Skip to content
COOEY

◄ SITREP

LIVE ATTACK MONITOR

THREAT_MAP

Real-time fused attack telemetry — active C2 beacons, DDoS origins, malicious scans, phishing infrastructure & ransomware claims — streamed from the estate threat pipeline. Each event is a live observation, geo-plotted and lane-classified.

--- [ THREAT_LEGEND ] ---
DDoS / ATTACK ORIGINS[HIGH_PRIORITY]
MALWARE / C2 / RANSOM[TRACKED]
PHISHING / SCAN NODES[MONITORED]
[ WARNING: 347 CRITICAL THREATS ACTIVE // DEFCON 1 ]
UTC: — SEC: BLK_29281448
// GLOBAL_THREAT_MAP
DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (23.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (14.9% of global) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (23.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (14.9% of global) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (23.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (14.9% of global) ATTACK SRC · RU · Top attacker: 152.89.198.103 (41k reports) ATTACK SRC · RU · Top attacker: 152.89.198.163 (41k reports) ATTACK SRC · US · Top attacker: 18.116.198.191 (60k reports) ATTACK SRC · US · Top attacker: 143.244.186.35 (92k reports) ATTACK SRC · PL · Top attacker: 89.248.163.109 (96k reports) ATTACK SRC · NL · Top attacker: 52.157.207.201 (195k reports) ATTACK SRC · ES · Top attacker: 194.224.249.214 (310k reports) ATTACK SRC · NL · Top attacker: 13.94.254.200 (320k reports) C2 / MALWARE · US · LIVE C2: 50.16.16.211:443 (QakBot) PHISH / SCAN · IN · urlscan: clients.erpcare.in (aitm, malicious) PHISH / SCAN · IN · urlscan: clients.erpcare.in (aitm, malicious) PHISH / SCAN · IN · urlscan: clients.erpcare.in (aitm, malicious) PHISH / SCAN · IN · urlscan: clients.erpcare.in (aitm, malicious) PHISH / SCAN · IN · urlscan: clients.erpcare.in (aitm, malicious) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (23.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (14.9% of global) C2 / MALWARE · NG · Cobaltstrike: 102.204.223.230 C2 / MALWARE · NG · Cobaltstrike: 102.204.223.106 C2 / MALWARE · CN · Cobaltstrike: 101.42.255.92 C2 / MALWARE · CN · Cobaltstrike: 101.33.225.32 C2 / MALWARE · CN · Cobaltstrike: 101.200.193.211 C2 / MALWARE · CN · Cobaltstrike: 101.133.225.51 C2 / MALWARE · CN · Cobaltstrike: 101.126.10.34 DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (23.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (14.6% of global) OUTAGE · US · ORLANDOTELCO -- United States — ping-slash24 critical OUTAGE · US · ORLANDOTELCO -- United States — ping-slash24 critical OUTAGE · US · ORLANDOTELCO -- United States — ping-slash24 critical OUTAGE · US · ORLANDOTELCO -- United States — ping-slash24 critical DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (23.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (14.6% of global) ATTACK SRC · RU · Top attacker: 152.89.198.103 (41k reports) ATTACK SRC · RU · Top attacker: 152.89.198.163 (41k reports) ATTACK SRC · US · Top attacker: 18.116.198.191 (60k reports) ATTACK SRC · US · Top attacker: 143.244.186.35 (92k reports) ATTACK SRC · PL · Top attacker: 89.248.163.109 (96k reports) ATTACK SRC · NL · Top attacker: 52.157.207.201 (195k reports) ATTACK SRC · ES · Top attacker: 194.224.249.214 (310k reports)
ddos malware/c2 phish/scan ◎ defended stack · arcs = live inbound observations
SYSTEM_METRICS
Threat load32%
PipelineSTREAMING
130
active events
56
critical
42
ddos origins
25
malware / c2
encrypted line active · polling
LIVE_ATTACK_STREAM
severity · vector · source → destination · seen ◆ ACTIVE_THREADS: 130
HIGH DDoS ORIGIN — 4m ago
HIGH DDoS ORIGIN — 4m ago
HIGH DDoS ORIGIN — 14m ago
HIGH DDoS ORIGIN — 14m ago
HIGH DDoS ORIGIN — 24m ago
HIGH DDoS ORIGIN — 24m ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 25m ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 25m ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 25m ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 25m ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 26m ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 26m ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 26m ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 26m ago
INFO THREAT LEVEL — 26m ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 26m ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 27m ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 28m ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 28m ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 28m ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 28m ago
