Community

Introduction

VulnCheck Attacker Infrastructure is a community index of command-and-control servers and other attacker infrastructure observed by VulnCheck's Target Intelligence and Canary Intelligence collection.

VulnCheck Attacker Infrastructure is a free, community-tier index of IP addresses and hostnames that VulnCheck has observed acting as attacker infrastructure. Records come from two VulnCheck collection sources:

Target Intelligence: Internet-wide scanning that fingerprints command-and-control (C2) servers, such as Sliver, Havoc, and Metasploit, along with other infrastructure that supports attacks.
Canary Intelligence: VulnCheck's canary network, which captures exploitation attempts against real vulnerable software. The callback hosts and payload-delivery servers named in those attempts are added to the index.

The index is available as vulncheck-attacker-infrastructure, from the same API as every other VulnCheck index.

What's included in Attacker Infrastructure?

Each record is one observable, an IP address, a hostname, or both, paired with a port. The same IP address can appear in several records if VulnCheck observed it on more than one port.

For each record, the index provides:

The IP address and/or hostname, and the port
The ASN, country, and country code (Target Intelligence records)
One or more classifications that describe what the infrastructure is
The source that observed it: target-intel or canary-intel
When VulnCheck first and last observed it

Classifications

Classifications use the same type:value format as Target Intelligence enrichment data.

Classification	Meaning	Example values
`c2:<family>`	A command-and-control server fingerprinted as a specific framework or malware family	`c2:sliver`, `c2:havoc`, `c2:msfconsole`, `c2:pikabot`, `c2:gophish`
`attacker-infrastructure:<name>`	Infrastructure that supports attacks without being a C2 server in its own right, such as botnet nodes, out-of-band callback servers, and offensive tooling	`attacker-infrastructure:63256-botnet`, `attacker-infrastructure:interactsh`, `attacker-infrastructure:acunetix`
`scanner:<name>`	Reconnaissance and scanning platforms	`scanner:rengine`, `scanner:asset-reconnaissance-lighthouse`
`proxy:<name>`	A reverse proxy or tunnel in front of the infrastructure. Always appears alongside a `c2` or `attacker-infrastructure` classification	`proxy:traefik`, `proxy:xray`, `proxy:localtonet`
`attacker-infrastructure`	Canary Intelligence: a host that an exploitation attempt against a VulnCheck canary called back to or fetched a payload from	(no value)
`c2:unknown`	Canary Intelligence: a C2 address extracted from an exploitation payload, with no framework identified	(no value)

Some attacker-infrastructure and scanner values describe dual-use tools, such as out-of-band interaction servers (interactsh) and web vulnerability scanners (acunetix), that both attackers and authorized security testers run. Canary Intelligence records list every host named in an exploitation payload, which can include legitimate services such as tunnelling or webhook providers. Review records in context before blocking them.

How do I access it?

API: query the vulncheck-attacker-infrastructure index with filters such as IP, port, ASN, country, classification, source, and last-seen date, or download the whole index as a backup. See API / Schema.
CLI: vulncheck index list vulncheck-attacker-infrastructure and vulncheck backup download vulncheck-attacker-infrastructure.

API access requires a free VulnCheck Community account. Sign up at https://console.vulncheck.com/.

Learn more about how VulnCheck tracks attacker infrastructure on the VulnCheck blog.

API / Schema