Skip to content
COOEY
LAGGING · 42m

◄ SITREP

TRIAGE & INVESTIGATION

SECOPS

Security-ops queue over the live fused alert streams — probe/outage verdicts & IOC/attack events, severity-ranked. Select an alert to investigate: raw payload, telemetry, outage-vs-vantage verification, and IOC enrichment. Read-only console; escalation/isolation is the private incident plane.

Alert queue
453
active alerts
Critical
128
top-priority
High
163
elevated
Under investigation
SIG-VET5P0
C2INTEL case
ALERT_QUEUE
sev · source · verdict live
CRITICAL FEODO C2 42m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL C2INTEL 1h
Cobaltstrike: 101.37.236.20
CRITICAL C2INTEL 1h
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 1h
Cobaltstrike: 101.201.103.158
CRITICAL C2INTEL 1h
Cobaltstrike: 101.200.193.211
CRITICAL C2INTEL 1h
Cobaltstrike: 101.126.10.34
CRITICAL C2INTEL 1h
Cobaltstrike: 1.94.65.9
CRITICAL FEODO C2 1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL C2INTEL 1h
Cobaltstrike: 1.15.76.39
CRITICAL IODA 1h
Netherlands — bgp critical
CRITICAL IODA 1h
Netherlands — bgp critical
CRITICAL IODA 1h
AS31133 (MF-MGSM-AS) — ping-slash24 critical
CRITICAL IODA 1h
AS51812 (KTVS-AS) — ping-slash24 critical
CRITICAL IODA 1h
ROSTOV-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 1h
AS31133 (MF-MGSM-AS) — ping-slash24 critical
CRITICAL IODA 1h
AS51812 (KTVS-AS) — ping-slash24 critical
CRITICAL IODA 1h
KTVS-AS -- Nizhegorod — ping-slash24 critical
CRITICAL IODA 1h
TAHIONISP-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 1h
ENFORTA-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 1h
BRYANSK-AS -- Bryansk — ping-slash24 critical
CRITICAL IODA 1h
AS21353 (ARTCOMS-AS) — ping-slash24 critical
CRITICAL IODA 1h
AS12772 (ENFORTA-AS) — ping-slash24 critical
CRITICAL IODA 1h
ROSTOV-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 1h
AS41661 (ERTH-CHEL-AS) — ping-slash24 critical
CRITICAL IODA 1h
ROSTOV-AS -- Rostov — ping-slash24 critical
CRITICAL IODA 1h
AS29648 (COMLINE-AS) — ping-slash24 critical
CRITICAL IODA 1h
SARATOV-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 1h
AS50498 (LIPETSK-AS) — ping-slash24 critical
CRITICAL IODA 1h
AS39785 (AXIOMA) — ping-slash24 critical
CRITICAL IODA 1h
SARATOV-AS -- Saratov — ping-slash24 critical
CRITICAL IODA 1h
AS56330 (KURGAN-AS) — ping-slash24 critical
CRITICAL IODA 1h
GARS-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 1h
AS39435 (EVOLGOGRAD-AS) — ping-slash24 critical
CRITICAL IODA 1h
AS12772 (ENFORTA-AS) — ping-slash24 critical
CRITICAL IODA 1h
KTVS-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 1h
VORONEZH-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 1h
AS42683 (ERTH-OREN-AS) — ping-slash24 critical
CRITICAL IODA 1h
VORONEZH-AS -- Voronezh — ping-slash24 critical
CRITICAL IODA 1h
AS8291 (RSNET-AS) — bgp critical
CRITICAL IODA 1h
AS8291 (RSNET-AS) — bgp critical
CRITICAL IODA 1h
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL IODA 1h
GSNU-AS-KR -- South Korea — ping-slash24 critical
CRITICAL FEODO C2 1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL IODA 2h
AS59588 (ZAINAS-IQ) — bgp critical
CRITICAL IODA 2h
