diff --git a/analyzers/CyberCrimeTracker/CyberCrimeTracker.json b/analyzers/CyberCrimeTracker/CyberCrimeTracker.json
new file mode 100644
index 000000000..116c1796c
--- /dev/null
+++ b/analyzers/CyberCrimeTracker/CyberCrimeTracker.json
@@ -0,0 +1,16 @@
+{
+ "name": "CyberCrime-Tracker",
+ "author": "ph34tur3",
+ "license": "AGPL-V3",
+ "url": "https://github.com/ph34tur3/Cortex-Analyzers",
+ "version": "1.0",
+ "description": "Search cybercrime-tracker.net for c2 servers.",
+ "dataTypeList": ["domain", "fqdn", "ip", "url", "other"],
+ "command": "CyberCrimeTracker/cct.py",
+ "baseConfig": "CyberCrimeTracker",
+ "config": {
+ "check_tlp": true,
+ "max_tlp": 2
+ },
+ "configurationItems": []
+}
diff --git a/analyzers/CyberCrimeTracker/cct.py b/analyzers/CyberCrimeTracker/cct.py
new file mode 100755
index 000000000..a146b7638
--- /dev/null
+++ b/analyzers/CyberCrimeTracker/cct.py
@@ -0,0 +1,62 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+from cortexutils.analyzer import Analyzer
+from cybercrimetracker.cybercrimeTrackerAPI import cybercrimeTrackerAPI
+
+
+class CyberCrimeTrackerAnalyzer(Analyzer):
+ """
+ This analyzer searches
+ http://cybercrime-tracker.net
+ for possible c2 servers.
+ """
+
+ def __init__(self):
+ Analyzer.__init__(self)
+
+ def summary(self, raw):
+ level = 'info'
+ namespace = 'CCT'
+ predicate = 'C2 Search'
+
+ hit_count = len(raw.get('results', []))
+ value = "\"{} hits\"".format(hit_count)
+ if hit_count == 1:
+ value = value[:-2] + "\""
+
+ if hit_count > 0:
+ level = 'malicious'
+
+ taxonomies = []
+ taxonomies.append(self.build_taxonomy(level, namespace, predicate, value))
+ return {
+ "taxonomies": taxonomies
+ }
+
+ def run(self):
+ observable = self.get_data()
+ limit = 40
+ offset = 0
+
+ results = []
+
+ try:
+ while True:
+ new_results = cybercrimeTrackerAPI().search(query=observable, offset=offset, limit=limit)
+ results.extend(new_results)
+
+ current_hit_count = len(new_results)
+ no_more_results = current_hit_count < limit
+ if no_more_results:
+ break
+ offset += limit
+
+ self.report({
+ 'results': results
+ })
+ except Exception:
+ self.error('An error occured while scraping cybercrime-tracker.')
+
+
+if __name__ == '__main__':
+ CyberCrimeTrackerAnalyzer().run()
diff --git a/analyzers/CyberCrimeTracker/requirements.txt b/analyzers/CyberCrimeTracker/requirements.txt
new file mode 100644
index 000000000..ba9686224
--- /dev/null
+++ b/analyzers/CyberCrimeTracker/requirements.txt
@@ -0,0 +1,2 @@
+cortexutils
+cybercrimetracker
diff --git a/thehive-templates/CyberCrimeTracker_1_0/long.html b/thehive-templates/CyberCrimeTracker_1_0/long.html
new file mode 100644
index 000000000..d84f61645
--- /dev/null
+++ b/thehive-templates/CyberCrimeTracker_1_0/long.html
@@ -0,0 +1,44 @@
+
+
+
+ CyberCrimeTracker C2 Search Report
+
+
+
+ - IP:
+ - {{r.ip}}
+ - URL:
+ - {{r.url}}
+ - Date:
+ - {{r.date}}
+ - Type:
+ - {{r.type}}
+ - VirusTotal (Latest Scan):
+ - {{r.vt_latest_scan}}
+ - VirusTotal (IP Info):
+ - {{r.vt_ip}}
+
+
+
+
+ CyberCrimeTracker C2 Search Report
+
+
+ No matches.
+
+
+
+ {{(artifact.data || artifact.attachment.name) | fang}}
+
+
+
+ - CyberCrimeTracker:
+ - {{content.errorMessage}}
+
+
+