LIVE · 9m
TRIAGE & INVESTIGATION
SECOPSSecurity-ops queue over the live fused alert streams — probe/outage verdicts & IOC/attack events, severity-ranked. Select an alert to investigate: raw payload, telemetry, outage-vs-vantage verification, and IOC enrichment. Read-only console; escalation/isolation is the private incident plane.
Alert queue
350
active alerts
Critical
33
top-priority
High
132
elevated
Under investigation
SIG-3E7PU5
C2INTEL case
ALERT_QUEUE
sev · source · verdict
live
CRITICAL
DEFCON
9m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
DEFCON
9m
[DEFCON 1] Nation-State Network Activity
CRITICAL
C2INTEL
34m
Cobaltstrike: 101.43.103.154
CRITICAL
C2INTEL
34m
Cobaltstrike: 101.43.103.154
CRITICAL
C2INTEL
34m
Cobaltstrike: 101.42.255.92
CRITICAL
C2INTEL
34m
Cobaltstrike: 101.42.255.92
CRITICAL
C2INTEL
34m
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
34m
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
35m
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
35m
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
35m
Cobaltstrike: 101.133.229.117
CRITICAL
C2INTEL
35m
Cobaltstrike: 101.133.229.117
CRITICAL
C2INTEL
35m
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
35m
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
35m
Cobaltstrike: 1.15.76.39
CRITICAL
C2INTEL
35m
Cobaltstrike: 1.15.76.39
CRITICAL
IODA
37m
NAYATEL-PK -- Punjab — ping-slash24 critical
CRITICAL
IODA
37m
NAYATEL-PK -- Punjab — ping-slash24 critical
CRITICAL
DEFCON
39m
[DEFCON 1] Nation-State Network Activity
CRITICAL
DEFCON
41m
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
IODA
57m
INTERNETBOLAGET -- Sweden — ping-slash24 critical
CRITICAL
DEFCON
1h
[DEFCON 1] Nation-State Network Activity
CRITICAL
DEFCON
1h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
FEODO C2
1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.43.103.154
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.42.255.92
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.133.229.117
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
1h
Cobaltstrike: 1.15.76.39
CRITICAL
DEFCON
1h
[DEFCON 1] Nation-State Network Activity
CRITICAL
DEFCON
1h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
HIGH
CF RADAR
9m
CF Radar: US top DDoS L7 origin (23.0% of global)
HIGH
CF RADAR
9m
CF Radar: US top DDoS L7 origin (23.0% of global)
HIGH
CF RADAR
9m
CF Radar: BR top DDoS L3 origin (11.6% of global)
HIGH
CF RADAR
9m
CF Radar: BR top DDoS L3 origin (11.6% of global)
HIGH
CF RADAR
18m
CF Radar: US top DDoS L7 origin (23.0% of global)
HIGH
CF RADAR
18m
CF Radar: US top DDoS L7 origin (23.0% of global)
HIGH
CF RADAR
19m
CF Radar: BR top DDoS L3 origin (11.6% of global)
HIGH
CF RADAR
19m
CF Radar: BR top DDoS L3 origin (11.6% of global)
HIGH
SANS DSHIELD
21m
Top attacker: 52.157.207.201 (195k reports)
HIGH
SANS DSHIELD
21m
Top attacker: 52.157.207.201 (195k reports)
HIGH
SANS DSHIELD
21m
Top attacker: 194.224.249.214 (310k reports)
HIGH
SANS DSHIELD
21m
