Skip to content
COOEY

◄ SITREP

LIVE ATTACK MONITOR

THREAT_MAP

Real-time fused attack telemetry — active C2 beacons, DDoS origins, malicious scans, phishing infrastructure & ransomware claims — streamed from the estate threat pipeline. Each event is a live observation, geo-plotted and lane-classified.

--- [ THREAT_LEGEND ] ---
DDoS / ATTACK ORIGINS[HIGH_PRIORITY]
MALWARE / C2 / RANSOM[TRACKED]
PHISHING / SCAN NODES[MONITORED]
[ WARNING: 167 CRITICAL THREATS ACTIVE // DEFCON 2 ]
UTC: — SEC: BLK_43812581
// GLOBAL_THREAT_MAP
DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (24.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (13.8% of global) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (24.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (13.8% of global) ATTACK SRC · RU · Top attacker: 152.89.198.103 (41k reports) ATTACK SRC · RU · Top attacker: 152.89.198.163 (41k reports) ATTACK SRC · US · Top attacker: 18.116.198.191 (60k reports) ATTACK SRC · US · Top attacker: 143.244.186.35 (92k reports) ATTACK SRC · PL · Top attacker: 89.248.163.109 (96k reports) ATTACK SRC · NL · Top attacker: 52.157.207.201 (195k reports) ATTACK SRC · ES · Top attacker: 194.224.249.214 (310k reports) ATTACK SRC · NL · Top attacker: 13.94.254.200 (320k reports) C2 / MALWARE · US · LIVE C2: 50.16.16.211:443 (QakBot) PHISH / SCAN · SG · urlscan: developed-brown-nljvpkv8-dph8vpgpkgup.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: xenophobic-turquoise-czaz8ems-dpaddlqdn89g.edgeone.dev (phishing, malicious) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (24.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (13.7% of global) PHISH / SCAN · SG · urlscan: ethical-aqua-olmeht4n-dp73qvun4n2u.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: the-shoot-game-dp18i81mdgoe.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: united-aquamarine-8fcssmve-dp1e0dvxmt7q.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: frightened-black-saoxdyoo-dpxajmru6gk1.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: yanyu-growth-ai-dpczpxv49r20.edgeone.dev (phishing, malicious) PHISH / SCAN · SG · urlscan: arcpulse-demo-dpp9wktv5v2d.edgeone.dev (phishing, malicious) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (24.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (13.7% of global) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (24.9% of global) DDoS ORIGIN · BR · CF Radar: BR top DDoS L3 origin (13.7% of global) C2 / MALWARE · CN · Cobaltstrike: 101.34.208.175 C2 / MALWARE · CN · Cobaltstrike: 101.33.225.32 C2 / MALWARE · CN · Cobaltstrike: 101.201.103.158 C2 / MALWARE · CN · Cobaltstrike: 101.133.225.51 C2 / MALWARE · CN · Cobaltstrike: 101.126.10.34 C2 / MALWARE · CN · Cobaltstrike: 1.15.76.39 C2 / MALWARE · CN · Cobaltstrike: 1.12.253.219 ATTACK SRC · RU · Top attacker: 152.89.198.103 (41k reports) ATTACK SRC · RU · Top attacker: 152.89.198.163 (41k reports) ATTACK SRC · US · Top attacker: 18.116.198.191 (60k reports) ATTACK SRC · US · Top attacker: 143.244.186.35 (92k reports) ATTACK SRC · PL · Top attacker: 89.248.163.109 (96k reports) ATTACK SRC · NL · Top attacker: 52.157.207.201 (195k reports) ATTACK SRC · ES · Top attacker: 194.224.249.214 (310k reports) ATTACK SRC · NL · Top attacker: 13.94.254.200 (320k reports) C2 / MALWARE · US · LIVE C2: 50.16.16.211:443 (QakBot) DDoS ORIGIN · US · CF Radar: US top DDoS L7 origin (24.9% of global)
ddos malware/c2 phish/scan ◎ defended stack · arcs = live inbound observations
SYSTEM_METRICS
Threat load55%
PipelineSTREAMING
221
active events
84
critical
84
ddos origins
28
malware / c2
encrypted line active · polling
LIVE_ATTACK_STREAM
severity · vector · source → destination · seen ◆ ACTIVE_THREADS: 221
HIGH RANSOMWARE — now
HIGH DDoS ORIGIN — 9m ago
HIGH DDoS ORIGIN — 9m ago
HIGH DDoS ORIGIN — 19m ago
HIGH DDoS ORIGIN — 19m ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 27m ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 27m ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 27m ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 27m ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 27m ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 27m ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 27m ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 28m ago
