159.203.5.115
Classification: Suspicious
159.203.5.115 is a suspicious IP address in Toronto, CA. Linked to Icedid malware. 36 sightings from 6 threat sources (Proxy, VPN), last seen 2026-07-23.
Current activity
- VPN node — Provides anonymization that can hide an attacker.
MITRE ATT&CK associations
Malware families: ICEDID (S0483)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| VPN | IPWhois.io | 2026-06-22 17:48:19 | 2026-07-23 21:49:59 | anonymization vpn | |
| Proxy | FireHOL | 2023-01-02 05:03:59 | 2024-09-03 20:04:28 | anonymization | |
| IcedID | ThreatFox Abuse.ch | 2023-08-21 21:17:03 | 2023-08-24 06:17:46 | malicious-activity | S0483 IcedID |
| Mail Spammer | Barracuda | 2023-01-02 05:04:00 | 2023-01-02 05:04:00 | ||
| Anonymizer | Maltiverse Research Team | 2021-03-28 01:50:06 | 2021-05-23 14:13:10 | anonymizer | |
| Anonymizer | Maltiverse | 2021-03-26 14:15:31 | 2021-03-26 14:15:31 |
Tags
anonymization bokbot icedid port:80 iceid anonymizerWhois information
- AS name
- AS14061 DigitalOcean, LLC
- AS registry
- arin
- AS date
- 2015-08-10 00:00:00
- AS CIDR
- 159.203.0.0/20
- CIDR
- 159.203.0.0/16
- Registrant
- DigitalOcean, LLC
- Address
- 101 Ave of the Americas FL2
- City
- Toronto
- State
- NY
- Postal code
- M4R
- Country
- CA — Canada 🇨🇦
- Contact email
- [email protected], [email protected]
- First indexed
- 2021-03-26 14:15:31
- Last updated
- 2026-09-25 00:56:43
Malicious IPs in the same CIDR
159.203.10.37 159.203.3.90 159.203.13.72 159.203.12.100 159.203.15.108 159.203.13.36 159.203.6.67 159.203.2.74 159.203.1.104 159.203.8.155 159.203.13.23 159.203.13.168 159.203.3.27 159.203.6.112 159.203.7.251 159.203.5.70 159.203.2.100 159.203.15.202 159.203.14.36 159.203.9.159 159.203.1.197