Skip to content
New Sliver C2 Instances Detected on Port 31337

New Sliver C2 Instances Detected on Port 31337

First seen 12 Nov 2026, 01:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 01:12 UTC
  • •Two Sliver C2 servers detected on port 31337.
  • •First server detected on November 11, second on November 8.
  • •Further validation is necessary as detections may be false positives.

Two separate instances of Sliver Command and Control (C2) servers have been detected on different IP addresses: 104.207.93.111 and 89.125.10.160, both using port 31337. The first detection was reported on November 11, 2026, while the second was noted on November 8, 2026. The nature of these detections suggests potential malicious activity, although further validation is recommended as they may be false positives. No specific attack vector or affected systems have been disclosed in the articles. Security professionals are advised to monitor their networks for any unusual activity related to these IP addresses. The situation remains fluid, and ongoing vigilance is essential.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 12h ago How this analysis works

Timeline

2026-11-08
Sliver C2 detected at 89.125.10.160
Detection reported for a C2 server on port 31337, further validation recommended.
Redpacketsecurity
2026-11-11
Sliver C2 detected at 104.207.93.111
Another C2 server detected on the same port, with similar validation warnings.
Redpacketsecurity

More articles in this cluster (3)

Following this threat?

Track Sliver in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (1)

1 / 2

Common questions

What are the IP addresses involved?
The detected Sliver C2 servers are located at 104.207.93.111 and 89.125.10.160.
What should I do if I see traffic to these IPs?
Monitor your network for unusual activity related to these IPs and consider blocking them.
Is there any confirmed exploitation?
No confirmed exploitation has been reported; further validation is needed as detections may be false positives.