LIVE · 8m
TRIAGE & INVESTIGATION
SECOPSSecurity-ops queue over the live fused alert streams — probe/outage verdicts & IOC/attack events, severity-ranked. Select an alert to investigate: raw payload, telemetry, outage-vs-vantage verification, and IOC enrichment. Read-only console; escalation/isolation is the private incident plane.
Alert queue
474
active alerts
Critical
114
top-priority
High
179
elevated
Under investigation
SIG-S0YVKJ
C2INTEL case
ALERT_QUEUE
sev · source · verdict
live
CRITICAL
C2INTEL
7m
Cobaltstrike: 1.94.65.9
CRITICAL
C2INTEL
8m
Cobaltstrike: 1.15.76.39
CRITICAL
FEODO C2
31m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
FEODO C2
31m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
C2INTEL
44m
Cobaltstrike: 101.37.236.20
CRITICAL
C2INTEL
48m
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
48m
Cobaltstrike: 101.33.225.32
CRITICAL
IODA
56m
ATHENAnet -- Greece — ping-slash24 critical
CRITICAL
IODA
56m
ATHENAnet -- Greece — ping-slash24 critical
CRITICAL
C2INTEL
59m
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
59m
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
1h
Cobaltstrike: 1.94.65.9
CRITICAL
IPSUM
1h
IPsum: 85.217.149.47 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 79.72.3.119 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 77.239.124.121 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 16.5.0.241 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 16.5.0.241 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 16.5.0.239 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 16.5.0.238 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 16.5.0.234 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 94.154.43.254 (score 11/10+)
CRITICAL
FEODO C2
1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
IODA
1h
STARHUB-NGNBN -- Singapore — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Esfahan — ping-slash24 critical
CRITICAL
IODA
1h
STARHUB-NGNBN -- Singapore — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Esfahan — ping-slash24 critical
CRITICAL
IODA
1h
FR-TIGRE -- France — ping-slash24 critical
CRITICAL
IODA
1h
FR-TIGRE -- France — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Chahar Mahall and Bakhtiari — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Chahar Mahall and Bakhtiari — ping-slash24 critical
CRITICAL
IODA
1h
FR-TIGRE -- France — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Chahar Mahall and Bakhtiari — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Chahar Mahall and Bakhtiari — ping-slash24 critical
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.201.103.158
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.126.10.34
CRITICAL
IODA
2h
AS131464 (DJBL-AS-AP) — bgp critical
CRITICAL
IODA
2h
AS131464 (DJBL-AS-AP) — bgp critical
CRITICAL
C2INTEL
2h
Cobaltstrike: 1.94.65.9
CRITICAL
C2INTEL
2h
Cobaltstrike: 1.15.76.39
CRITICAL
IODA
2h
AS34879 (CCT-AS) — bgp critical
CRITICAL
IODA
2h
AS34879 (CCT-AS) — bgp critical
CRITICAL
IODA
2h
AS34879 (CCT-AS) — bgp critical
CRITICAL
IODA
2h
AS34879 (CCT-AS) — bgp critical
CRITICAL
IODA
2h
STARHUB-NGNBN -- Singapore — ping-slash24 critical
CRITICAL
IODA
2h
STARHUB-NGNBN -- Singapore — ping-slash24 critical
CRITICAL
IODA
2h
STARHUB-NGNBN -- Singapore — ping-slash24 critical
CRITICAL
IODA
2h
AS47531 (GorPTUs-AS) — bgp critical
CRITICAL
IODA
2h
AS47531 (GorPTUs-AS) — bgp critical
CRITICAL
DEFCON
2h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
FEODO C2
2h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.37.236.20
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.33.225.32
CRITICAL
IODA
2h
JKU-LINZ-AS -- Austria — ping-slash24 critical
CRITICAL
C2INTEL
3h
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
3h
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
3h
Cobaltstrike: 1.94.65.9
CRITICAL
FEODO C2
3h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
IODA
3h
ITISNET-AS -- South Korea — ping-slash24 critical
CRITICAL
IODA
3h
ITISNET-AS -- South Korea — ping-slash24 critical
CRITICAL
IODA
3h
AS137443 (ANCHGLOBAL-AS-AP) — bgp critical
CRITICAL
IODA
3h
AS137443 (ANCHGLOBAL-AS-AP) — bgp critical
CRITICAL
DEFCON
4h
[DEFCON 1] Nation-State Network Activity
CRITICAL
IODA
4h
AKAMAI-LINODE-AP -- India — ping-slash24 critical
CRITICAL
DEFCON
4h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
DEFCON
4h
[DEFCON 1] Nation-State Network Activity
CRITICAL
IODA
4h
AS50581 (UTG) — bgp critical
CRITICAL
DEFCON
4h
Mass withdrawal burst: 85 routes
CRITICAL
IODA
5h
AS20807 (Credolink-ASN) — ping-slash24 critical
CRITICAL
IPSUM
7h
IPsum: 16.5.0.241 (score 9/10+)
CRITICAL
IODA
8h
AS59815 (TRK-METRO-AS) — ping-slash24 critical
CRITICAL
IODA
8h
DEC-AS -- Ukraine — ping-slash24 critical
CRITICAL
IODA
8h
KIRZ-AS-TH -- Thailand — ping-slash24 critical
CRITICAL
IODA
9h
AS31133 (MF-MGSM-AS) — ping-slash24 critical
CRITICAL
IODA
9h
AS51812 (KTVS-AS) — ping-slash24 critical
CRITICAL
IODA
9h
ROSTOV-AS -- Russian Federation — ping-slash24 critical
CRITICAL
DEFCON
10h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
IODA
10h
MEGAFON-AS -- Lipetsk — ping-slash24 critical
CRITICAL
IODA
10h
TCI -- Markazi — ping-slash24 critical
CRITICAL
HIBP
11h
Breach: LimeLeads (17838k accounts)
INVESTIGATION
Investigation ID
SIG-S0YVKJ
Status
C2 SERVER
CRITICAL
C2INTEL
· CN
59m ago
Raw payload
Cobaltstrike: 101.200.193.211
Active Cobaltstrike infrastructure — AS37963 Hangzhou Alibaba Advertising Co — China. From drb-ra/C2IntelFeeds 30-day scan.
Telemetry timeline · related activity
18:58:28Z
Cobaltstrike: 1.94.65.9
18:57:18Z
Cobaltstrike: 1.15.76.39
18:21:51Z
Cobaltstrike: 101.37.236.20
18:17:10Z
Cobaltstrike: 101.33.225.32
18:17:10Z
Cobaltstrike: 101.33.225.32
18:06:14Z
Cobaltstrike: 101.126.10.34
Escalate / isolate actions live in the private incident plane (per-tenant).
IOC_ENRICHMENT
101.200.193.211
17/91
⚠ Malicious activity detected
Detections · 12 engines
ADMINUSLabs
malicious
alphaMountain.ai
malicious
AlphaSOC
malware
Certego
phishing
Chong Lua Dao
malicious
CyRadar
malicious
Emsisoft
malware
ESET
phishing
Forcepoint ThreatSeeker
malicious
Fortinet
malware
Hunt.io Intelligence
malicious
Kaspersky
malware
GEOCN
NETWORK101.200.0.0/15