In this presentation we will cover how we could retrieve latest C2s published by the admins of DDOSIA project as soon as a C2 is taken down. We will touch on the implemented custom docker-based sandbox for real-time target collection of DDOSIA’s victims thanks to a collaboration with a fellow at the ForensicXlab, which we will compare to other methodologies from the literature.