167.172.157.217

Classification: Malicious

167.172.157.217 is a malicious IP address in North Bergen, US. Linked to Cobalt Strike malware. 123 sightings from 3 threat sources, last seen 2026-10-11.

Current activity

  • Known attacker — Seen launching attacks over the Internet.

MITRE ATT&CK associations

Malware families: COBALT STRIKE (S0154)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Malicious Host CIArmy 2025-03-13 03:11:58 2026-10-11 20:03:39 attacker malicious-activity
Malicious Host AbuseIPDB 2025-03-10 13:38:26 2025-03-12 06:22:13 compromised malicious-activity
Port Scanner AbuseIPDB 2025-03-09 19:04:50 2025-03-12 06:22:13 anomalous-activity
Bruteforce AbuseIPDB 2025-03-10 00:50:09 2025-03-11 17:35:52 malicious-activity
Hacking AbuseIPDB 2025-03-09 20:12:04 2025-03-11 17:35:52 malicious-activity
HTTP Attacker AbuseIPDB 2025-03-10 22:50:49 2025-03-10 22:50:49 malicious-activity
Suspicious Host AbuseIPDB 2025-03-10 04:08:55 2025-03-10 04:08:55 anomalous-activity
Cobalt Strike ThreatFox Abuse.ch 2023-04-04 09:17:45 2023-04-06 08:22:39 malicious-activity S0154 Cobalt Strike

Tags

cobaltstrike cs-watermark-694793028 digitalocean llc port:443 agentemis beacon cobeacon

Whois information

AS name
AS14061 DigitalOcean, LLC
AS registry
ripencc
AS date
1993-08-30 00:00:00
AS CIDR
167.172.144.0/20
CIDR
167.172.0.0/16
Registrant
DigitalOcean, LLC
Address
101 Avenue of the Americas, 10th Floor New York 10013 UNITED STATES
City
North Bergen
State
NJ
Postal code
07047
Country
US — United States 🇺🇸
First indexed
2023-04-04 09:17:45
Last updated
2026-10-12 17:26:19

Malicious IPs in the same CIDR

167.172.148.89 167.172.157.30 167.172.150.173 167.172.157.153 167.172.156.208 167.172.150.24 167.172.148.206 167.172.153.212 167.172.157.17 167.172.158.128 167.172.145.231 167.172.157.217 167.172.148.222 167.172.155.27 167.172.153.2 167.172.158.160 167.172.158.20 167.172.144.9 167.172.146.21 167.172.158.84 167.172.149.163