LIVE · 11m
TRIAGE & INVESTIGATION
SECOPSSecurity-ops queue over the live fused alert streams — probe/outage verdicts & IOC/attack events, severity-ranked. Select an alert to investigate: raw payload, telemetry, outage-vs-vantage verification, and IOC enrichment. Read-only console; escalation/isolation is the private incident plane.
Alert queue
341
active alerts
Critical
47
top-priority
High
112
elevated
Under investigation
SIG-40DVLF
C2INTEL case
ALERT_QUEUE
sev · source · verdict
live
CRITICAL
DEFCON
10m
[DEFCON 1] Nation-State Network Activity
CRITICAL
DEFCON
12m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
FEODO C2
13m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
FEODO C2
13m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
DEFCON
40m
[DEFCON 1] Nation-State Network Activity
CRITICAL
DEFCON
42m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
FEODO C2
43m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
FEODO C2
43m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
IODA
49m
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL
IODA
49m
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.43.103.154
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.43.103.154
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.42.255.92
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.42.255.92
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.133.229.117
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.133.229.117
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
57m
Cobaltstrike: 1.15.76.39
CRITICAL
C2INTEL
57m
Cobaltstrike: 1.15.76.39
CRITICAL
IODA
1h
AS22689 -- Brazil — ping-slash24 critical
CRITICAL
IODA
1h
AS22689 -- Brazil — ping-slash24 critical
CRITICAL
IODA
1h
AS22689 -- Brazil — ping-slash24 critical
CRITICAL
IODA
1h
AS22689 -- Brazil — ping-slash24 critical
CRITICAL
IODA
1h
AS22689 -- Brazil — ping-slash24 critical
CRITICAL
IODA
1h
AS22689 -- Brazil — ping-slash24 critical
CRITICAL
DEFCON
1h
[DEFCON 1] Nation-State Network Activity
CRITICAL
DEFCON
1h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
FEODO C2
1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
DEFCON
1h
[DEFCON 1] Nation-State Network Activity
CRITICAL
FEODO C2
1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
IODA
1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL
IODA
1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL
IODA
1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL
IODA
1h
ORLANDOTELCO -- United States — ping-slash24 critical
CRITICAL
DEFCON
1h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.43.103.154
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.42.255.92
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.133.229.117
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
1h
Cobaltstrike: 1.15.76.39
HIGH
CF RADAR
11m
CF Radar: US top DDoS L3+L7 origin (15.3% of global)
HIGH
CF RADAR
11m
CF Radar: US top DDoS L3+L7 origin (15.3% of global)
HIGH
SANS DSHIELD
13m
Top attacker: 52.157.207.201 (195k reports)
HIGH
SANS DSHIELD
13m
Top attacker: 52.157.207.201 (195k reports)
HIGH
SANS DSHIELD
13m
Top attacker: 194.224.249.214 (310k reports)
HIGH
SANS DSHIELD
13m
Top attacker: 194.224.249.214 (310k reports)
HIGH
SANS DSHIELD
13m
Top attacker: 13.94.254.200 (320k reports)
HIGH
SANS DSHIELD
13m
Top attacker: 13.94.254.200 (320k reports)
HIGH
URLSCAN
14m
urlscan: clients.erpcare.in (aitm, malicious)
HIGH
URLSCAN
14m
urlscan: clients.erpcare.in (aitm, malicious)
HIGH
URLSCAN
14m
urlscan: fat-apricot-jjhanlvh-dp2sce9d6amh.edgeone.dev (phishing, malicious)
HIGH
URLSCAN
14m
urlscan: fat-apricot-jjhanlvh-dp2sce9d6amh.edgeone.dev (phishing, malicious)
HIGH
URLSCAN
14m
urlscan: go.melio.com (aitm, malicious)
HIGH
URLSCAN
14m
urlscan: go.melio.com (aitm, malicious)
HIGH
URLSCAN
14m
urlscan: go.melio.com (aitm, malicious)
HIGH
URLSCAN
14m
urlscan: go.melio.com (aitm, malicious)
HIGH
URLSCAN
14m
urlscan: safe-magenta-tkbxtrmd-dpws3847uxvj.edgeone.dev (phishing, malicious)
HIGH
URLSCAN
14m
urlscan: safe-magenta-tkbxtrmd-dpws3847uxvj.edgeone.dev (phishing, malicious)
HIGH
URLSCAN
14m
urlscan: clients.erpcare.in (aitm, malicious)
HIGH
URLSCAN
14m
urlscan: clients.erpcare.in (aitm, malicious)
HIGH
DEFCON
18m
abuse.ch URLhaus — Recent Malicious URLs: 200 new — http://123.188.72.146:45830/Mozi.m
HIGH
CHANGEDETECT
18m
abuse.ch URLhaus — Recent Malicious URLs: 200 new — http://123.188.72.146:45830/Mozi.m
HIGH
CF RADAR
21m
CF Radar: US top DDoS L3+L7 origin (15.3% of global)
HIGH
CF RADAR
21m
CF Radar: US top DDoS L3+L7 origin (15.3% of global)
HIGH
CF RADAR
31m
CF Radar: US top DDoS L3+L7 origin (15.3% of global)
HIGH
CF RADAR
31m
CF Radar: US top DDoS L3+L7 origin (15.3% of global)
HIGH
CF RADAR
41m
CF Radar: US top DDoS L3+L7 origin (15.3% of global)
HIGH
CF RADAR
41m
CF Radar: US top DDoS L3+L7 origin (15.3% of global)
HIGH
SANS DSHIELD
43m
Top attacker: 52.157.207.201 (195k reports)
HIGH
SANS DSHIELD
43m
Top attacker: 52.157.207.201 (195k reports)
HIGH
SANS DSHIELD
43m
Top attacker: 194.224.249.214 (310k reports)
HIGH
SANS DSHIELD
43m
Top attacker: 194.224.249.214 (310k reports)
HIGH
SANS DSHIELD
43m
Top attacker: 13.94.254.200 (320k reports)
INVESTIGATION
Investigation ID
SIG-40DVLF
Status
C2 SERVER
CRITICAL
C2INTEL
· CN
1h ago
Raw payload
Cobaltstrike: 101.200.193.211
Active Cobaltstrike infrastructure — AS37963 Hangzhou Alibaba Advertising Co — China. From drb-ra/C2IntelFeeds 30-day scan.
Telemetry timeline · related activity
05:32:23Z
Cobaltstrike: 101.43.103.154
05:32:23Z
Cobaltstrike: 101.43.103.154
05:32:16Z
Cobaltstrike: 101.42.255.92
05:32:16Z
Cobaltstrike: 101.42.255.92
05:32:13Z
Cobaltstrike: 101.33.225.32
05:32:13Z
Cobaltstrike: 101.33.225.32
Escalate / isolate actions live in the private incident plane (per-tenant).
IOC_ENRICHMENT
101.200.193.211
17/91
⚠ Malicious activity detected
Detections · 12 engines
ADMINUSLabs
malicious
alphaMountain.ai
malicious
AlphaSOC
malware
Certego
phishing
Chong Lua Dao
malicious
CyRadar
malicious
Emsisoft
malware
ESET
phishing
Forcepoint ThreatSeeker
malicious
Fortinet
malware
Hunt.io Intelligence
malicious
Kaspersky
malware
GEOCN
NETWORK101.200.0.0/15