Skip to content
COOEY
LIVE · 13m

◄ SITREP

TRIAGE & INVESTIGATION

SECOPS

Security-ops queue over the live fused alert streams — probe/outage verdicts & IOC/attack events, severity-ranked. Select an alert to investigate: raw payload, telemetry, outage-vs-vantage verification, and IOC enrichment. Read-only console; escalation/isolation is the private incident plane.

Alert queue
385
active alerts
Critical
96
top-priority
High
189
elevated
Under investigation
SIG-598556
DEFCON case
ALERT_QUEUE
sev · source · verdict live
CRITICAL C2INTEL 12m
Cobaltstrike: 101.43.103.154
CRITICAL C2INTEL 12m
Cobaltstrike: 101.43.103.154
CRITICAL C2INTEL 12m
Cobaltstrike: 101.42.255.92
CRITICAL C2INTEL 12m
Cobaltstrike: 101.42.255.92
CRITICAL C2INTEL 12m
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 12m
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 12m
Cobaltstrike: 101.200.193.211
CRITICAL C2INTEL 12m
Cobaltstrike: 101.200.193.211
CRITICAL C2INTEL 12m
Cobaltstrike: 101.133.229.117
CRITICAL C2INTEL 12m
Cobaltstrike: 101.133.229.117
CRITICAL C2INTEL 12m
Cobaltstrike: 101.126.10.34
CRITICAL C2INTEL 12m
Cobaltstrike: 101.126.10.34
CRITICAL C2INTEL 12m
Cobaltstrike: 1.15.76.39
CRITICAL C2INTEL 12m
Cobaltstrike: 1.15.76.39
CRITICAL DEFCON 17m
[DEFCON 1] Nation-State Network Activity
CRITICAL DEFCON 23m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL FEODO C2 29m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL FEODO C2 29m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL UKRAINE-ALER 30m
🚨 AIR RAID ALERT: Luhansk oblast
CRITICAL IODA 44m
MEGAFON-AS -- Lipetsk — ping-slash24 critical
CRITICAL IODA 44m
MEGAFON-AS -- Lipetsk — ping-slash24 critical
CRITICAL IODA 44m
NAYATEL-PK -- Punjab — ping-slash24 critical
CRITICAL IODA 44m
MEGAFON-AS -- Lipetsk — ping-slash24 critical
CRITICAL DEFCON 49m
[DEFCON 1] Nation-State Network Activity
CRITICAL DEFCON 53m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL DEFCON 55m
DigitalOcean: Cloud Control Panel and API [investigating] — API, Cloud Control Panel
CRITICAL FEODO C2 59m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL C2INTEL 1h
Cobaltstrike: 101.43.103.154
CRITICAL C2INTEL 1h
Cobaltstrike: 101.42.255.92
CRITICAL C2INTEL 1h
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 1h
Cobaltstrike: 101.200.193.211
CRITICAL C2INTEL 1h
Cobaltstrike: 101.133.229.117
CRITICAL C2INTEL 1h
Cobaltstrike: 101.126.10.34
CRITICAL C2INTEL 1h
Cobaltstrike: 1.15.76.39
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL DEFCON 1h
[DEFCON 1] Nation-State Network Activity
CRITICAL IODA 1h
box-broadband -- United Kingdom — ping-slash24 critical
CRITICAL IODA 1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL IODA 1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL IODA 1h
box-broadband -- United Kingdom — ping-slash24 critical
CRITICAL IODA 1h
box-broadband -- United Kingdom — ping-slash24 critical
CRITICAL IODA 1h
box-broadband -- United Kingdom — ping-slash24 critical
CRITICAL IODA 1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL IODA 1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL IODA 1h
box-broadband -- United Kingdom — ping-slash24 critical
CRITICAL IODA 1h
box-broadband -- United Kingdom — ping-slash24 critical
CRITICAL DEFCON 1h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL FEODO C2 1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL IODA 1h
AS132585 (SIA-HK-AS) — bgp critical
CRITICAL IODA 1h
AS132585 (SIA-HK-AS) — bgp critical
CRITICAL IODA 1h
AS132585 (SIA-HK-AS) — bgp critical
CRITICAL IODA 1h
AS132585 (SIA-HK-AS) — bgp critical
CRITICAL IODA 1h
AS132585 (SIA-HK-AS) — bgp critical
CRITICAL IODA 1h
AS132585 (SIA-HK-AS) — bgp critical
CRITICAL IODA 1h
AS131284 (ETISALATAFG-AS-AP) — bgp critical
CRITICAL IODA 1h
NBLNETWORKS-AS -- Finland — ping-slash24 critical
CRITICAL IODA 1h
NBLNETWORKS-AS -- Finland — ping-slash24 critical
CRITICAL IODA 1h
AS131284 (ETISALATAFG-AS-AP) — bgp critical
CRITICAL IODA 1h
AS131284 (ETISALATAFG-AS-AP) — bgp critical
CRITICAL IODA 1h
NBLNETWORKS-AS -- Finland — ping-slash24 critical
CRITICAL IODA 1h
NBLNETWORKS-AS -- Finland — ping-slash24 critical
CRITICAL IODA 1h
AS131284 (ETISALATAFG-AS-AP) — bgp critical
CRITICAL IODA 1h
NAYATEL-PK -- Punjab — ping-slash24 critical
CRITICAL IODA 1h
NAYATEL-PK -- Punjab — ping-slash24 critical
CRITICAL IODA 1h
NAYATEL-PK -- Punjab — ping-slash24 critical
CRITICAL IODA 1h
NAYATEL-PK -- Punjab — ping-slash24 critical
CRITICAL IODA 1h
NAYATEL-PK -- Punjab — ping-slash24 critical
CRITICAL IODA 1h
NAYATEL-PK -- Punjab — ping-slash24 critical
CRITICAL IODA 1h
WINDTRE-AS -- Italy — ping-slash24 critical
CRITICAL IODA 1h
WINDTRE-AS -- Italy — ping-slash24 critical
CRITICAL IODA 1h
WINDTRE-AS -- Italy — ping-slash24 critical
CRITICAL IODA 1h
WINDTRE-AS -- Italy — ping-slash24 critical
CRITICAL DEFCON 1h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
INVESTIGATION
Investigation ID
SIG-598556
Status
ACTIVE
CRITICAL DEFCON 55m ago
Raw payload
DigitalOcean: Cloud Control Panel and API [investigating] — API, Cloud Control Panel Our Engineering team is investigating a recurrence of the issue impacting the DigitalOcean public API and Cloud Control Panel. This issue does not impact our data plane (i.e. running droplets). Users may experience difficulties accessing the Cloud Control Panel, along with elevated latency and intermittent errors when accessing the public API or Cloud Control Plane. We are actively investigating the issue and working to restore normal service. We will continue to provide updates as more inform
Telemetry timeline · related activity
No correlated activity on this indicator in the current window.
↗ signal fusion
Escalate / isolate actions live in the private incident plane (per-tenant).
IOC_ENRICHMENT
No network indicator on this alert — nothing to enrich.