Skip to content
COOEY
LIVE · 0m

◄ SITREP

TRIAGE & INVESTIGATION

SECOPS

Security-ops queue over the live fused alert streams — probe/outage verdicts & IOC/attack events, severity-ranked. Select an alert to investigate: raw payload, telemetry, outage-vs-vantage verification, and IOC enrichment. Read-only console; escalation/isolation is the private incident plane.

Alert queue
429
active alerts
Critical
76
top-priority
High
222
elevated
Under investigation
SIG-D123D6
DEFCON case
ALERT_QUEUE
sev · source · verdict live
CRITICAL DEFCON 2m
[DEFCON 1] Nation-State Network Activity
CRITICAL FEODO C2 6m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL FEODO C2 6m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL DEFCON 11m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL DEFCON 32m
[DEFCON 1] Nation-State Network Activity
CRITICAL FEODO C2 36m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL FEODO C2 36m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL C2INTEL 50m
Cobaltstrike: 101.43.103.154
CRITICAL C2INTEL 50m
Cobaltstrike: 101.43.103.154
CRITICAL C2INTEL 50m
Cobaltstrike: 101.42.255.92
CRITICAL C2INTEL 50m
Cobaltstrike: 101.42.255.92
CRITICAL C2INTEL 50m
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 50m
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 50m
Cobaltstrike: 101.200.193.211
CRITICAL C2INTEL 50m
Cobaltstrike: 101.200.193.211
CRITICAL C2INTEL 50m
Cobaltstrike: 101.133.229.117
CRITICAL C2INTEL 50m
Cobaltstrike: 101.133.229.117
CRITICAL C2INTEL 50m
Cobaltstrike: 101.126.10.34
CRITICAL C2INTEL 50m
Cobaltstrike: 101.126.10.34
CRITICAL C2INTEL 50m
Cobaltstrike: 1.15.76.39
CRITICAL C2INTEL 50m
Cobaltstrike: 1.15.76.39
CRITICAL DEFCON 51m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL DEFCON 1h
[DEFCON 1] Nation-State Network Activity
CRITICAL UKRAINE-ALER 1h
🚨 AIR RAID ALERT: Luhansk oblast
CRITICAL DEFCON 1h
GitHub: Incident with Actions [investigating] — Actions, Pages
CRITICAL CHANGEDETECT 1h
GitHub: Incident with Actions [investigating] — Actions, Pages
CRITICAL FEODO C2 1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL FEODO C2 1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL IODA 1h
AS37405 (UNIV-NG-NSUKKA) — bgp critical
CRITICAL IODA 1h
AS37405 (UNIV-NG-NSUKKA) — bgp critical
CRITICAL IODA 1h
Nigeria — bgp critical
CRITICAL IODA 1h
AS37405 (UNIV-NG-NSUKKA) — bgp critical
CRITICAL IODA 1h
AS37405 (UNIV-NG-NSUKKA) — bgp critical
CRITICAL IODA 1h
Nigeria — bgp critical
CRITICAL IODA 1h
AS9123 (TimeWeb-AS) — bgp critical
CRITICAL IODA 1h
AS9123 (TimeWeb-AS) — bgp critical
CRITICAL DEFCON 1h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL FEODO C2 1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL DEFCON 1h
[DEFCON 1] Nation-State Network Activity
CRITICAL C2INTEL 1h
Cobaltstrike: 101.43.103.154
CRITICAL C2INTEL 1h
Cobaltstrike: 101.42.255.92
CRITICAL C2INTEL 1h
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 1h
Cobaltstrike: 101.200.193.211
CRITICAL IODA 1h
NBLNETWORKS-AS -- Finland — ping-slash24 critical
CRITICAL IODA 1h
NBLNETWORKS-AS -- Finland — ping-slash24 critical
CRITICAL IODA 1h
AS131284 (ETISALATAFG-AS-AP) — bgp critical
CRITICAL IODA 1h
AS133119 (UNICOM-CN) — bgp critical
CRITICAL IODA 1h
AS136958 (UNICOM-GuangZhou-IDC) — bgp critical
CRITICAL IODA 1h
AS135061 (UNICOM-ShenZhen-IDC) — bgp critical
CRITICAL IODA 1h
AS138421 (CU-CN-AS) — bgp critical
CRITICAL IODA 1h
AS23844 (BJ-GUANGHUAN-AP) — bgp critical
CRITICAL IODA 1h
AS60490 (MTS-CLOUD) — bgp critical
CRITICAL IODA 1h
AS131284 (ETISALATAFG-AS-AP) — bgp critical
CRITICAL IODA 1h
AS131284 (ETISALATAFG-AS-AP) — bgp critical
CRITICAL IODA 1h
AS133119 (UNICOM-CN) — bgp critical
CRITICAL IODA 1h
AS136958 (UNICOM-GuangZhou-IDC) — bgp critical
CRITICAL IODA 1h
AS135061 (UNICOM-ShenZhen-IDC) — bgp critical
CRITICAL IODA 1h
AS138421 (CU-CN-AS) — bgp critical
CRITICAL IODA 1h
AS23844 (BJ-GUANGHUAN-AP) — bgp critical
CRITICAL IODA 1h
AS60490 (MTS-CLOUD) — bgp critical
CRITICAL IODA 1h
AS131284 (ETISALATAFG-AS-AP) — bgp critical
CRITICAL IODA 2h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL IODA 2h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL IODA 2h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL IODA 2h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL IODA 2h
ASB2B2C -- Canada — ping-slash24 critical
CRITICAL IODA 2h
NAYATEL-PK -- Punjab — ping-slash24 critical
CRITICAL IODA 2h
ASB2B2C -- Canada — ping-slash24 critical
CRITICAL IODA 2h
ASB2B2C -- Canada — ping-slash24 critical
CRITICAL IODA 2h
POSTECH-AS-KR -- South Korea — ping-slash24 critical
CRITICAL IODA 2h
AS9123 (TimeWeb-AS) — bgp critical
CRITICAL IODA 2h
AS9123 (TimeWeb-AS) — bgp critical
CRITICAL HIBP 19h
Breach: Carhartt (12933k accounts)
CRITICAL HIBP 19h
Breach: Carhartt (12933k accounts)
CRITICAL HIBP 19d
Breach: ExactSciences (10870k accounts)
CRITICAL HIBP 19d
Breach: ExactSciences (10870k accounts)
HIGH RANSOMLOOK now
Ransomware: coinbase cartel → Crowe
HIGH RANSOMLOOK now
Ransomware: coinbase cartel → Crowe
HIGH RANSOMLOOK now
Ransomware: coinbase cartel → Crowe
HIGH RANSOMLOOK now
Ransomware: coinbase cartel → Crowe
INVESTIGATION
Investigation ID
SIG-D123D6
Status
ACTIVE
CRITICAL DEFCON 1h ago
Raw payload
GitHub: Incident with Actions [investigating] — Actions, Pages We believe we've identified and addressed the issue and are ramping traffic back up slowly to ensure it doesn't recur. Some customers will continue to see delays as we ramp up.
Telemetry timeline · related activity
No correlated activity on this indicator in the current window.
↗ signal fusion
Escalate / isolate actions live in the private incident plane (per-tenant).
IOC_ENRICHMENT
No network indicator on this alert — nothing to enrich.