LIVE · 12m
TRIAGE & INVESTIGATION
SECOPSSecurity-ops queue over the live fused alert streams — probe/outage verdicts & IOC/attack events, severity-ranked. Select an alert to investigate: raw payload, telemetry, outage-vs-vantage verification, and IOC enrichment. Read-only console; escalation/isolation is the private incident plane.
Alert queue
322
active alerts
Critical
44
top-priority
High
148
elevated
Under investigation
SIG-GUWW0N
C2INTEL case
ALERT_QUEUE
sev · source · verdict
live
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.43.103.154
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.43.103.154
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.42.255.92
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.42.255.92
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.133.229.117
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.133.229.117
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
12m
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
12m
Cobaltstrike: 1.15.76.39
CRITICAL
C2INTEL
12m
Cobaltstrike: 1.15.76.39
CRITICAL
DEFCON
18m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
DEFCON
24m
[DEFCON 1] Nation-State Network Activity
CRITICAL
FEODO C2
28m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
FEODO C2
28m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
DEFCON
48m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
DEFCON
54m
[DEFCON 1] Nation-State Network Activity
CRITICAL
FEODO C2
58m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
IODA
1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.43.103.154
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.42.255.92
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.133.229.117
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
1h
Cobaltstrike: 1.15.76.39
CRITICAL
DEFCON
1h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
DEFCON
1h
[DEFCON 1] Nation-State Network Activity
CRITICAL
FEODO C2
1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
DEFCON
1h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
DEFCON
1h
[DEFCON 1] Nation-State Network Activity
CRITICAL
FEODO C2
1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
IODA
2h
KDDI -- Japan — ping-slash24 critical
CRITICAL
IODA
2h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL
IODA
2h
KDDI -- Japan — ping-slash24 critical
CRITICAL
IODA
2h
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.43.103.154
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.42.255.92
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.133.229.117
HIGH
ET
12m
Compromised: 103.40.11.179
HIGH
ET
12m
Compromised: 103.40.11.179
HIGH
ET
12m
Compromised: 103.241.168.70
HIGH
ET
12m
Compromised: 103.241.168.70
HIGH
ET
12m
Compromised: 103.194.106.230
HIGH
ET
12m
Compromised: 103.194.106.230
HIGH
ET
12m
Compromised: 103.19.196.230
HIGH
ET
12m
Compromised: 103.19.196.230
HIGH
ET
12m
Compromised: 103.159.85.90
HIGH
ET
12m
Compromised: 103.159.85.90
HIGH
ET
12m
Compromised: 103.159.51.70
HIGH
ET
12m
Compromised: 103.159.51.70
HIGH
ET
12m
Compromised: 102.220.160.38
HIGH
ET
12m
Compromised: 102.220.160.38
HIGH
ET
12m
Compromised: 102.220.160.172
HIGH
ET
12m
Compromised: 102.220.160.172
HIGH
RANSOMLOOK
13m
Ransomware: lockbit5 → fpmanagement.nl
HIGH
RANSOMLOOK
13m
Ransomware: lockbit5 → fpmanagement.nl
HIGH
RANSOMLOOK
13m
Ransomware: lockbit5 → fpmanagement.nl
HIGH
RANSOMLOOK
13m
Ransomware: lockbit5 → fpmanagement.nl
HIGH
RANSOMLOOK
13m
Ransomware: lockbit5 → fpmanagement.nl
HIGH
RANSOMLOOK
13m
Ransomware: lockbit5 → fpmanagement.nl
HIGH
RANSOMLOOK
13m
Ransomware: lockbit5 → fpmanagement.nl
HIGH
RANSOMLOOK
13m
Ransomware: lockbit5 → fpmanagement.nl
HIGH
CF RADAR
16m
CF Radar: US top DDoS L7 origin (23.8% of global)
HIGH
CF RADAR
16m
CF Radar: US top DDoS L7 origin (23.8% of global)
HIGH
CF RADAR
16m
CF Radar: BR top DDoS L3 origin (15.4% of global)
HIGH
CF RADAR
16m
CF Radar: BR top DDoS L3 origin (15.4% of global)
HIGH
CF RADAR
26m
CF Radar: US top DDoS L7 origin (23.8% of global)
HIGH
CF RADAR
26m
CF Radar: US top DDoS L7 origin (23.8% of global)
HIGH
CF RADAR
26m
CF Radar: BR top DDoS L3 origin (15.4% of global)
HIGH
CF RADAR
26m
CF Radar: BR top DDoS L3 origin (15.4% of global)
HIGH
SANS DSHIELD
28m
Top attacker: 52.157.207.201 (195k reports)
HIGH
SANS DSHIELD
28m
Top attacker: 52.157.207.201 (195k reports)
HIGH
SANS DSHIELD
28m
Top attacker: 194.224.249.214 (310k reports)
HIGH
SANS DSHIELD
28m
Top attacker: 194.224.249.214 (310k reports)
INVESTIGATION
Investigation ID
SIG-GUWW0N
Status
C2 SERVER
CRITICAL
C2INTEL
· CN
1h ago
Raw payload
Cobaltstrike: 101.42.255.92
Active Cobaltstrike infrastructure — AS45090 Shenzhen Tencent Computer Systems Company Limited — China. From drb-ra/C2IntelFeeds 30-day scan.
Telemetry timeline · related activity
18:32:21Z
Cobaltstrike: 101.43.103.154
18:32:21Z
Cobaltstrike: 101.43.103.154
18:32:18Z
Cobaltstrike: 101.42.255.92
18:32:18Z
Cobaltstrike: 101.42.255.92
18:32:14Z
Cobaltstrike: 101.33.225.32
18:32:14Z
Cobaltstrike: 101.33.225.32
Escalate / isolate actions live in the private incident plane (per-tenant).
IOC_ENRICHMENT
101.42.255.92
15/91
⚠ Malicious activity detected
Detections · 12 engines
ADMINUSLabs
malicious
alphaMountain.ai
malicious
AlphaSOC
malware
Chong Lua Dao
malicious
Cluster25
malicious
CyRadar
malicious
Dr.Web
malicious
Forcepoint ThreatSeeker
malicious
Fortinet
malware
Hunt.io Intelligence
malicious
Lionic
malicious
SOCRadar
malware
GEOCN
NETWORK101.42.0.0/15