AS59588 (ZAINAS-IQ) — bgp critical
CRITICAL DEFCON 2h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL C2INTEL 2h
Cobaltstrike: 101.37.236.20
CRITICAL C2INTEL 2h
Cobaltstrike: 101.33.225.32
CRITICAL C2INTEL 2h
Cobaltstrike: 101.201.103.158
CRITICAL C2INTEL 2h
Cobaltstrike: 101.200.193.211
CRITICAL C2INTEL 2h
Cobaltstrike: 101.126.10.34
CRITICAL C2INTEL 2h
Cobaltstrike: 1.94.65.9
CRITICAL IODA 2h
AS41985 (STARGROUP-UA-AS) — bgp critical
CRITICAL FEODO C2 2h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL C2INTEL 2h
Cobaltstrike: 1.15.76.39
CRITICAL IODA 2h
MEGAFON-AS -- Lipetsk — ping-slash24 critical
CRITICAL IODA 2h
MEGAFON-AS -- Lipetsk — ping-slash24 critical
CRITICAL IODA 2h
AS48166 (FORTEX-AS) — ping-slash24 critical
CRITICAL IODA 2h
FORTEX-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 2h
MEGAFON-AS -- Voronezh — ping-slash24 critical
CRITICAL IODA 2h
FORTEX-AS -- Moskovsskaya — ping-slash24 critical
CRITICAL IODA 2h
FORTEX-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 2h
MEGAFON-AS -- Voronezh — ping-slash24 critical
CRITICAL IODA 2h
MEGAFON-AS -- Lipetsk — ping-slash24 critical
CRITICAL IODA 2h
MEGAFON-AS -- Voronezh — ping-slash24 critical
CRITICAL IODA 2h
FORTEX-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 2h
FORTEX-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 2h
FORTEX-AS -- Moskovsskaya — ping-slash24 critical
CRITICAL IODA 2h
MEGAFON-AS -- Voronezh — ping-slash24 critical
CRITICAL IODA 2h
TCI -- Markazi — ping-slash24 critical
CRITICAL IODA 3h
AS48031 (XServer) — bgp critical
CRITICAL DEFCON 3h
[DEFCON 1] Nation-State Network Activity
CRITICAL IODA 3h
AS34879 (CCT-AS) — bgp critical
CRITICAL FEODO C2 4h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL C2INTEL 4h
Cobaltstrike: 1.15.76.39
CRITICAL DEFCON 4h
Mass withdrawal burst: 483 routes
CRITICAL IODA 5h
AS49120 (GORSET-AS) — ping-slash24 critical
CRITICAL IODA 5h
NETCOM-R-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 5h
GORSET-AS -- Russian Federation — ping-slash24 critical
CRITICAL IODA 5h
NETCOM-R-AS -- Moskva — ping-slash24 critical
INVESTIGATION
Investigation ID
SIG-VET5P0
Status
C2 SERVER
CRITICAL C2INTEL · CN 1h ago
Raw payload
Cobaltstrike: 101.33.225.32 Active Cobaltstrike infrastructure — AS45090 Shenzhen Tencent Computer Systems Company Limited — China. From drb-ra/C2IntelFeeds 30-day scan.
Telemetry timeline · related activity
09:46:13Z
Cobaltstrike: 101.37.236.20
09:44:44Z
Cobaltstrike: 101.201.103.158
09:43:17Z
Cobaltstrike: 101.200.193.211
09:41:34Z
Cobaltstrike: 101.126.10.34
09:41:17Z
Cobaltstrike: 1.94.65.9
09:40:20Z
Cobaltstrike: 1.15.76.39
↗ CN probes ↗ AS45090 routing ↗ 101.33.225.32 on map ↗ signal fusion
Escalate / isolate actions live in the private incident plane (per-tenant).
IOC_ENRICHMENT
101.33.225.32 11/91
⚠ Malicious activity detected
Detections · 12 engines
ADMINUSLabs malicious
alphaMountain.ai malicious
AlphaSOC malware
Chong Lua Dao malicious
Cluster25 malicious
Criminal IP malicious
CyRadar malicious
Hunt.io Intelligence malicious
Lionic malicious
MalwareURL malware
SOCRadar malware
ESET suspicious
GEOCN
NETWORK101.33.192.0/18
VirusTotal ▸