LAGGING · 36m

TRIAGE & INVESTIGATION

SECOPS

Security-ops queue over the live fused alert streams — probe/outage verdicts & IOC/attack events, severity-ranked. Select an alert to investigate: raw payload, telemetry, outage-vs-vantage verification, and IOC enrichment. Read-only console; escalation/isolation is the private incident plane.

Alert queue

ALERT_QUEUE

sev · source · verdict live

CRITICAL FEODO C2 36m

LIVE C2: 50.16.16.211:443 (QakBot)

CRITICAL C2INTEL 54m

Cobaltstrike: 101.37.236.20

CRITICAL C2INTEL 55m

Cobaltstrike: 101.33.225.32

CRITICAL C2INTEL 57m

Cobaltstrike: 101.201.103.158

CRITICAL C2INTEL 1h

Cobaltstrike: 101.126.10.34

CRITICAL C2INTEL 1h

Cobaltstrike: 1.94.65.9

CRITICAL FEODO C2 1h

LIVE C2: 50.16.16.211:443 (QakBot)

CRITICAL C2INTEL 1h

Cobaltstrike: 1.15.76.39

CRITICAL FEODO C2 1h

LIVE C2: 50.16.16.211:443 (QakBot)

CRITICAL IODA 1h

UCSB-NET-AS -- United States — ping-slash24 critical

CRITICAL IODA 1h

UCSB-NET-AS -- United States — ping-slash24 critical

CRITICAL IODA 1h

UCSB-NET-AS -- United States — ping-slash24 critical

CRITICAL C2INTEL 1h

Cobaltstrike: 101.37.236.20

CRITICAL C2INTEL 1h

Cobaltstrike: 101.33.225.32

CRITICAL C2INTEL 1h

Cobaltstrike: 101.201.103.158

CRITICAL C2INTEL 1h

Cobaltstrike: 101.200.193.211

CRITICAL C2INTEL 1h

Cobaltstrike: 101.126.10.34

CRITICAL C2INTEL 1h

Cobaltstrike: 1.94.65.9

CRITICAL FEODO C2 2h

LIVE C2: 50.16.16.211:443 (QakBot)

CRITICAL C2INTEL 2h

Cobaltstrike: 1.15.76.39

CRITICAL IPSUM 2h

IPsum: 85.217.149.47 (score 9/10+)

CRITICAL IPSUM 2h

IPsum: 79.72.3.119 (score 9/10+)

CRITICAL IPSUM 2h

IPsum: 77.239.124.121 (score 9/10+)

CRITICAL IPSUM 2h

IPsum: 45.43.60.98 (score 9/10+)

CRITICAL IODA 2h

AS24835 (RAYA-AS) — bgp critical

CRITICAL IPSUM 2h

IPsum: 16.5.0.241 (score 9/10+)

CRITICAL IPSUM 2h

IPsum: 16.5.0.241 (score 9/10+)

CRITICAL IODA 2h

AS29491 (KIEVLINE) — bgp critical

CRITICAL IPSUM 2h

IPsum: 16.5.0.239 (score 9/10+)

CRITICAL IPSUM 2h

IPsum: 16.5.0.238 (score 9/10+)

CRITICAL IPSUM 2h

IPsum: 16.5.0.234 (score 9/10+)

CRITICAL IPSUM 2h

IPsum: 107.150.97.10 (score 10/10+)

CRITICAL IPSUM 2h

IPsum: 94.154.43.254 (score 11/10+)

CRITICAL FEODO C2 2h

LIVE C2: 50.16.16.211:443 (QakBot)

