JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.102.95.51

20.102.95.51

Recent Activity

58 reports found in our database

97% ▲ ▲ ▲ Critical

Abuse confidence score ?

ISP

Microsoft Corporation

Usage Type

Data Center/Web Hosting/Transit

ASN

AS8075

Domain Name

microsoft.com

Country

🇺🇸 United States of America

City

Dulles Town Center, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 20.102.95.51:

This IP address has been reported a total of 58 times from 42 distinct sources. 20.102.95.51 was first reported on May 20th 2026, and the most recent report was 10 hours ago. In the last 60 days, the top reporter locations were: United States of America with 25 reports; Germany with 2 reports; Australia with 1 report. The most common categories in these recent reports were: Brute-Force 27 times; SSH 21 times; Hacking 7 times; Port Scan 5 times; Web App Attack 3 times; Other 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 psh-ack	2026-09-14 12:46:16 (10 hours ago)	Brute-force attack across 30 sessions using weak passwords (111111, 123456, password, root, admin, q ... show more Brute-force attack across 30 sessions using weak passwords (111111, 123456, password, root, admin, qwerty, abc123) and anomalous __hp_ prefixed creds indicating automated tooling. Attacker exec'd process enumeration and environment detection cmds repeatedly. Primary pattern: writes 24-char hex tokens to /tmp/.hp[id]_a and /tmp/.hp[id]_b, exfiltrates via printf. Token generation/exfil occurred multiple times suggesting reconnaissance of exfil channels or cmd execution validation. Six hidden files dropped in /tmp/.hp* pattern, 25 bytes each (24 chars + newline), containing hex token pairs. SHA-256: .hp6f0b649f_b: 4fe0fb6acad614ba7757b8bb5b1a336f1578bdeec654a17a34e3ac1573902c2a \| .hp339c55bf_a: 4784007323ddf9c88bae0a41308afb37e4a0145fb790ebc8a334baec683ed267 \| .hp197c843d_a: 87e08a6395f06a54cc7fc8b8619b6bac711b527d65ca77a3bb36691ff751372f \| .hp6f0b649f_a: 439f37fbe72f0d962e73764afe105873bd4971b6a87817435602571c47090f show less	Brute-Force SSH Hacking
🇺🇸 psh-ack	2026-09-14 10:14:36 (13 hours ago)	Four SSH brute-force sessions: creds root/111111, root/qwerty, __hp_ prefixed variants. OpenSSH 7.4- ... show more Four SSH brute-force sessions: creds root/111111, root/qwerty, __hp_ prefixed variants. OpenSSH 7.4-9.3 signatures. Chain: PID extraction via /proc/$SPID/status, wrote tokens to /tmp/.hp* files, probed Cowrie paths (/home/cowrie, /opt/cowrie, /srv/cowrie), fingerprinted via /proc/1/cmdline, /proc/version, uname, /etc/passwd. Invoked undefined handlers (__hp_6ff87e8e, __hp_acff54b) returning non-zero codes—environment probing for honeypot detection. No persistence, lateral movement, or payload exec observed. Reconnaissance-only, targeting honeypot identification. Pattern suggests automated brute-force tooling with evasion logic designed to skip monitored systems. show less	Brute-Force SSH
🇺🇸 [email protected]	2026-09-14 10:08:21 (13 hours ago)	Total attacks: 6	Brute-Force SSH
🇺🇸 anon333	2026-09-14 10:04:08 (13 hours ago)	Cowrie Honeypot: 5 unauthorised SSH/Telnet login attempts between 2026-09-14T09:36:40Z and 2026-09-1 ... show more Cowrie Honeypot: 5 unauthorised SSH/Telnet login attempts between 2026-09-14T09:36:40Z and 2026-09-14T10:04:07Z show less	Brute-Force SSH
🇺🇸 psh-ack	2026-09-14 09:59:25 (13 hours ago)	Reconnaissance probe across 4 sessions using leaked creds: root/1234567890, root/__hp_027a8ba0e60f26 ... show more Reconnaissance probe across 4 sessions using leaked creds: root/1234567890, root/__hp_027a8ba0e60f26b62aca6bbe, root/__hp_c3e2c4190a67de4eebd1cd52, root/pass. OpenSSH versions 8.7p1, 9.2p1 Debian, 9.3p1 Ubuntu suggest automated bot. Attack focused on environment detection: process enumeration ($$, /proc/PID/status), token file creation (/tmp/.hp* with hex strings), honeypot detection (searching /home/cowrie, /opt/cowrie, /srv/cowrie paths), kernel fingerprinting (/proc/version, uname -r/-v). Commands read/write hex identifiers to temp files—suggests credential validation or session tracking testing. No malware, persistence, lateral movement, or exfiltration. 7-minute window, 4 rapid sessions indicate scripted execution. Consistent with automated scanning, honeypot detection logic, or reconnaissance phase. Low immediate compromise risk but moderate for infrastructure mapping—attacker probes honeypot signatures and system capabilities before payload deployment. show less	Brute-Force SSH
