Just start hunting them down. But I agree, the tools to do that ie. flow, isp/hosting provider relationships, ad tech telemetry, etc are fucking expensive and/or have gate keepers. There are some good projects out there that build the foundations tho, like hunt.io etc
Threat Hunting Platform | C2 & Malicious Infrastructure Hunting
Explore the leading Threat Hunting Platform, discover active C2 servers, perform proactive infrastructure hunting and more.