skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

tracking-threat-actor-infrastructure

Track and pivot across threat actor C2 infrastructure using Shodan, passive DNS, and certificate transparency.

954|172|Updated Mar 13, 2026
Search Tags:#threat intelligence#stix#certificate transparency#passive DNS#Shodan#c2 tracking#infrastructure pivoting
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill tracking-threat-actor-infrastructure
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tracking-threat-actor-infrastructure
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/tracking-threat-actor-infrastructure
Command: npx skills add https://github.com/xalgord/xalgorix --skill tracking-threat-actor-infrastructure

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires shodan, censys, requests, stix2.

What problem does it solve?

Analysts need to discover, map, and monitor adversary-controlled infrastructure such as C2 servers, phishing domains, and staging hosts, but doing so manually across Shodan, passive DNS, WHOIS, and CT logs is slow and error-prone.

Core Features & Use Cases

  • Infrastructure Discovery: Query Shodan for host metadata and search for known C2 framework signatures like Cobalt Strike, Sliver, and Havoc.
  • Pivoting & Enrichment: Use passive DNS (SecurityTrails, PassiveTotal), WHOIS, and certificate transparency (crt.sh) to pivot from one indicator to related infrastructure.
  • Timeline & Validation: Build infrastructure timelines, avoid false-positive pivots and sinkholes, and export results as STIX 2.1 Infrastructure objects.
  • Use Case: Given a known Cobalt Strike C2 IP, pivot via passive DNS and SSL certificate attributes to uncover the actor's broader infrastructure cluster and track its evolution over time.

Quick Start

Use this skill to investigate the IP 203.0.113.10 and pivot to all related threat actor infrastructure using Shodan, passive DNS, and certificate transparency logs.

Frequently Asked Questions about tracking-threat-actor-infrastructure

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find C2 servers with Shodan?▼

Search Shodan for known C2 framework signatures, such as product:"Cobalt Strike Beacon" or the Sliver certificate pattern ssl.cert.subject.cn:"multiplayer". The Shodan host API then returns ports, services, JARM hashes, and certificate details for each match.

How to pivot from one IOC to related threat actor infrastructure?▼

Start from a known indicator and pivot via passive DNS for historical domain-IP mappings, reverse WHOIS for related registrations, and shared SSL certificates or JARM/JA3S fingerprints. Corroborate each pivot with a second high-specificity selector before claiming a cluster.

What API keys are needed for passive DNS and infrastructure tracking?▼

You need API keys for Shodan, Censys, VirusTotal, SecurityTrails, and PassiveTotal, plus Python 3.9+ with the shodan, censys, requests, and stix2 libraries. crt.sh certificate transparency queries require no key.

Why does infrastructure pivoting produce false positives?▼

Pivoting on shared attributes like CDN IPs, Let's Encrypt issuers, or common JARM hashes links unrelated hosts. Use high-specificity selectors such as unique certificate serials, self-signed CNs, favicon hashes, or non-standard ports, and confirm with a second pivot.

How do I check if a C2 domain is sinkholed or taken down?▼

Check passive DNS for a sudden re-point into known sinkhole ranges and WHOIS for registrar holds before treating it as active adversary infrastructure. A resolving domain may be researcher- or registrar-controlled rather than live C2.

Related Skills

Explore More Software Engineering Skills→
taracodlabstaracodlabs
779

virustotal

Query VirusTotal for files, URLs, domains, and IPs via REST API.

Official
Advanced
Liberty91LTDLiberty91LTD
15

stix-bundle

Generate STIX 2.1 bundles modeling threat intelligence objects and relationships.

Official
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-campaign-attribution-evidence

Analyze attribution evidence to rank threat actor hypotheses with confidence levels.

Community
Advanced
luisgustavooliveiraluisgustavooliveira

Recon

Perform passive and active infrastructure reconnaissance using DNS, WHOIS, and IPInfo.

Community
Advanced