LAGGING · 30m
TRIAGE & INVESTIGATION
SECOPSSecurity-ops queue over the live fused alert streams — probe/outage verdicts & IOC/attack events, severity-ranked. Select an alert to investigate: raw payload, telemetry, outage-vs-vantage verification, and IOC enrichment. Read-only console; escalation/isolation is the private incident plane.
Alert queue
475
active alerts
Critical
111
top-priority
High
186
elevated
Under investigation
SIG-WEILS5
C2INTEL case
ALERT_QUEUE
sev · source · verdict
live
CRITICAL
FEODO C2
30m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
FEODO C2
30m
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
C2INTEL
42m
Cobaltstrike: 101.37.236.20
CRITICAL
C2INTEL
47m
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
47m
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
57m
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
58m
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
58m
Cobaltstrike: 1.94.65.9
CRITICAL
IPSUM
1h
IPsum: 85.217.149.47 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 79.72.3.119 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 77.239.124.121 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 16.5.0.241 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 16.5.0.241 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 16.5.0.239 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 16.5.0.238 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 16.5.0.234 (score 9/10+)
CRITICAL
IPSUM
1h
IPsum: 94.154.43.254 (score 11/10+)
CRITICAL
FEODO C2
1h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
IODA
1h
STARHUB-NGNBN -- Singapore — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Esfahan — ping-slash24 critical
CRITICAL
IODA
1h
STARHUB-NGNBN -- Singapore — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Esfahan — ping-slash24 critical
CRITICAL
IODA
1h
FR-TIGRE -- France — ping-slash24 critical
CRITICAL
IODA
1h
FR-TIGRE -- France — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Chahar Mahall and Bakhtiari — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Chahar Mahall and Bakhtiari — ping-slash24 critical
CRITICAL
IODA
1h
FR-TIGRE -- France — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Chahar Mahall and Bakhtiari — ping-slash24 critical
CRITICAL
IODA
1h
TCI -- Chahar Mahall and Bakhtiari — ping-slash24 critical
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.33.225.32
CRITICAL
C2INTEL
1h
Cobaltstrike: 101.201.103.158
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.126.10.34
CRITICAL
IODA
2h
AS131464 (DJBL-AS-AP) — bgp critical
CRITICAL
IODA
2h
AS131464 (DJBL-AS-AP) — bgp critical
CRITICAL
C2INTEL
2h
Cobaltstrike: 1.94.65.9
CRITICAL
C2INTEL
2h
Cobaltstrike: 1.15.76.39
CRITICAL
IODA
2h
AS34879 (CCT-AS) — bgp critical
CRITICAL
IODA
2h
AS34879 (CCT-AS) — bgp critical
CRITICAL
IODA
2h
AS34879 (CCT-AS) — bgp critical
CRITICAL
IODA
2h
AS34879 (CCT-AS) — bgp critical
CRITICAL
IODA
2h
STARHUB-NGNBN -- Singapore — ping-slash24 critical
CRITICAL
IODA
2h
STARHUB-NGNBN -- Singapore — ping-slash24 critical
CRITICAL
IODA
2h
STARHUB-NGNBN -- Singapore — ping-slash24 critical