Top attacker: 194.224.249.214 (310k reports)
HIGH
SANS DSHIELD
21m
Top attacker: 13.94.254.200 (320k reports)
HIGH
SANS DSHIELD
21m
Top attacker: 13.94.254.200 (320k reports)
HIGH
URLSCAN
21m
urlscan: merchant.legallypayment.com (aitm, malicious)
HIGH
URLSCAN
21m
urlscan: merchant.legallypayment.com (aitm, malicious)
HIGH
URLSCAN
22m
urlscan: clients.erpcare.in (aitm, malicious)
HIGH
URLSCAN
22m
urlscan: clients.erpcare.in (aitm, malicious)
HIGH
URLSCAN
22m
urlscan: go.melio.com (aitm, malicious)
HIGH
URLSCAN
22m
urlscan: go.melio.com (aitm, malicious)
HIGH
URLSCAN
22m
urlscan: merchant.legallypayment.com (aitm, malicious)
HIGH
URLSCAN
22m
urlscan: merchant.legallypayment.com (aitm, malicious)
HIGH
URLSCAN
22m
urlscan: clients.erpcare.in (aitm, malicious)
HIGH
URLSCAN
22m
urlscan: clients.erpcare.in (aitm, malicious)
HIGH
URLSCAN
22m
urlscan: interesting-green-7hznwtjo-dp8spfgupx0o.edgeone.dev (phishing, malicious)
HIGH
URLSCAN
22m
urlscan: interesting-green-7hznwtjo-dp8spfgupx0o.edgeone.dev (phishing, malicious)
HIGH
URLSCAN
22m
urlscan: www.docdroid.net (aitm, malicious)
HIGH
URLSCAN
22m
urlscan: www.docdroid.net (aitm, malicious)
HIGH
CF RADAR
28m
CF Radar: US top DDoS L7 origin (23.0% of global)
HIGH
CF RADAR
28m
CF Radar: US top DDoS L7 origin (23.0% of global)
HIGH
CF RADAR
29m
CF Radar: BR top DDoS L3 origin (11.6% of global)
HIGH
CF RADAR
29m
CF Radar: BR top DDoS L3 origin (11.6% of global)
HIGH
ET
34m
Compromised: 103.40.11.179
HIGH
ET
34m
Compromised: 103.40.11.179
HIGH
ET
34m
Compromised: 103.241.168.70
HIGH
ET
34m
Compromised: 103.241.168.70
HIGH
ET
34m
Compromised: 103.205.107.170
HIGH
ET
34m
Compromised: 103.205.107.170
HIGH
ET
34m
Compromised: 103.194.106.230
HIGH
ET
34m
Compromised: 103.194.106.230
HIGH
ET
34m
Compromised: 103.19.196.230
HIGH
ET
34m
Compromised: 103.19.196.230
HIGH
ET
35m
Compromised: 103.159.85.90
HIGH
ET
35m
Compromised: 103.159.85.90
HIGH
ET
35m
Compromised: 103.159.51.70
HIGH
ET
35m
Compromised: 103.159.51.70
HIGH
ET
35m
Compromised: 102.220.160.38
INVESTIGATION
Investigation ID
SIG-3E7PU5
Status
C2 SERVER
CRITICAL
C2INTEL
· CN
1h ago
Raw payload
Cobaltstrike: 101.42.255.92
Active Cobaltstrike infrastructure — AS45090 Shenzhen Tencent Computer Systems Company Limited — China. From drb-ra/C2IntelFeeds 30-day scan.
Telemetry timeline · related activity
07:32:25Z
Cobaltstrike: 101.43.103.154
07:32:25Z
Cobaltstrike: 101.43.103.154
07:32:21Z
Cobaltstrike: 101.42.255.92
07:32:21Z
Cobaltstrike: 101.42.255.92
07:32:17Z
Cobaltstrike: 101.33.225.32
07:32:17Z
Cobaltstrike: 101.33.225.32
Escalate / isolate actions live in the private incident plane (per-tenant).
IOC_ENRICHMENT
101.42.255.92
15/91
⚠ Malicious activity detected
Detections · 12 engines
ADMINUSLabs
malicious
alphaMountain.ai
malicious
AlphaSOC
malware
Chong Lua Dao
malicious
Cluster25
malicious
CyRadar
malicious
Dr.Web
malicious
Forcepoint ThreatSeeker
malicious
Fortinet
malware
Hunt.io Intelligence
malicious
Lionic
malicious
SOCRadar
malware
GEOCN
NETWORK101.42.0.0/15