CRITICAL IODA 2h

MOD-EU -- United Kingdom — ping-slash24 critical

CRITICAL IODA 2h

MOD-EU -- United Kingdom — ping-slash24 critical

CRITICAL IODA 2h

ERX-TANET-ASN1 -- New Taipei City — ping-slash24 critical

CRITICAL IODA 2h

ERX-TANET-ASN1 -- New Taipei City — ping-slash24 critical

CRITICAL IODA 2h

MOD-EU -- United Kingdom — ping-slash24 critical

CRITICAL IODA 2h

ERX-TANET-ASN1 -- New Taipei City — ping-slash24 critical

CRITICAL C2INTEL 2h

Cobaltstrike: 101.37.236.20

CRITICAL C2INTEL 2h

Cobaltstrike: 101.33.225.32

CRITICAL IODA 3h

AS59815 (TRK-METRO-AS) — ping-slash24 critical

CRITICAL IODA 3h

DEC-AS -- Ukraine — ping-slash24 critical

CRITICAL IODA 3h

KIRZ-AS-TH -- Thailand — ping-slash24 critical

CRITICAL IODA 4h

AS31133 (MF-MGSM-AS) — ping-slash24 critical

CRITICAL IODA 4h

AS51812 (KTVS-AS) — ping-slash24 critical

CRITICAL IODA 4h

ROSTOV-AS -- Russian Federation — ping-slash24 critical

CRITICAL DEFCON 5h

[DEFCON 2] DDoS Origin + Active Threat Feed Signal

CRITICAL IODA 5h

MEGAFON-AS -- Lipetsk — ping-slash24 critical

CRITICAL IODA 5h

TCI -- Markazi — ping-slash24 critical

CRITICAL HIBP 5h

Breach: LimeLeads (17838k accounts)

CRITICAL HIBP 5h

Breach: LimeLeads (17838k accounts)

CRITICAL IODA 6h

AS48031 (XServer) — bgp critical

CRITICAL DEFCON 6h

[DEFCON 1] Nation-State Network Activity

CRITICAL IODA 7h

AS34879 (CCT-AS) — bgp critical

CRITICAL FEODO C2 7h

LIVE C2: 50.16.16.211:443 (QakBot)

CRITICAL C2INTEL 7h

Cobaltstrike: 1.15.76.39

CRITICAL DEFCON 7h

Mass withdrawal burst: 483 routes

CRITICAL IODA 8h

AS49120 (GORSET-AS) — ping-slash24 critical

CRITICAL IODA 8h

NETCOM-R-AS -- Russian Federation — ping-slash24 critical

CRITICAL IODA 8h

GORSET-AS -- Russian Federation — ping-slash24 critical

CRITICAL IODA 8h

NETCOM-R-AS -- Moskva — ping-slash24 critical

CRITICAL IODA 8h

AS49531 (NETCOM-R-AS) — ping-slash24 critical

CRITICAL C2INTEL 8h

Cobaltstrike: 101.33.225.32

CRITICAL IPSUM 8h

IPsum: 16.5.0.238 (score 9/10+)

CRITICAL C2INTEL 8h

Cobaltstrike: 101.201.103.158

CRITICAL IPSUM 8h

IPsum: 16.5.0.234 (score 9/10+)

CRITICAL DEFCON 8h

[DEFCON 1] Nation-State Network Activity

CRITICAL IODA 10h

AS150452 (LANDUPS-AS-AP) — bgp critical

CRITICAL C2INTEL 10h

Cobaltstrike: 1.15.76.39

CRITICAL IODA 11h

CT-CHONGQING-MAN2-AP -- Chongqing — ping-slash24 critical

CRITICAL IODA 11h

AS141739 (CT-CHONGQING-MAN2-AP) — ping-slash24 critical

CRITICAL DEFCON 11h

[DEFCON 1] Nation-State Network Activity

CRITICAL DEFCON 11h

Mass withdrawal burst: 86 routes

CRITICAL IODA 12h

AS141739 (CT-CHONGQING-MAN2-AP) — ping-slash24 critical

CRITICAL IODA 12h

AS37340 (Spectranet) — ping-slash24 critical

CRITICAL DEFCON 12h

[DEFCON 2] DDoS Origin + Active Threat Feed Signal

CRITICAL IODA 15h

AS204490 (ASKONTEL) — bgp critical

CRITICAL DEFCON 15h

Mass withdrawal burst: 657 routes

INVESTIGATION

Investigation ID

SIG-Y36IFD

Status

C2 SERVER

CRITICAL C2INTEL · CN 57m ago

Raw payload

Cobaltstrike: 101.201.103.158 Active Cobaltstrike infrastructure — AS37963 Hangzhou Alibaba Advertising Co — China. From drb-ra/C2IntelFeeds 30-day scan.

Telemetry timeline · related activity

13:06:46Z

Cobaltstrike: 101.37.236.20

13:05:35Z

Cobaltstrike: 101.33.225.32

12:59:35Z

Cobaltstrike: 101.126.10.34

12:55:04Z

Cobaltstrike: 1.94.65.9

12:54:41Z

Cobaltstrike: 1.15.76.39

12:10:06Z

Cobaltstrike: 101.37.236.20

↗ CN probes ↗ AS37963 routing ↗ 101.201.103.158 on map ↗ signal fusion

Escalate / isolate actions live in the private incident plane (per-tenant).

IOC_ENRICHMENT

101.201.103.158 2/89

⚠ Malicious activity detected

Detections · 3 engines

AlphaSOC malware

Hunt.io Intelligence malicious

SOCRadar suspicious

GEOCN

NETWORK101.200.0.0/15

VirusTotal ▸