Skip to content
COOEY

◄ SITREP

GLOBAL THREAT POSTURE

LIVE

Live global posture — geolocated threat events (outages, attacks, DDoS, ransomware, C2, scans) fused across sources, with a DEFCON level derived from the intel pipeline's own correlated escalations.

LIVE THREAT STREAM streaming · SSE
◈ Connected — awaiting pushed events from the intel stream…
Global DEFCON
1
SEVERE
25 SEVERE (DEFCON-1) escalations active
Global events processed
29,281,448
prevailing recent level · live counter
GLOBAL POSTURE VECTOR signal fusion →
OUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.9% of global)OUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalOUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.9% of global)OUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · AF · Etisalat Afghan — AS131284 (ETISALATAFG-AS-AP) — bgp criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · AF · Etisalat Afghan — AS131284 (ETISALATAFG-AS-AP) — bgp criticalOUTAGE · critical · US · AROSSCLOUD INC. — AROSS-AS -- United States — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.9% of global)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · AF · Etisalat Afghan — AS131284 (ETISALATAFG-AS-AP) — bgp criticalOUTAGE · critical · US · AROSSCLOUD INC. — AROSS-AS -- United States — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · US · AROSSCLOUD INC. — AROSS-AS -- United States — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.9% of global)OUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · US · AROSSCLOUD INC. — AROSS-AS -- United States — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalCOMPROMISED_HOST · high · VN — Compromised: 103.167.88.166MALWARE_URL · high · CN — Malware URL: 1.62.79.200 (malware_download)COMPROMISED_HOST · high · VN — Compromised: 103.160.5.123C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.230MALWARE_URL · high · CN — Malware URL: 123.8.90.13 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.67MALWARE_URL · high · CN — Malware URL: 27.206.188.38 (malware_download)C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.106MALWARE_URL · high · PK — Malware URL: 110.36.86.83 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.41C2_SERVER · critical · CN — Cobaltstrike: 101.42.255.92MALWARE_URL · high · CN — Malware URL: 182.126.248.115 (malware_download)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.88BREACH · critical · ? — Breach: Paidwork (23273k accounts)C2_SERVER · critical · CN — Cobaltstrike: 101.33.225.32BREACH · high · ? — Breach: InterConSecurity (276k accounts)BREACH · high · ? — Breach: HoustonCityCollege (832k accounts)MALWARE_URL · high · EC — Malware URL: 45.233.94.135 (malware_download)COMPROMISED_HOST · high · PK — Compromised: 101.50.83.146C2_SERVER · critical · CN — Cobaltstrike: 101.200.193.211BREACH · critical · ? — Breach: GooseCreek (6574k accounts)BREACH · high · ? — Breach: Fluke (821k accounts)MALWARE_URL · high · EC — Malware URL: 45.233.94.135 (malware_download)COMPROMISED_HOST · high · SG — Compromised: 101.100.216.61C2_SERVER · critical · CN — Cobaltstrike: 101.133.225.51BREACH · critical · ? — Breach: ExactSciences (10870k accounts)BREACH · high · ? — Breach: BrinksHome (732k accounts)MALWARE_URL · high · CN — Malware URL: 182.126.248.115 (malware_download)COMPROMISED_HOST · high · US — Compromised: 100.23.213.128C2_SERVER · critical · CN — Cobaltstrike: 101.126.10.34BREACH · high · ? — Breach: Alcon (218k accounts)OUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.6% of global)OUTAGE · critical · US · AROSSCLOUD INC. — AROSS-AS -- United States — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Krasnodar — ping-slash24 criticalOUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.6% of global)MALICIOUS_SCAN · high · US — urlscan: dfsfiles.com (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Krasnodar — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalOUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Krasnodar — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalOUTAGE · critical · TW · Pittqiao Network Information Co.,Ltd. — AS131642 (PNI-AS-TW) — bgp criticalOUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.8% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.6% of global)OUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Krasnodar — ping-slash24 criticalOUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalOUTAGE · critical · TW · Pittqiao