CRITICAL
IODA
2h
AS47531 (GorPTUs-AS) — bgp critical
CRITICAL
IODA
2h
AS47531 (GorPTUs-AS) — bgp critical
CRITICAL
DEFCON
2h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
FEODO C2
2h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.37.236.20
CRITICAL
C2INTEL
2h
Cobaltstrike: 101.33.225.32
CRITICAL
IODA
2h
JKU-LINZ-AS -- Austria — ping-slash24 critical
CRITICAL
C2INTEL
3h
Cobaltstrike: 101.200.193.211
CRITICAL
C2INTEL
3h
Cobaltstrike: 101.126.10.34
CRITICAL
C2INTEL
3h
Cobaltstrike: 1.94.65.9
CRITICAL
FEODO C2
3h
LIVE C2: 50.16.16.211:443 (QakBot)
CRITICAL
C2INTEL
3h
Cobaltstrike: 1.15.76.39
CRITICAL
IODA
3h
ITISNET-AS -- South Korea — ping-slash24 critical
CRITICAL
IODA
3h
ITISNET-AS -- South Korea — ping-slash24 critical
CRITICAL
IODA
3h
AS137443 (ANCHGLOBAL-AS-AP) — bgp critical
CRITICAL
IODA
3h
AS137443 (ANCHGLOBAL-AS-AP) — bgp critical
CRITICAL
DEFCON
3h
[DEFCON 1] Nation-State Network Activity
CRITICAL
IODA
4h
AKAMAI-LINODE-AP -- India — ping-slash24 critical
CRITICAL
DEFCON
4h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
DEFCON
4h
[DEFCON 1] Nation-State Network Activity
CRITICAL
IODA
4h
AS50581 (UTG) — bgp critical
CRITICAL
DEFCON
4h
Mass withdrawal burst: 85 routes
CRITICAL
IODA
5h
AS20807 (Credolink-ASN) — ping-slash24 critical
CRITICAL
IPSUM
7h
IPsum: 16.5.0.241 (score 9/10+)
CRITICAL
IODA
8h
AS59815 (TRK-METRO-AS) — ping-slash24 critical
CRITICAL
IODA
8h
DEC-AS -- Ukraine — ping-slash24 critical
CRITICAL
IODA
8h
KIRZ-AS-TH -- Thailand — ping-slash24 critical
CRITICAL
IODA
9h
AS31133 (MF-MGSM-AS) — ping-slash24 critical
CRITICAL
IODA
9h
AS51812 (KTVS-AS) — ping-slash24 critical
CRITICAL
IODA
9h
ROSTOV-AS -- Russian Federation — ping-slash24 critical
CRITICAL
DEFCON
10h
[DEFCON 2] DDoS Origin + Active Threat Feed Signal
CRITICAL
IODA
10h
MEGAFON-AS -- Lipetsk — ping-slash24 critical
CRITICAL
IODA
10h
TCI -- Markazi — ping-slash24 critical
CRITICAL
HIBP
11h
Breach: LimeLeads (17838k accounts)
CRITICAL
HIBP
11h
Breach: LimeLeads (17838k accounts)
CRITICAL
IODA
11h
AS48031 (XServer) — bgp critical
CRITICAL
DEFCON
11h
[DEFCON 1] Nation-State Network Activity
INVESTIGATION
Investigation ID
SIG-WEILS5
Status
C2 SERVER
CRITICAL
C2INTEL
· CN
47m ago
Raw payload
Cobaltstrike: 101.33.225.32
Active Cobaltstrike infrastructure — AS45090 Shenzhen Tencent Computer Systems Company Limited — China. From drb-ra/C2IntelFeeds 30-day scan.
Telemetry timeline · related activity
18:21:51Z
Cobaltstrike: 101.37.236.20
18:06:44Z
Cobaltstrike: 101.200.193.211
18:06:14Z
Cobaltstrike: 101.126.10.34
18:06:02Z
Cobaltstrike: 1.94.65.9
17:11:48Z
Cobaltstrike: 101.33.225.32
17:09:58Z
Cobaltstrike: 101.201.103.158
Escalate / isolate actions live in the private incident plane (per-tenant).
IOC_ENRICHMENT
101.33.225.32
11/91
⚠ Malicious activity detected
Detections · 12 engines
ADMINUSLabs
malicious
alphaMountain.ai
malicious
AlphaSOC
malware
Chong Lua Dao
malicious
Cluster25
malicious
Criminal IP
malicious
CyRadar
malicious
Hunt.io Intelligence
malicious
Lionic
malicious
MalwareURL
malware
SOCRadar
malware
ESET
suspicious
GEOCN
NETWORK101.33.192.0/18