INFO THREAT LEVEL — 28m ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 28m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 28m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 28m ago
HIGH DDoS ORIGIN — 29m ago
HIGH DDoS ORIGIN — 29m ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 29m ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 29m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 29m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 29m ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 29m ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 29m ago
HIGH DDoS ORIGIN — 39m ago
HIGH DDoS ORIGIN — 39m ago
HIGH DDoS ORIGIN — 49m ago
HIGH DDoS ORIGIN — 49m ago
CRITICAL C2 / MALWARE 101.34.208.175 → AS45090 50m ago
CRITICAL C2 / MALWARE 101.33.225.32 → AS45090 50m ago
CRITICAL C2 / MALWARE 101.201.103.158 → AS37963 50m ago
CRITICAL C2 / MALWARE 101.133.225.51 → AS37963 50m ago
CRITICAL C2 / MALWARE 101.126.10.34 → AS137718 50m ago
CRITICAL C2 / MALWARE 1.15.76.39 → AS45090 50m ago
CRITICAL C2 / MALWARE 1.12.253.219 → AS45090 50m ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 57m ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 57m ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 57m ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 57m ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 57m ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 57m ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 57m ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 58m ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 58m ago
INFO THREAT LEVEL — 58m ago
HIGH DDoS ORIGIN — 59m ago
HIGH DDoS ORIGIN — 59m ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH DDoS ORIGIN — 1h ago
CRITICAL OUTAGE — → AS8452 1h ago
CRITICAL OUTAGE — → AS8452 1h ago
CRITICAL OUTAGE — → AS8452 1h ago
CRITICAL OUTAGE — → AS8452 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH DDoS ORIGIN — 1h ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 1h ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 1h ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 1h ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 1h ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 1h ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 1h ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 1h ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 1h ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 1h ago
INFO THREAT LEVEL — 1h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
CRITICAL OUTAGE — → AS209596 1h ago
CRITICAL OUTAGE — → AS209596 1h ago
CRITICAL OUTAGE — → AS209596 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
CRITICAL OUTAGE — → AS8788 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH DDoS ORIGIN — 1h ago
CRITICAL C2 / MALWARE 101.34.208.175 → AS45090 1h ago
CRITICAL C2 / MALWARE 101.33.225.32 → AS45090 1h ago
CRITICAL C2 / MALWARE 101.201.103.158 → AS37963 1h ago
CRITICAL C2 / MALWARE 101.133.225.51 → AS37963 1h ago
CRITICAL C2 / MALWARE 101.126.10.34 → AS137718 1h ago
CRITICAL C2 / MALWARE 1.15.76.39 → AS45090 1h ago
CRITICAL C2 / MALWARE 1.12.253.219 → AS45090 1h ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 1h ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 1h ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 1h ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 1h ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 1h ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 1h ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 1h ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 1h ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 1h ago
INFO THREAT LEVEL — 1h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 1h ago
CRITICAL OUTAGE — → AS20940 [AKAMAI] 1h ago