Network Information Co.,Ltd. — AS131642 (PNI-AS-TW) — bgp criticalOUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.7% of global)OUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalOUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.7% of global)MALICIOUS_SCAN · high · US — urlscan: dfsfiles.com (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.7% of global)COMPROMISED_HOST · high · VN — Compromised: 103.167.88.166MALWARE_URL · high · CN — Malware URL: 115.51.88.28 (malware_download)COMPROMISED_HOST · high · VN — Compromised: 103.160.5.123C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.230MALWARE_URL · high · CN — Malware URL: 42.180.33.198 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.67C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.106MALWARE_URL · high · CN — Malware URL: 115.55.195.102 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.41C2_SERVER · critical · CN — Cobaltstrike: 101.42.255.92MALWARE_URL · high · CN — Malware URL: 182.114.255.23 (malware_download)BREACH · critical · ? — Breach: Paidwork (23273k accounts)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.88MALWARE_URL · high · CN — Malware URL: 182.116.118.60 (malware_download)C2_SERVER · critical · CN — Cobaltstrike: 101.33.225.32BREACH · high · ? — Breach: InterConSecurity (276k accounts)BREACH · high · ? — Breach: HoustonCityCollege (832k accounts)COMPROMISED_HOST · high · PK — Compromised: 101.50.83.146MALWARE_URL · high · CN — Malware URL: 182.114.255.23 (malware_download)C2_SERVER · critical · CN — Cobaltstrike: 101.200.193.211BREACH · critical · ? — Breach: GooseCreek (6574k accounts)BREACH · high · ? — Breach: Fluke (821k accounts)MALWARE_URL · high · CN — Malware URL: 42.53.59.112 (malware_download)COMPROMISED_HOST · high · SG — Compromised: 101.100.216.61C2_SERVER · critical · CN — Cobaltstrike: 101.133.225.51BREACH · critical · ? — Breach: ExactSciences (10870k accounts)BREACH · high · ? — Breach: BrinksHome (732k accounts)MALWARE_URL · high · CN — Malware URL: 1.62.79.200 (malware_download)COMPROMISED_HOST · high · US — Compromised: 100.23.213.128C2_SERVER · critical · CN — Cobaltstrike: 101.126.10.34BREACH · high · ? — Breach: Alcon (218k accounts)DDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.4% of global)OUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.4% of global)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: awardwallet.com (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: financebuzz.com (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: frequentmiler.com (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · EG · TE-AS — TE-AS -- Ash Sharqiyah — ping-slash24 criticalOUTAGE · critical · RU · METROBIT Ltd. — AS45054 (Metrobit-AS) — bgp criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.4% of global)OUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · RU · METROBIT Ltd. — AS45054 (Metrobit-AS) — bgp criticalOUTAGE · critical · EG · TE-AS — TE-AS -- Ash Sharqiyah — ping-slash24 criticalOUTAGE · critical · EG · TE-AS — TE-AS -- Ash Sharqiyah — ping-slash24 criticalOUTAGE · critical · RU · METROBIT Ltd. — AS45054 (Metrobit-AS) — bgp criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.5% of global)OUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.5% of global)MALICIOUS_SCAN · high · US — urlscan: dfsfiles.com (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · US · Indiana University — INDIANA-EXTERNAL -- United States — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.5% of global)OUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · US · Indiana University — INDIANA-EXTERNAL -- United States — ping-slash24 criticalMALWARE_URL · high · CN — Malware URL: 221.15.141.166 (malware_download)COMPROMISED_HOST · high · VN — Compromised: 103.167.88.166C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.230MALWARE_URL · high · CN — Malware URL: 182.121.138.136 (malware_download)COMPROMISED_HOST · high · VN — Compromised: 103.160.5.123C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.106MALWARE_URL · high · CN — Malware URL: 123.4.178.145 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.67C2_SERVER · critical · CN — Cobaltstrike: 101.42.255.92MALWARE_URL · high · CN — Malware URL: 221.15.141.166 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.41C2_SERVER · critical · CN — Cobaltstrike: 101.33.225.32MALWARE_URL · high · CN — Malware URL: 115.50.150.5 (malware_download)BREACH · critical · ? — Breach: Paidwork (23273k accounts)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.88BREACH · high · ? — Breach: InterConSecurity (276k accounts)BREACH · high · ? — Breach: HoustonCityCollege (832k accounts)C2_SERVER · critical · CN — Cobaltstrike: 101.200.193.211MALWARE_URL · high · CN — Malware URL: 175.146.54.164 (malware_download)COMPROMISED_HOST · high · PK — Compromised: 101.50.83.146BREACH · critical · ? — Breach: GooseCreek (6574k accounts)BREACH · high · ? — Breach: Fluke (821k accounts)MALWARE_URL · high · CN — Malware URL: 42.180.33.198 (malware_download)C2_SERVER · critical · CN — Cobaltstrike: 101.133.225.51COMPROMISED_HOST · high · SG — Compromised: 101.100.216.61BREACH · critical · ? — Breach: ExactSciences (10870k accounts)BREACH · high · ? — Breach: BrinksHome (732k accounts)MALWARE_URL · high · CN — Malware URL: 27.219.18.191 (malware_download)C2_SERVER · critical · CN — Cobaltstrike: 101.126.10.34COMPROMISED_HOST · high · US — Compromised: 100.23.213.128BREACH · high · ? — Breach: Alcon (218k accounts)OUTAGE · critical · US · Indiana University — INDIANA-EXTERNAL -- United States — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.1% of global)OUTAGE · critical · US · Indiana University — INDIANA-EXTERNAL -- United States — ping-slash24 criticalOUTAGE · critical · US · Indiana University — INDIANA-EXTERNAL -- United States — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.1% of global)MALICIOUS_SCAN · high · US — urlscan: www.inc.com (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · US · Indiana University — INDIANA-EXTERNAL -- United States — ping-slash24 criticalOUTAGE · critical · HK · Kvmcloud Network CO., LIMITED — AS210110 (KVMCLOUD-AS) — bgp criticalOUTAGE · critical · TW · Pittqiao Network Information Co.,Ltd. — AS131642 (PNI-AS-TW) — bgp criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (23.9% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.1% of global)OUTAGE · critical · TW · Pittqiao Network Information Co.,Ltd. — AS131642 (PNI-AS-TW) — bgp criticalOUTAGE · critical · HK · Kvmcloud Network CO., LIMITED — AS210110 (KVMCLOUD-AS) — bgp criticalOUTAGE · critical · PK · National Telecommunication Corporation — AS23888 (NTC-AS-AP) — bgp criticalOUTAGE · critical · ZA · Reflex Solutions — AS37236 (Reflex-Solutions) — bgp criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.0% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.0% of global)OUTAGE · critical · PK · National Telecommunication Corporation — AS23888 (NTC-AS-AP) — bgp criticalOUTAGE · critical · ZA · Reflex Solutions — AS37236 (Reflex-Solutions) — bgp criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · RU · PE Zinstein Hariton Vladimirovich — AS43936 (EVPANET-AS) — bgp criticalOUTAGE · critical · US · AROSSCLOUD INC. — AROSS-AS -- United States — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.0% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.0% of global)MALICIOUS_SCAN · high · US — urlscan: dfsfiles.com (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · US · AROSSCLOUD INC. — AROSS-AS -- United States — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · RU · Joint Stock Company TransTeleCom — ASN-UMN -- Russian Federation — ping-slash24 criticalOUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Russian Federation — ping-slash24 criticalOUTAGE · critical · KR · INet Technologies Co., Ltd. — KPIN-AS-KR -- South Korea — ping-slash24 criticalOUTAGE · critical · RU · Joint Stock Company TransTeleCom — AS16285 (ASN-UMN) — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.0% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (14.0% of global)OUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · KR · INet Technologies Co., Ltd. — KPIN-AS-KR -- South Korea — ping-slash24 criticalOUTAGE · critical · RU · Joint Stock Company TransTeleCom — ASN-UMN -- Russian Federation — ping-slash24 criticalOUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Russian Federation — ping-slash24 criticalOUTAGE · critical · RU · Joint Stock Company TransTeleCom — AS16285 (ASN-UMN) — ping-slash24 criticalMALWARE_URL · high · CN — Malware URL: 163.142.93.187 (malware_download)COMPROMISED_HOST · high · VN — Compromised: 103.167.88.166MALWARE_URL · high · CN — Malware URL: 182.121.138.136 (malware_download)COMPROMISED_HOST · high · VN — Compromised: 103.160.5.123C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.230MALWARE_URL · high · CN — Malware URL: 42.224.175.231 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.67C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.106MALWARE_URL · high · CN — Malware URL: 221.15.141.166 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.41C2_SERVER · critical · CN — Cobaltstrike: 101.42.255.92MALWARE_URL · high · CN — Malware URL: 182.121.138.136 (malware_download)BREACH · critical · ? — Breach: Paidwork (23273k accounts)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.88C2_SERVER · critical · CN — Cobaltstrike: 101.33.225.32BREACH · high · ? — Breach: InterConSecurity (276k accounts)MALWARE_URL · high · CN — Malware URL: 123.4.178.145 (malware_download)BREACH · high · ? — Breach: HoustonCityCollege (832k accounts)COMPROMISED_HOST · high · PK — Compromised: 101.50.83.146C2_SERVER · critical · CN — Cobaltstrike: 101.200.193.211BREACH · critical · ? — Breach: GooseCreek (6574k accounts)MALWARE_URL · high · CN — Malware URL: 221.15.141.166 (malware_download)BREACH · high · ? — Breach: Fluke (821k accounts)COMPROMISED_HOST · high · SG — Compromised: 101.100.216.61C2_SERVER · critical · CN — Cobaltstrike: 101.133.225.51BREACH · critical · ? — Breach: ExactSciences (10870k accounts)BREACH · high · ? — Breach: BrinksHome (732k accounts)MALWARE_URL · high · CN — Malware URL: 115.50.150.5 (malware_download)COMPROMISED_HOST · high · US — Compromised: 100.23.213.128C2_SERVER · critical · CN — Cobaltstrike: 101.126.10.34BREACH · high · ? — Breach: Alcon (218k accounts)OUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · RU · Joint Stock Company TransTeleCom — AS16285 (ASN-UMN) — ping-slash24 criticalOUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Russian Federation — ping-slash24 criticalOUTAGE · critical · KR · INet Technologies Co., Ltd. — KPIN-AS-KR -- South Korea — ping-slash24 criticalOUTAGE · critical · RU · Joint Stock Company TransTeleCom — ASN-UMN -- Russian Federation — ping-slash24 criticalOUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Krasnodar — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.0% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.8% of global)OUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Russian Federation — ping-slash24 criticalOUTAGE · critical · KR · INet Technologies Co., Ltd. — KPIN-AS-KR -- South Korea — ping-slash24 criticalOUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · RU · Joint Stock Company TransTeleCom — AS16285 (ASN-UMN) — ping-slash24 criticalOUTAGE · critical · RU · Joint Stock Company TransTeleCom — ASN-UMN -- Russian Federation — ping-slash24 criticalOUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Krasnodar — ping-slash24 criticalOUTAGE · critical · RU · Joint Stock Company TransTeleCom — ASN-UMN -- Russian Federation — ping-slash24 criticalOUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Krasnodar — ping-slash24 criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.0% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.8% of global)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Krasnodar — ping-slash24 criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.0% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.8% of global)OUTAGE · critical · RU · CRELCOM LLC — CRELCOM-NET -- Krasnodar — ping-slash24 criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.2% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.7% of global)OUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.2% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.7% of global)MALICIOUS_SCAN · high · US — urlscan: dfsfiles.com (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · TW · Pittqiao Network Information Co.,Ltd. — AS131642 (PNI-AS-TW) — bgp criticalOUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.2% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.7% of global)OUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · TW · Pittqiao Network Information Co.,Ltd. — AS131642 (PNI-AS-TW) — bgp criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalCOMPROMISED_HOST · high · VN — Compromised: 103.167.88.166MALWARE_URL · high · CN — Malware URL: 175.148.158.154 (malware_download)COMPROMISED_HOST · high · VN — Compromised: 103.160.5.123C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.230MALWARE_URL · high · CN — Malware URL: 125.45.148.93 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.67C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.106MALWARE_URL · high · CN — Malware URL: 112.251.225.122 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.41C2_SERVER · critical · CN — Cobaltstrike: 101.42.255.92MALWARE_URL · high · CN — Malware URL: 163.142.93.187 (malware_download)BREACH · critical · ? — Breach: Paidwork (23273k accounts)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.88C2_SERVER · critical · CN — Cobaltstrike: 101.33.225.32MALWARE_URL · high · CN — Malware URL: 175.148.158.154 (malware_download)BREACH · high · ? — Breach: InterConSecurity (276k accounts)BREACH · high · ? — Breach: HoustonCityCollege (832k accounts)COMPROMISED_HOST · high · PK — Compromised: 101.50.83.146C2_SERVER · critical · CN — Cobaltstrike: 101.200.193.211MALWARE_URL · high · CN — Malware URL: 175.175.7.234 (malware_download)BREACH · critical · ? — Breach: GooseCreek (6574k accounts)BREACH · high · ? — Breach: Fluke (821k accounts)COMPROMISED_HOST · high · SG — Compromised: 101.100.216.61C2_SERVER · critical · CN — Cobaltstrike: 101.133.225.51MALWARE_URL · high · CN — Malware URL: 163.142.93.187 (malware_download)BREACH · critical · ? — Breach: ExactSciences (10870k accounts)BREACH · high · ? — Breach: BrinksHome (732k accounts)COMPROMISED_HOST · high · US — Compromised: 100.23.213.128MALWARE_URL · high · CN — Malware URL: 182.121.138.136 (malware_download)C2_SERVER · critical · CN — Cobaltstrike: 101.126.10.34BREACH · high · ? — Breach: Alcon (218k accounts)OUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · TW · Pittqiao Network Information Co.,Ltd. — AS131642 (PNI-AS-TW) — bgp criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.2% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.7% of global)OUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · TW · Pittqiao Network Information Co.,Ltd. — AS131642 (PNI-AS-TW) — bgp criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · NG · Zinox Telecommunications Limited — AS37506 (Zinox) — bgp criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · NG · Zinox Telecommunications Limited — AS37506 (Zinox) — bgp criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · RU · TDV "Teleradio company "Yalta" LLC — AS47939 (YALTANET) — bgp criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.2% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.7% of global)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · US — urlscan: pinnacleinfotech.com (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · SG — urlscan: ottegroup.com (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · NG · Zinox Telecommunications Limited — AS37506 (Zinox) — bgp criticalOUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · RU · TDV "Teleradio company "Yalta" LLC — AS47939 (YALTANET) — bgp criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · ZA · Reflex Solutions — AS37236 (Reflex-Solutions) — bgp criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · ZA · Reflex Solutions — AS37236 (Reflex-Solutions) — bgp criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.2% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.7% of global)OUTAGE · critical · DE · Globalways GmbH — GLOBALWAYS -- Germany — ping-slash24 criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · CN · CHINANET Guangdong province network — AS58466 (CT-Guangzhou-IDC) — bgp criticalOUTAGE · critical · CN · CHINANET Guangdong province Dongguan MAN network — AS134772 (ChinaNet-Guangdong-Dongguan-MAN) — bgp criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.3% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.7% of global)OUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · CN · CHINANET Guangdong province Dongguan MAN network — AS134772 (ChinaNet-Guangdong-Dongguan-MAN) — bgp criticalOUTAGE · critical · CN · CHINANET Guangdong province network — AS58466 (CT-Guangzhou-IDC) — bgp criticalREPUTATION · critical · SG — IPsum: 43.153.206.227 (score 8/10+)PHISHING · high · CA — Phishing: guide-library-30bd.siti111856.workers.devREPUTATION · critical · NL — IPsum: 31.76.9.4 (score 8/10+)PHISHING · high · CL — Phishing: 53cfaf.icefactory.clREPUTATION · critical · NL — IPsum: 2.57.122.53 (score 8/10+)HONEYPOT · high · CN — CINS Honeypot: 1.193.63.252PHISHING · high · CL — Phishing: 33dbae.icefactory.clREPUTATION · critical · ZA — IPsum: 129.151.171.7 (score 9/10+)HONEYPOT · high · CN — CINS Honeypot: 1.193.63.172REPUTATION · critical · DE — IPsum: 108.165.164.23 (score 