Skip to content
COOEY

◄ SITREP

LIVE ATTACK MONITOR

THREAT_MAP

Real-time fused attack telemetry — active C2 beacons, DDoS origins, malicious scans, phishing infrastructure & ransomware claims — streamed from the estate threat pipeline. Each event is a live observation, geo-plotted and lane-classified.

--- [ THREAT_LEGEND ] ---
DDoS / ATTACK ORIGINS[HIGH_PRIORITY]
MALWARE / C2 / RANSOM[TRACKED]
PHISHING / SCAN NODES[MONITORED]
[ WARNING: 200 CRITICAL THREATS ACTIVE // DEFCON 1 ]
UTC: — SEC: BLK_29290475
// GLOBAL_THREAT_MAP
C2 / MALWARE · CN · Cobaltstrike: 101.126.10.34 C2 / MALWARE · CN · Cobaltstrike: 1.15.76.39 DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (22.3% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (14.2% of global) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (22.3% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (14.2% of global) ATTACK SRC · RU · Top attacker: 152.89.198.103 (41k reports) ATTACK SRC · RU · Top attacker: 152.89.198.163 (41k reports) ATTACK SRC · US · Top attacker: 18.116.198.191 (60k reports) ATTACK SRC · US · Top attacker: 143.244.186.35 (92k reports) ATTACK SRC · PL · Top attacker: 89.248.163.109 (96k reports) ATTACK SRC · NL · Top attacker: 52.157.207.201 (195k reports) ATTACK SRC · ES · Top attacker: 194.224.249.214 (310k reports) ATTACK SRC · NL · Top attacker: 13.94.254.200 (320k reports) C2 / MALWARE · US · LIVE C2: 50.16.16.211:443 (QakBot) PHISH / SCAN · SG · urlscan: magic-sapphire-td2fox1e-dpq1cmpr2vwd.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: causal-azure-9hq8d3zt-dpuspqqwca3a.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: different-lime-wjexf4qi-dpsj7j539qyx.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: prepared-tan-smeq5bd0-dpbgh99qublx.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: yappiest-silver-wdqst59k-dprv31sf9bt6.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: eager-teal-y5rcx44y-dpco632xczgj.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: nst-study-dp0a2pk0rl9x.edgeone.dev (phishing, malicious) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (22.3% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (14.2% of global) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (22.3% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (13.8% of global) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (22.3% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (13.8% of global) ATTACK SRC · RU · Top attacker: 152.89.198.103 (41k reports) ATTACK SRC · RU · Top attacker: 152.89.198.163 (41k reports) ATTACK SRC · US · Top attacker: 18.116.198.191 (60k reports) ATTACK SRC · US · Top attacker: 143.244.186.35 (92k reports) ATTACK SRC · PL · Top attacker: 89.248.163.109 (96k reports) ATTACK SRC · NL · Top attacker: 52.157.207.201 (195k reports) ATTACK SRC · ES · Top attacker: 194.224.249.214 (310k reports) ATTACK SRC · NL · Top attacker: 13.94.254.200 (320k reports) C2 / MALWARE · US · LIVE C2: 50.16.16.211:443 (QakBot) PHISH / SCAN · SG · urlscan: partial-maroon-gujyly5w-dplqykjp48vc.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: experimental-bronze-5dkpucg9-dpcac5yzn1qk.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: silky-sapphire-dzpl2m2z-dp000y4g4ebx.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: petite-indigo-6akhqvzz-dpo25ao2pa4o.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: clear-copper-lipvkfpb-dpiq16uv6acf.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: due-olive-pwmpb7gm-dpetyt7w4p32.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: poised-azure-zvw1ljg8-dpscowlyceap.edgeone.dev (phishing, malicious)
ddos malware/c2 phish/scan ◎ defended stack · arcs = live inbound observations
SYSTEM_METRICS
Threat load23%
PipelineSTREAMING
91
active events
36
critical
28
ddos origins
20
malware / c2
encrypted line active · polling
LIVE_ATTACK_STREAM
severity · vector · source → destination · seen ◆ ACTIVE_THREADS: 91
HIGH RANSOMWARE — now
HIGH RANSOMWARE — now
HIGH RANSOMWARE — now
HIGH RANSOMWARE — now
CRITICAL C2 / MALWARE 101.126.10.34 → AS137718 4s ago
CRITICAL C2 / MALWARE 1.15.76.39 → AS45090 8s ago
HIGH DDoS ORIGIN — 3m ago
HIGH DDoS ORIGIN — 3m ago
HIGH DDoS ORIGIN — 13m ago
HIGH DDoS ORIGIN — 13m ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 15m ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 15m ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 15m ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 15m ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 15m ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 16m ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 16m ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 16m ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 16m ago
INFO THREAT LEVEL — 16m ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 16m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 17m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 17m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 18m ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 18m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 19m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 19m ago
HIGH DDoS ORIGIN — 23m ago
HIGH DDoS ORIGIN — 23m ago
HIGH DDoS ORIGIN — 33m ago
HIGH DDoS ORIGIN — 33m ago
HIGH DDoS ORIGIN — 43m ago
HIGH DDoS ORIGIN — 43m ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 45m ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 45m ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 45m ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 45m ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 45m ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 46m ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 46m ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 46m ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 46m ago
INFO THREAT LEVEL — 46m ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 46m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 47m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 47m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 48m ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 48m ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 49m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 49m ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 49m ago
CRITICAL OUTAGE — → AS23674 52m ago
CRITICAL OUTAGE — → AS23674 52m ago
CRITICAL OUTAGE — → AS23674 52m ago
CRITICAL OUTAGE — → AS23674 52m ago
HIGH DDoS ORIGIN — 53m ago
HIGH DDoS ORIGIN — 53m ago
CRITICAL C2 / MALWARE 101.43.103.154 → AS45090 59m ago
CRITICAL C2 / MALWARE 101.42.255.92 → AS45090 59m ago
CRITICAL C2 / MALWARE 101.33.225.32 → AS45090 59m ago
CRITICAL C2 / MALWARE 101.200.193.211 → AS37963 59m ago
CRITICAL C2 / MALWARE 101.133.229.117 → AS37963 1h ago
CRITICAL C2 / MALWARE 101.126.10.34 → AS137718 1h ago
CRITICAL OUTAGE — → AS17429 1h ago
CRITICAL OUTAGE — → AS17429 1h ago
CRITICAL OUTAGE — → AS17429 1h ago
CRITICAL OUTAGE — → AS17429 1h ago
CRITICAL OUTAGE — → AS17429 1h ago
CRITICAL OUTAGE — → AS17429 1h ago
CRITICAL OUTAGE — → AS17429 1h ago
CRITICAL OUTAGE — → AS17429 1h ago
CRITICAL OUTAGE — → AS23314 1h ago
CRITICAL OUTAGE — → AS23314 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
CRITICAL OUTAGE — → AS29975 1h ago
HIGH RANSOMWARE — 2h ago
HIGH RANSOMWARE — 2h ago
HIGH RANSOMWARE — 3h ago
HIGH RANSOMWARE — 3h ago
HIGH RANSOMWARE — 4h ago
HIGH RANSOMWARE — 4h ago