2025 State of the Internet: C2 Time to Live
ID: 1432a18a-5c7c-5ad6-9e4e-eb39696557e6
STIX ID: report--1432a18a-5c7c-5ad6-9e4e-eb39696557e6
Feed Name: Censys Blog
Date Published: 2025-08-06
Date Updated: 2026-04-27
Author: Ivonne Francia; Ariana Mirian; Senior Security Researcher
This Censys research analyzes the time-to-live (TTL) of C2 infrastructure observed during April 2025, comparing Cobalt Strike and Viper by network availability and content (watermarks). It reports family- and port-level TTL statistics, shows that content-based tracking (watermarks) can reveal longer or different lifespans than simple network presence, and highlights operational nuances defenders should consider when tracking C2 servers.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.