9/10+)PHISHING · high · CL — Phishing: d51b01.icefactory.clHONEYPOT · high · CN — CINS Honeypot: 1.193.63.11REPUTATION · critical · NL — IPsum: 80.82.77.33 (score 9/10+)HONEYPOT · high · CN — CINS Honeypot: 1.192.46.208PHISHING · high · CL — Phishing: 81cc79.icefactory.clREPUTATION · critical · DE — IPsum: 77.90.185.20 (score 9/10+)HONEYPOT · high · CN — CINS Honeypot: 1.192.129.106PHISHING · high · CL — Phishing: 0ee24f.icefactory.clREPUTATION · critical · SE — IPsum: 45.198.224.26 (score 9/10+)HONEYPOT · high · AU — CINS Honeypot: 1.140.3.11PHISHING · high · CL — Phishing: bd3685.icefactory.clREPUTATION · critical · FR — IPsum: 31.77.227.120 (score 9/10+)HONEYPOT · high · AU — CINS Honeypot: 1.120.123.117PHISHING · high · DE — Phishing: www.robiox.com.psREPUTATION · critical · AD — IPsum: 195.178.110.137 (score 11/10+)HONEYPOT · high · CN — CINS Honeypot: 1.119.158.77DDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.3% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.7% of global)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.3% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.7% of global)OUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalCOMPROMISED_HOST · high · VN — Compromised: 103.160.5.123MALWARE_URL · high · RU — Malware URL: 158.255.83.180 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.67C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.230MALWARE_URL · high · US — Malware URL: github.com (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.41C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.106MALWARE_URL · high · US — Malware URL: www.dropbox.com (malware_download)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.88C2_SERVER · critical · CN — Cobaltstrike: 101.42.255.92MALWARE_URL · high · DE — Malware URL: 77.90.185.66 (malware_download)BREACH · critical · ? — Breach: Paidwork (23273k accounts)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.45C2_SERVER · critical · CN — Cobaltstrike: 101.33.225.32MALWARE_URL · high · BO — Malware URL: 190.109.228.150 (malware_download)BREACH · high · ? — Breach: InterConSecurity (276k accounts)BREACH · high · ? — Breach: HoustonCityCollege (832k accounts)COMPROMISED_HOST · high · PK — Compromised: 101.50.83.146C2_SERVER · critical · CN — Cobaltstrike: 101.200.193.211MALWARE_URL · high · CN — Malware URL: 222.142.245.198 (malware_download)BREACH · critical · ? — Breach: GooseCreek (6574k accounts)BREACH · high · ? — Breach: Fluke (821k accounts)MALWARE_URL · high · IN — Malware URL: 59.91.206.69 (malware_download)COMPROMISED_HOST · high · SG — Compromised: 101.100.216.61C2_SERVER · critical · CN — Cobaltstrike: 101.133.225.51BREACH · critical · ? — Breach: ExactSciences (10870k accounts)BREACH · high · ? — Breach: BrinksHome (732k accounts)MALWARE_URL · high · CN — Malware URL: 222.142.245.198 (malware_download)COMPROMISED_HOST · high · US — Compromised: 100.23.213.128C2_SERVER · critical · CN — Cobaltstrike: 101.126.10.34BREACH · high · ? — Breach: Alcon (218k accounts)OUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.3% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.5% of global)OUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.3% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.5% of global)MALICIOUS_SCAN · high · US — urlscan: pinnacleinfotech.com (aitm, malicious)MALICIOUS_SCAN · high · SG — urlscan: ottegroup.com (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · NG · University of Nigeria — AS37405 (UNIV-NG-NSUKKA) — bgp criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.3% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.5% of global)OUTAGE · critical · NG · University of Nigeria — AS37405 (UNIV-NG-NSUKKA) — bgp criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Donets'k — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Ukraine — ping-slash24 criticalOUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — AS49588 (SlvNet-as) — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.4% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.6% of global)OUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Ukraine — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Donets'k — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — AS49588 (SlvNet-as) — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — AS49588 (SlvNet-as) — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Donets'k — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Ukraine — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.4% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.6% of global)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)MALICIOUS_SCAN · high · FI — urlscan: herdestindustriescoltd.com (advance fee fraud, malicious, nondelivery)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · FI — urlscan: herdestindustriescoltd.com (advance fee fraud, malicious, nondelivery)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · FI — urlscan: herdestindustriescoltd.com (advance fee fraud, malicious, nondelivery)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · FI — urlscan: herdestindustriescoltd.com (advance fee fraud, malicious, nondelivery)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Ukraine — ping-slash24 criticalOUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — AS49588 (SlvNet-as) — ping-slash24 criticalOUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Ukraine — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Donets'k — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.4% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.6% of global)OUTAGE · critical · PK · Nayatel (Pvt) Ltd — NAYATEL-PK -- Punjab — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Donets'k — ping-slash24 criticalOUTAGE · critical · UA · SDS-Vostok Ltd. — SlvNet-as -- Ukraine — ping-slash24 criticalMALWARE_URL · high · DE — Malware URL: 77.90.185.66 (malware_download)COMPROMISED_HOST · high · VN — Compromised: 103.160.5.123MALWARE_URL · high · DE — Malware URL: 77.90.185.66 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.67C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.230MALWARE_URL · high · DE — Malware URL: 77.90.185.66 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.41C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.106MALWARE_URL · high · DE — Malware URL: 77.90.185.66 (malware_download)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.88C2_SERVER · critical · CN — Cobaltstrike: 101.42.255.92MALWARE_URL · high · RU — Malware URL: 158.255.83.180 (malware_download)BREACH · critical · ? — Breach: Paidwork (23273k accounts)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.45C2_SERVER · critical · CN — Cobaltstrike: 101.33.225.32BREACH · high · ? — Breach: InterConSecurity (276k accounts)BREACH · high · ? — Breach: HoustonCityCollege (832k accounts)MALWARE_URL · high · US — Malware URL: github.com (malware_download)COMPROMISED_HOST · high · PK — Compromised: 101.50.83.146C2_SERVER · critical · CN — Cobaltstrike: 101.200.193.211BREACH · critical · ? — Breach: GooseCreek (6574k accounts)BREACH · high · ? — Breach: Fluke (821k accounts)MALWARE_URL · high · US — Malware URL: www.dropbox.com (malware_download)COMPROMISED_HOST · high · SG — Compromised: 101.100.216.61C2_SERVER · critical · CN — Cobaltstrike: 101.133.225.51BREACH · critical · ? — Breach: ExactSciences (10870k accounts)BREACH · high · ? — Breach: BrinksHome (732k accounts)MALWARE_URL · high · DE — Malware URL: 77.90.185.66 (malware_download)COMPROMISED_HOST · high · US — Compromised: 100.23.213.128C2_SERVER · critical · CN — Cobaltstrike: 101.126.10.34BREACH · high · ? — Breach: Alcon (218k accounts)OUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.4% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.6% of global)OUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · TW · Asia Pacific On-Line Service Inc. — APOL-AS -- Taichung City — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.4% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.6% of global)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · SE · Internet Vikings International AB — INTERNETBOLAGET -- Sweden — ping-slash24 criticalOUTAGE · critical · FI · Telia Cygate Oy — NBLNETWORKS-AS -- Finland — ping-slash24 criticalOUTAGE · critical · TW · Asia Pacific On-Line Service Inc. — APOL-AS -- Taichung City — ping-slash24 criticalOUTAGE · critical · TW · Asia Pacific On-Line Service Inc. — APOL-AS -- Taichung City — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.4% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.6% of global)DDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.5% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.5% of global)OUTAGE · critical · RU · Yalta-TV KOM Ltd. — AS57093 (ASYALTA) — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.5% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.5% of