HIGH DDoS ORIGIN — 34m ago
HIGH DDoS ORIGIN — 34m ago
CRITICAL C2 / MALWARE 102.204.223.230 → AS139923 39m ago
CRITICAL C2 / MALWARE 102.204.223.106 → AS139923 39m ago
CRITICAL C2 / MALWARE 101.42.255.92 → AS45090 39m ago
CRITICAL C2 / MALWARE 101.33.225.32 → AS45090 40m ago
CRITICAL C2 / MALWARE 101.200.193.211 → AS37963 40m ago
CRITICAL C2 / MALWARE 101.133.225.51 → AS37963 40m ago
CRITICAL C2 / MALWARE 101.126.10.34 → AS137718 40m ago
HIGH DDoS ORIGIN — 44m ago
HIGH DDoS ORIGIN — 44m ago
CRITICAL OUTAGE — → AS23314 52m ago
CRITICAL OUTAGE — → AS23314 52m ago
CRITICAL OUTAGE — → AS23314 52m ago
CRITICAL OUTAGE — → AS23314 52m ago
HIGH DDoS ORIGIN — 54m ago
HIGH DDoS ORIGIN — 54m ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 55m ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 55m ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 55m ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 56m ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 56m ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 56m ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 56m ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 56m ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 56m ago
INFO THREAT LEVEL — 56m ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 57m ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 58m ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 58m ago
HIGH PHISH / SCAN 69.167.176.86 → AS32244 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH DDoS ORIGIN — 1h ago
CRITICAL OUTAGE — → AS48918 1h ago
CRITICAL OUTAGE — → AS48918 1h ago
CRITICAL OUTAGE — → AS48918 1h ago
CRITICAL OUTAGE — → AS48918 1h ago
CRITICAL OUTAGE — → AS48918 1h ago
CRITICAL OUTAGE — → AS48918 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH DDoS ORIGIN — 1h ago
CRITICAL OUTAGE — → AS131284 1h ago
CRITICAL OUTAGE — → AS131284 1h ago
CRITICAL OUTAGE — → AS131284 1h ago
CRITICAL OUTAGE — → AS400619 1h ago
CRITICAL OUTAGE — → AS400619 1h ago
CRITICAL OUTAGE — → AS400619 1h ago
CRITICAL OUTAGE — → AS400619 1h ago
CRITICAL OUTAGE — → AS400619 1h ago
CRITICAL OUTAGE — → AS56042 1h ago
CRITICAL OUTAGE — → AS56042 1h ago
CRITICAL OUTAGE — → AS56042 1h ago
CRITICAL OUTAGE — → AS56042 1h ago
CRITICAL OUTAGE — → AS56042 1h ago
CRITICAL OUTAGE — → AS56042 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH DDoS ORIGIN — 1h ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 1h ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 1h ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 1h ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 1h ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 1h ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 1h ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 1h ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 1h ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 1h ago
INFO THREAT LEVEL — 1h ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 1h ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 1h ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 1h ago
HIGH PHISH / SCAN 103.191.209.16 → AS150055 1h ago
HIGH PHISH / SCAN 69.167.176.86 → AS32244 1h ago
CRITICAL OUTAGE — → AS56042 1h ago
CRITICAL OUTAGE — → AS56042 1h ago
CRITICAL OUTAGE — → AS29422 1h ago
CRITICAL OUTAGE — → AS29422 1h ago
CRITICAL OUTAGE — → AS29422 1h ago
CRITICAL OUTAGE — → AS6789 1h ago
CRITICAL OUTAGE — → AS23674 1h ago
CRITICAL OUTAGE — → AS23674 1h ago
CRITICAL OUTAGE — → AS6789 1h ago
CRITICAL OUTAGE — → AS6789 1h ago
CRITICAL OUTAGE — → AS6789 1h ago
CRITICAL OUTAGE — → AS23674 1h ago
CRITICAL OUTAGE — → AS56042 1h ago
CRITICAL OUTAGE — → AS56042 1h ago
CRITICAL OUTAGE — → AS131642 2h ago
CRITICAL OUTAGE — → AS23314 2h ago
CRITICAL OUTAGE — → AS23314 2h ago
CRITICAL OUTAGE — → AS131642 2h ago
CRITICAL OUTAGE — → AS23314 2h ago
CRITICAL OUTAGE — → AS23314 2h ago
CRITICAL OUTAGE — → AS23314 2h ago
CRITICAL OUTAGE — → AS23314 2h ago
HIGH RANSOMWARE — 3h ago
HIGH RANSOMWARE — 3h ago
HIGH RANSOMWARE — 3h ago
HIGH RANSOMWARE — 6h ago
HIGH RANSOMWARE — 6h ago
HIGH RANSOMWARE — 6h ago
HIGH RANSOMWARE — 6h ago
HIGH RANSOMWARE — 6h ago
HIGH RANSOMWARE — 6h ago
HIGH RANSOMWARE — 7h ago
HIGH RANSOMWARE — 7h ago
HIGH RANSOMWARE — 7h ago
HIGH RANSOMWARE — 8h ago
HIGH RANSOMWARE — 8h ago
HIGH RANSOMWARE — 8h ago