Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
165.232.86.175 has a very high threat confidence level of 100%, originating from Amsterdam, The Netherlands, on the DigitalOcean, LLC network (14061). It has been observed across 225 sessions targeting SSH, with detected attack patterns including ssh host fingerprint and shell rc immutable removal, dual source gpu validation with host context, pci and nvidia gpu identification with host metadata, First observed on February 14, 2026, most recently active March 11, 2026.
Execution of a multi-command host fingerprinting script that collects kernel details, architecture, uptime, CPU count and model, GPU information, login history, and binary help characteristics, combined with chattr -i $HOME/.bashrc $HOME/.zshrc 2>/dev/null || true to remove the immutable attribute from user shell initialization files in the current user’s home directory.
Combined execution of lspci (VGA and 3D controller extraction and device count) and nvidia-smi -q (product name extraction and non-empty count validation), together with kernel/architecture (uname -s -v -n -r -m) and uptime collection. This pattern reflects cross-validation of GPU presence using both PCI-level and NVIDIA driver-level queries, enriched with host system context.
Execution of uname -s -v -n -r -m to collect kernel and architecture details, uptime -p for system uptime, lspci queries to extract and count VGA-class PCI devices, and nvidia-smi -q filtering for product name to identify NVIDIA GPU models. This pattern reflects layered GPU identification using both PCI enumeration and NVIDIA driver-level queries, combined with basic host system metadata collection.
Execution of uname -s -v -n -r -m to collect kernel and architecture details, uptime -p for human-readable system uptime, and lspci queries to extract VGA-class PCI device descriptions and count the number of VGA devices. This pattern reflects PCI-level GPU identification combined with basic host system metadata collection.
Identifies SSH sessions where the actor performs structured hardware reconnaissance including CPU core enumeration, GPU detection via nvidia-smi, VGA/3D controller inspection via lspci, system uptime queries, and kernel/architecture fingerprinting to assess computational capabilities of the compromised host.
| Date | Category | Protocol | Comment |
|---|---|---|---|
| Mar 10, 2026 | Brute Force | SSH | SikkerGuard: 2 blocked packets |