreatFox rather than a broad commercial TI platform.

Best options

My pick: ThreatFox. Its API specifically exposes botnet_cc indicators, including C2 domains and IP:port combinations, and you can request IOCs first seen within the last 1–7 days. It also associates indicators with malware families and provides confidence/context fields.

For example, your ingestion pipeline could poll recent IOCs and filter for:

• threat_type = botnet_cc
• ioc_type = domain, ip, or ip:port
• high confidence
• first_seen within your desired freshness window
• specific malware families you're interested in

That gives you a much more useful feed for "alert me when a new C2 appears" than simply consuming a giant IP/domain blacklist.

I'd pair it with URLhaus

URLhaus focuses on malware-distribution URLs rather than C2, but it complements ThreatFox well: you can correlate newly observed payload-delivery infrastructure with C2 infrastructure. Its database exports are generated every five minutes, and its API supports automated queries.

If you need enrichment too

Pulsedive is worth considering if you want one API for indicator lookups, threat/malware context, feeds, and on-demand analysis. Its API supports indicator, threat, explore, and feed endpoints, and API access is available with a free account.

The important distinction is that Pulsedive's full bulk feeds are much more expensive than its basic API access, so I wouldn't buy a feed subscription if your only requirement is newly discovered C2s.

What I'd deploy

For a small SOC/security engineering team, I'd do:

ThreatFox → normalize/deduplicate → confidence/age filtering → SIEM/SOAR → DNS/firewall/EDR enrichment

Then optionally add URLhaus for malware-delivery infrastructure and Pulsedive for enrichment.

One caveat: ThreatFox's free API is subject to fair-use rules, and abuse.ch explicitly says commercial/for-profit usage may require its paid commercial API. threatfox.abuse.ch If this is going into a commercial product or a high-volume production pipeline, I'd get the commercial-use terms sorted out rather than building around the community endpoint.

If you tell me roughly how many IOCs/day you need (e.g. 1K, 10K, 100K) and whether this is internal SOC use or a commercial product, I can narrow it down to the cheapest viable feed and compare current pricing/API limits.

If your priority is new malware C2 infrastructure + an API + low cost, I’d start with ThreatFox.

My pick: ThreatFox

ThreatFox is particularly well suited to your requirement because its API explicitly labels botnet_cc indicators and distinguishes domain, IP:port, URL, etc. It also associates indicators with malware families and provides confidence information. You can query IOCs from the last 1–7 days, making it useful for detecting newly appearing infrastructure.

You can get an API key for free, and the project provides example scripts for pulling recent IOCs programmatically.

For example, your ingestion pipeline could periodically pull recent indicators and filter on:

threat_type = botnet_cc
first_seen >= now - 24h
confidence_level >= 70
ioc_type in (ip:port, domain, url)

That gives you a much more useful stream than a generic malicious-IP blocklist.

A useful second feed: Feodo Tracker

Feodo Tracker is excellent if high-confidence active C2 IPs are more important than breadth. Its C2 blocklist is regenerated every 5 minutes, and an IP is only added after it produces a valid botnet-C2 response, specifically to keep false positives down. It also exposes JSON and SIEM/IDS-friendly formats.

One caveat: the traditional Feodo Tracker dataset is currently empty because the tracked malware families have largely been disrupted by takedowns. The project now points users toward Spamhaus's broader Botnet Controller List for active botnet C2 coverage.

Where URLhaus fits

URLhaus is complementary rather than a direct C2 feed. It is particularly good for catching malware distribution URLs and compromised infrastructure associated with campaigns. Its community API is free under fair-use principles, although commercial users may need the paid enhanced API.

Recommended inexpensive stack:
ThreatFox → primary C2 feed, Feodo/Spamhaus → high-confidence active C2, and URLhaus → malware delivery infrastructure.

If you tell me roughly how many IOCs/day you need and whether you want STIX/TAXII, JSON REST, or a simple CSV feed, I can narrow this down to 2–3 commercial options with current pricing and API limits.

For an affordable or free, highly actionable API feed tracking live malware command-and-control (C2 ) infrastructure, Hunt.io C2 Feed and abuse.ch URLhaus / ThreatFox are the top choices. Hunt.io provides low-cost, high-confidence active infrastructure telemetry via daily JSON API pulls, while abuse.ch provides robust, free community-driven intelligence.

Top Affordable and Actionable C2 Feeds

• Hunt.io C2 Feed : Scans the internet explicitly for malware protocols, SSL certs, and JARM/JA4 fingerprints, delivering structured newline-delimited JSON data via API covering the past 7 days of active infrastructure.
• ThreatFox by Abuse.ch : A completely free, highly structured, and scannable IOC feed tracking active malware C2 servers and malicious IP/domain infrastructure contributed by global researchers.
• URLhaus by Abuse.ch : Focuses explicitly on sharing malicious URLs and online C2 drop sites used to distribute malware, offering robust programmatic and API access.
• AlienVault OTX : An open threat-sharing community where users subscribe to customized "pulses" containing fresh indicators for emerging C2 nodes, fully consumable via a free REST API.

If you can share your budget range (free OSINT vs. paid commercial) and whether you need automatic STIX/TAXII integration or simple JSON, I can help you narrow down the best API implementation.