Skip to content
COOEY
LIVE · 0m

◄ SITREP

TRIAGE & INVESTIGATION

SECOPS

Security-ops queue over the live fused alert streams — probe/outage verdicts & IOC/attack events, severity-ranked. Select an alert to investigate: raw payload, telemetry, outage-vs-vantage verification, and IOC enrichment. Read-only console; escalation/isolation is the private incident plane.

Alert queue
340
active alerts
Critical
75
top-priority
High
171
elevated
Under investigation
SIG-598556
DEFCON case
ALERT_QUEUE
sev · source · verdict live
CRITICAL DEFCON 2m
DigitalOcean — Monitoring — Cloud Control Panel and API
CRITICAL CHANGEDETECT 2m
DigitalOcean — Monitoring — Cloud Control Panel and API
CRITICAL FEODO C2 14m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL FEODO C2 14m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL C2INTEL 27m
Cobaltstrike: 101.43.103.154
CRITICAL C2INTEL 27m
Cobaltstrike: 101.43.103.154
CRITICAL C2INTEL 27m
Cobaltstrike: 101.42.255.92
CRITICAL C2INTEL 27m
Cobaltstrike: 101.42.255.92
CRITICAL C2INTEL 27m
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 27m
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 27m
Cobaltstrike: 101.200.193.211
CRITICAL C2INTEL 27m
Cobaltstrike: 101.200.193.211
CRITICAL C2INTEL 27m
Cobaltstrike: 101.133.229.117
CRITICAL C2INTEL 27m
Cobaltstrike: 101.133.229.117
CRITICAL C2INTEL 28m
Cobaltstrike: 101.126.10.34
CRITICAL C2INTEL 28m
Cobaltstrike: 101.126.10.34
CRITICAL C2INTEL 28m
Cobaltstrike: 1.15.76.39
CRITICAL DEFCON 32m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL DEFCON 38m
[DEFCON 1] Nation-State Network Activity
CRITICAL FEODO C2 44m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL DEFCON 1h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL IPSUM 1h
IPsum: 2.57.122.53 (score 8/10+)
CRITICAL IPSUM 1h
IPsum: 195.178.110.137 (score 9/10+)
CRITICAL IPSUM 1h
IPsum: 193.47.62.69 (score 9/10+)
CRITICAL IPSUM 1h
IPsum: 93.174.95.106 (score 9/10+)
CRITICAL IPSUM 1h
IPsum: 85.239.149.72 (score 9/10+)
CRITICAL IPSUM 1h
IPsum: 80.82.77.33 (score 9/10+)
CRITICAL IPSUM 1h
IPsum: 79.72.3.119 (score 9/10+)
CRITICAL IPSUM 1h
IPsum: 77.239.124.102 (score 9/10+)
CRITICAL IPSUM 1h
IPsum: 62.60.130.253 (score 9/10+)
CRITICAL IPSUM 1h
IPsum: 62.60.130.201 (score 9/10+)
CRITICAL DEFCON 1h
[DEFCON 1] Nation-State Network Activity
CRITICAL IODA 1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL IODA 1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL FEODO C2 1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL IODA 1h
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL IODA 1h
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL IODA 1h
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL IODA 1h
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL IODA 1h
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL IODA 1h
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL C2INTEL 1h
Cobaltstrike: 101.43.103.154
CRITICAL C2INTEL 1h
Cobaltstrike: 101.42.255.92
CRITICAL C2INTEL 1h
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 1h
Cobaltstrike: 101.200.193.211
CRITICAL IODA 1h
AS48031 (XServer) — ping-slash24 critical
CRITICAL IODA 1h
AS48031 (XServer) — ping-slash24 critical
CRITICAL IODA 1h
AS48031 (XServer) — ping-slash24 critical
CRITICAL IODA 1h
AS48031 (XServer) — ping-slash24 critical
CRITICAL IODA 1h
AS48031 (XServer) — ping-slash24 critical
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL IODA 1h
NBLNETWORKS-AS -- Finland — ping-slash24 critical
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL IODA 1h
NBLNETWORKS-AS -- Finland — ping-slash24 critical
CRITICAL IODA 1h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL IODA 1h
NBLNETWORKS-AS -- Finland — ping-slash24 critical
CRITICAL IODA 2h
eGov-AS-TH -- Thailand — ping-slash24 critical
CRITICAL IODA 2h
AS38026 (MNBL-TRANSIT-AS-AP) — bgp critical
CRITICAL IODA 2h
AS45753 (NETSEC-HK) — bgp critical
CRITICAL IODA 2h
AS58466 (CT-Guangzhou-IDC) — bgp critical
CRITICAL IODA 2h
eGov-AS-TH -- Thailand — ping-slash24 critical
CRITICAL IODA 2h
AS38026 (MNBL-TRANSIT-AS-AP) — bgp critical
CRITICAL IODA 2h
AS45753 (NETSEC-HK) — bgp critical
CRITICAL IODA 2h
AS58466 (CT-Guangzhou-IDC) — bgp critical
CRITICAL IODA 2h
eGov-AS-TH -- Thailand — ping-slash24 critical
CRITICAL IODA 2h
eGov-AS-TH -- Thailand — ping-slash24 critical
CRITICAL IODA 2h
eGov-AS-TH -- Thailand — ping-slash24 critical
CRITICAL IODA 2h
AS58540 (CHINATELECOM-SHANDONG-JINAN-IDC) — bgp critical
CRITICAL IODA 2h
AS8595 (WESTCALL-AS) — bgp critical
CRITICAL IODA 2h
AS58540 (CHINATELECOM-SHANDONG-JINAN-IDC) — bgp critical
CRITICAL IODA 2h
AS8595 (WESTCALL-AS) — bgp critical
CRITICAL IODA 2h
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL IODA 2h
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL HIBP 18d
Breach: ExactSciences (10870k accounts)
CRITICAL HIBP 18d
Breach: ExactSciences (10870k accounts)
HIGH RANSOMLOOK now
Ransomware: majinahanashi → PCA Group Sdn. Bhd.
HIGH RANSOMLOOK now
Ransomware: majinahanashi → PCA Group Sdn. Bhd.
HIGH CF RADAR 1m
CF Radar: US top DDoS L7 origin (23.5% of global)
HIGH CF RADAR 1m
CF Radar: US top DDoS L7 origin (23.5% of global)
HIGH CF RADAR 1m
CF Radar: BR top DDoS L3 origin (18.9% of global)
INVESTIGATION
Investigation ID
SIG-598556
Status
ACTIVE
CRITICAL DEFCON 2m ago
Raw payload
DigitalOcean — Monitoring — Cloud Control Panel and API Impact: critical · Status: Monitoring Affected: API, Cloud Control Panel Update: Our Engineering team has implemented mitigation measures to address the issue impacting the DigitalOcean public API and Cloud Control Panel. We are seeing improvements, and users should now be able to access the Cloud Control Panel and use the public API normally. We are continuing to monitor the service to ensure it remains stable and will provide further updates as more information becomes available. We appreciate your patience and understanding. Details: https://stspg.io/8l5c24cxh3hr
Telemetry timeline · related activity
No correlated activity on this indicator in the current window.
↗ signal fusion
Escalate / isolate actions live in the private incident plane (per-tenant).
IOC_ENRICHMENT
No network indicator on this alert — nothing to enrich.