159.65.53.179
Classification: Malicious
159.65.53.179 is a malicious IP address in London, GB. Linked to Sliver malware. 285 sightings from 4 threat sources (SSH Attacker), last seen 2026-10-18.
Current activity
- Known attacker — Seen launching attacks over the Internet.
- Known scanner — Seen scanning hosts over the Internet.
- VPN node — Provides anonymization that can hide an attacker.
MITRE ATT&CK associations
Malware families: SLIVER (S0633)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| VPN | IPWhois.io | 2025-08-15 22:18:51 | 2026-10-18 02:31:56 | anonymization vpn | |
| Bruteforce | AbuseIPDB | 2026-10-16 21:43:51 | 2026-10-17 22:02:43 | attacker malicious-activity | |
| SSH Attacker | AbuseIPDB | 2026-10-16 21:45:48 | 2026-10-17 22:02:43 | attacker malicious-activity | |
| SSH Attacker | Blocklist.de | 2026-10-17 14:00:20 | 2026-10-17 14:00:20 | attacker malicious-activity | |
| HTTP Attacker | AbuseIPDB | 2026-10-17 01:01:11 | 2026-10-17 01:01:11 | attacker malicious-activity | |
| Hacking | AbuseIPDB | 2026-10-16 21:41:19 | 2026-10-16 23:02:23 | attacker malicious-activity | |
| Port Scanner | AbuseIPDB | 2026-10-16 17:51:02 | 2026-10-16 22:13:22 | malicious-activity reconnaissance | |
| Sliver | ThreatFox Abuse.ch | 2025-08-15 21:58:47 | 2025-08-19 08:18:43 | malicious-activity | S0633 Sliver |
Tags
c2 sliver port:31337 shodan port:8888 drb-ra ssh bruteforce botWhois information
- AS name
- AS14061 DigitalOcean, LLC
- Registrant
- DigitalOcean, LLC
- City
- London
- Postal code
- EC4R
- Country
- GB — United Kingdom 🇬🇧
- First indexed
- 2025-08-15 22:18:50
- Last updated
- 2026-10-18 02:31:58