---
title: "Comment by Furqan Ashraf on \"Hunting IOCs in Linux: From Cryptominers to C2 Persistence\" | Hashnode"
description: "Nice hunt. One step I'd add once you find the C2 IP: check it against a known C2 list. A confirmed match tells you whether it's commodity malware with documente"
url: "https://hashnode.com/posts/hunting-iocs-in-linux-from-cryptominers-to-c2-persistence/6a77a3e9bdb63b025294e575/comment/6ac4edfec5f96136f734bb23"
---

[Discussion](https://hashnode.com/posts/hunting-iocs-in-linux-from-cryptominers-to-c2-persistence/6a77a3e9bdb63b025294e575)

Comment [Hunting IOCs in Linux: From Cryptominers to C2 Persistence](https://hashnode.com/posts/hunting-iocs-in-linux-from-cryptominers-to-c2-persistence/6a77a3e9bdb63b025294e575)

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Oct 6](https://hashnode.com/posts/hunting-iocs-in-linux-from-cryptominers-to-c2-persistence/6a77a3e9bdb63b025294e575/comment/6ac4edfec5f96136f734bb23)

Nice hunt. One step I'd add once you find the C2 IP: check it against a known C2 list. A confirmed match tells you whether it's commodity malware with documented behavior or something targeted, and that changes how deep the remediation needs to go.

Disclosure: I work on WhoisFreaks; our Threat Intelligence Feed includes a daily C2 IP list for exactly that lookup: [whoisfreaks.com/products/threat-intelligence-feed](https://whoisfreaks.com/products/threat-intelligence-feed)