global)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · ES — Top attacker: 194.224.249.214 (310k reports)MALICIOUS_SCAN · high · US — urlscan: go.melio.com (aitm, malicious)ATTACK · high · NL — Top attacker: 13.94.254.200 (320k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)C2_SERVER · critical · US — LIVE C2: 50.16.16.211:443 (QakBot)OUTAGE · critical · RU · Yalta-TV KOM Ltd. — AS57093 (ASYALTA) — ping-slash24 criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS24445 (CMNET-V4henan-AS-AP) — merit-nt criticalOUTAGE · critical · CN · China Mobile Communications Corporation — AS56042 (CMNET-Shanxi-AP) — merit-nt criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.5% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.9% of global)COMPROMISED_HOST · high · VN — Compromised: 103.160.5.123MALWARE_URL · high · CN — Malware URL: 175.173.53.215 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.67C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.230MALWARE_URL · high · CN — Malware URL: 123.8.45.230 (malware_download)COMPROMISED_HOST · high · SI — Compromised: 102.220.160.41C2_SERVER · critical · NG — Cobaltstrike: 102.204.223.106MALWARE_URL · high · RU — Malware URL: 78.25.123.5 (malware_download)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.88C2_SERVER · critical · CN — Cobaltstrike: 101.42.255.92MALWARE_URL · high · RU — Malware URL: 78.25.123.5 (malware_download)BREACH · critical · ? — Breach: Paidwork (23273k accounts)COMPROMISED_HOST · high · CN — Compromised: 101.96.192.45C2_SERVER · critical · CN — Cobaltstrike: 101.33.225.32MALWARE_URL · high · CN — Malware URL: 123.8.45.230 (malware_download)BREACH · high · ? — Breach: InterConSecurity (276k accounts)BREACH · high · ? — Breach: HoustonCityCollege (832k accounts)COMPROMISED_HOST · high · PK — Compromised: 101.50.83.146C2_SERVER · critical · CN — Cobaltstrike: 101.200.193.211MALWARE_URL · high · CN — Malware URL: 175.173.53.215 (malware_download)BREACH · critical · ? — Breach: GooseCreek (6574k accounts)BREACH · high · ? — Breach: Fluke (821k accounts)COMPROMISED_HOST · high · SG — Compromised: 101.100.216.61C2_SERVER · critical · CN — Cobaltstrike: 101.133.225.51MALWARE_URL · high · CN — Malware URL: 42.227.207.180 (malware_download)BREACH · critical · ? — Breach: ExactSciences (10870k accounts)BREACH · high · ? — Breach: BrinksHome (732k accounts)COMPROMISED_HOST · high · US — Compromised: 100.23.213.128MALWARE_URL · high · CN — Malware URL: 42.227.207.180 (malware_download)C2_SERVER · critical · CN — Cobaltstrike: 101.126.10.34BREACH · high · ? — Breach: Alcon (218k accounts)OUTAGE · critical · US · Unified Layer — UNIFIEDLAYER-AS-1 -- United States — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.5% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.4% of global)OUTAGE · critical · US · Unified Layer — UNIFIEDLAYER-AS-1 -- United States — ping-slash24 criticalOUTAGE · critical · US · AROSSCLOUD INC. — AROSS-AS -- United States — ping-slash24 criticalOUTAGE · critical · US · AHOSTING — AHOSTING -- United States — ping-slash24 criticalOUTAGE · critical · US · Summit Broadband — ORLANDOTELCO -- United States — ping-slash24 criticalOUTAGE · critical · CH · Nine Internet Solutions AG — NINE -- Switzerland — ping-slash24 criticalDDOS_ORIGIN · high · US — CF Radar: US top DDoS L7 origin (24.5% of global)DDOS_ORIGIN · high · BR — CF Radar: BR top DDoS L3 origin (13.4% of global)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)ATTACK · high · NL — Top attacker: 52.157.207.201 (195k reports)MALICIOUS_SCAN · high · IN — urlscan: clients.erpcare.in (aitm, malicious)
critical high med/low 740 geolocated of 1000 events
EVENT TYPES
outage212
event97
malicious scan97
ddos origin96
ransomware post77
c2 server71
compromised host64
malware url64
breach64
attack46
exploited vuln40
vulnerability32
reputation10
iran probe change9
phishing8
honeypot8
probe vantage block2
probe change2
hijacked prefix1
TOP ORIGIN COUNTRIES
US160
CN147
IN67
BR48
NL34
RU34
DE26
PK23
CORRELATED ESCALATIONS
500 active
FUSED CORRELATIONS · DEFCON-RANKED all fusion →
DEFCON 1
Nation-State Network Activity · US
CRITICAL
DEFCON 1
Nation-State Network Activity · CN
CRITICAL
DEFCON 2
DDoS Origin + Active Threat Feed Signal · US
CRITICAL
DEFCON 2
DDoS Origin + Active Threat Feed Signal · NL
CRITICAL
DEFCON 2
DDoS Origin + Active Threat Feed Signal · CN
CRITICAL
DEFCON 3
Bulletproof Hosting Detected
HIGH