CRITICAL OUTAGE — → AS20940 [AKAMAI] 1h ago
CRITICAL OUTAGE — → AS20940 [AKAMAI] 1h ago
CRITICAL OUTAGE — → AS20940 [AKAMAI] 1h ago
CRITICAL OUTAGE — → AS20940 [AKAMAI] 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH DDoS ORIGIN — 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 1h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 2h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 2h ago
HIGH DDoS ORIGIN — 2h ago
HIGH DDoS ORIGIN — 2h ago
HIGH DDoS ORIGIN — 2h ago
HIGH DDoS ORIGIN — 2h ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 2h ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 2h ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 2h ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 2h ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 2h ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 2h ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 2h ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 2h ago
INFO THREAT LEVEL — 2h ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 2h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 2h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 2h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 2h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 2h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 2h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 2h ago
CRITICAL OUTAGE — → AS37340 2h ago
CRITICAL OUTAGE — → AS37340 2h ago
CRITICAL OUTAGE — → AS37340 2h ago
CRITICAL OUTAGE — → AS37340 2h ago
CRITICAL OUTAGE — → AS37340 2h ago
CRITICAL OUTAGE — → AS37340 2h ago
CRITICAL OUTAGE — → AS37340 2h ago
CRITICAL OUTAGE — → AS37340 2h ago
CRITICAL OUTAGE — → AS37340 2h ago
HIGH DDoS ORIGIN — 2h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 2h ago
HIGH DDoS ORIGIN — 2h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 2h ago
CRITICAL OUTAGE — → AS28220 2h ago
CRITICAL OUTAGE — → AS8643 2h ago
HIGH DDoS ORIGIN — 2h ago
HIGH DDoS ORIGIN — 2h ago
CRITICAL OUTAGE — → AS134175 2h ago
CRITICAL OUTAGE — → AS134175 2h ago
CRITICAL OUTAGE — → AS134548 2h ago
CRITICAL OUTAGE — → AS134548 2h ago
CRITICAL OUTAGE — → AS134175 2h ago
CRITICAL OUTAGE — → AS134548 2h ago
CRITICAL OUTAGE — → AS134548 2h ago
CRITICAL OUTAGE — → AS2914 [NTT] 2h ago
CRITICAL OUTAGE — → AS134548 2h ago
CRITICAL OUTAGE — → AS134175 2h ago
CRITICAL OUTAGE — → AS134175 2h ago
CRITICAL OUTAGE — → AS134175 2h ago
CRITICAL OUTAGE — → AS134548 2h ago
CRITICAL OUTAGE — → AS134548 2h ago
CRITICAL OUTAGE — → AS2914 [NTT] 2h ago
CRITICAL OUTAGE — → AS2914 [NTT] 2h ago
CRITICAL OUTAGE — → AS134548 2h ago
HIGH DDoS ORIGIN — 2h ago
HIGH DDoS ORIGIN — 2h ago
CRITICAL C2 / MALWARE 101.34.208.175 → AS45090 2h ago
CRITICAL C2 / MALWARE 101.33.225.32 → AS45090 2h ago
CRITICAL C2 / MALWARE 101.201.103.158 → AS37963 2h ago
CRITICAL C2 / MALWARE 101.133.225.51 → AS37963 2h ago
CRITICAL C2 / MALWARE 101.126.10.34 → AS137718 2h ago
CRITICAL C2 / MALWARE 1.15.76.39 → AS45090 2h ago
CRITICAL C2 / MALWARE 1.12.253.219 → AS45090 2h ago
CRITICAL OUTAGE — → AS209596 2h ago
CRITICAL OUTAGE — → AS209596 2h ago
CRITICAL OUTAGE — → AS209596 2h ago
CRITICAL OUTAGE — → AS209596 2h ago
CRITICAL OUTAGE — → AS209596 2h ago
MEDIUM ATTACK SRC 152.89.198.103 → AS213498 2h ago
MEDIUM ATTACK SRC 152.89.198.163 → AS213498 2h ago
MEDIUM ATTACK SRC 18.116.198.191 → AS16509 [AMAZON] 2h ago
MEDIUM ATTACK SRC 143.244.186.35 → AS14061 2h ago
MEDIUM ATTACK SRC 89.248.163.109 → AS202425 2h ago
HIGH ATTACK SRC 52.157.207.201 → AS8075 [MICROSOFT] 2h ago
HIGH ATTACK SRC 194.224.249.214 → AS3352 2h ago
HIGH ATTACK SRC 13.94.254.200 → AS8075 [MICROSOFT] 2h ago
CRITICAL C2 / MALWARE 50.16.16.211 → AS14618 2h ago
INFO THREAT LEVEL — 2h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 2h ago
HIGH DDoS ORIGIN — 2h ago
HIGH DDoS ORIGIN — 2h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 2h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 2h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 3h ago
HIGH PHISH / SCAN 43.174.247.29 → AS139341 3h ago
HIGH PHISH / SCAN 43.174.246.29 → AS139341 3h ago