🇺🇸 psh-ack	2026-09-14 09:44:09 (13 hours ago)	Four SSH sessions via OpenSSH/PuTTY clients. Brute-force creds: root/123, root/test, root/__hp_1276b ... show more Four SSH sessions via OpenSSH/PuTTY clients. Brute-force creds: root/123, root/test, root/__hp_1276b3c241a4e0264934e8a8, root/__hp_139300bf7f8783181b6ced21. Cmd exec focused on system enumeration and honeypot evasion. Attacker ran PID/process inspection (shell PID, status PID, parent process) to fingerprint env. Temp token files created in /tmp: hp197c843d_a, hp197c843d_b, hp6837b9ae_a, hp6837b9ae_b (hex strings). Reconnaissance targeted honeypot ID: checked /home/cowrie, /opt/cowrie, /srv/cowrie dirs and /proc/1/cmdline for init process config. Enumerated /proc/version, uname, attempted exec of non-existent funcs (__hp_232b262, __hp_4e2d23be) to trigger errors for env detection. Passwd file enum attempted. No malware dl, persistence, lateral movement, payload deploy, shell scripts, binaries, or data exfil detected. Activity consistent with automated vuln scanning or honeypot detection tool targeting Cowrie/similar SSH honeypot implementations. show less	Brute-Force SSH
🇺🇸 [email protected]	2026-09-14 09:41:25 (13 hours ago)	Total attacks: 4	Brute-Force SSH
🇺🇸 [email protected]	2026-09-14 09:18:22 (14 hours ago)	Total attacks: 2	Brute-Force SSH
🇺🇸 bigwavedave	2026-09-14 09:14:21 (14 hours ago)	SSH	Brute-Force SSH
🇺🇸 psh-ack	2026-09-14 09:14:13 (14 hours ago)	SSH brute-force: root creds (1234, 12345, obfuscated variants __hp_270b565904b4e5ff73699351, __hp_a1 ... show more SSH brute-force: root creds (1234, 12345, obfuscated variants __hp_270b565904b4e5ff73699351, __hp_a12275bea5a1796849f30934). Multiple OpenSSH versions (Debian/Ubuntu) indicate automated scanning. Post-auth: env detection, honeypot ID checks. Temp tokens in /tmp: ae77205ec50cca3bcb71e1ed, a8e5f0056b946943efa2df5b, fc3dac08461e08a4fd0ef1f3, 0cb3733fd93c4adade0cfc3c (likely session tracking). Shell introspection: /proc/self/status queries for PID/PPID/vars. Cowrie detection scans (/home/cowrie, /opt/cowrie, /srv/cowrie) + /proc/1/cmdline container checks. /proc/version + uname fingerprinting. Undefined func calls (__hp_37bbed8d, __hp_5000f369) with exit validation. No malware dl, file transfer, or persistence. No lateral movement/port forwarding. Pattern: automated recon against SSH, environment assessment focus. Suggests adversary testing deployment footprints/developing honeypot countermeasures. show less	Brute-Force SSH
🇺🇸 Vlad Marchenko	2026-09-14 09:04:16 (14 hours ago)	2026-09-14T03:39:42.296601 nas.marchenko.net sshd-session[105565]: pam_unix(sshd:auth): authenticati ... show more 2026-09-14T03:39:42.296601 nas.marchenko.net sshd-session[105565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.102.95.51 user=root 2026-09-14T03:39:44.158287 nas.marchenko.net sshd-session[105565]: Failed password for invalid user root from 20.102.95.51 port 29712 ssh2 2026-09-14T04:04:15.467871 nas.marchenko.net sshd-session[111230]: User root from 20.102.95.51 not allowed because not listed in AllowUsers ... show less	Brute-Force SSH
🇺🇸 RidgeStar	2026-09-14 08:58:27 (14 hours ago)	2026-09-14T01:58:27-07:00: Failed password for invalid user root from 20.102.95.51 port 29712 ssh2	Brute-Force SSH
🇺🇸 psh-ack	2026-09-14 08:43:31 (14 hours ago)	Honeypot detection & reconnaissance via 2 sessions. Creds: root/12345678 and root/__hp_261d0c6ec076a ... show more Honeypot detection & reconnaissance via 2 sessions. Creds: root/12345678 and root/__hp_261d0c6ec076a17c2728b4c4. OpenSSH 8.4p1 and 8.7p1 (Debian). Attack chain: environment fingerprinting & honeypot evasion. Recon executed: /proc/PID/status for shell processes, /proc/version & uname for kernel detection, searched /home/cowrie, /opt/cowrie, /srv/cowrie for Cowrie SSH honeypot dirs, enumerated /proc/1/cmdline for init process, probed /etc/passwd. Temp marker files created in /tmp: .hp3e9c9100_a and .hp3e9c9100_b with hash values 78a077a02301ab8b93674c9f and 16b22f232c39052b5a495ca3 for session tracking/token verification. Called undefined function __hp_708dbaeb to trigger error responses for behavior profiling. No payload delivery, malware dl, persistence, or lateral movement. Activity terminated post-recon. Scanning & detection-evasion probe only—attacker identified target as SSH honeypot and withdrew. Pattern consistent with automated honeypot screening infrastructure testing. show less	Brute-Force SSH
🇺🇸 RidgeStar	2026-09-14 08:26:42 (15 hours ago)	2026-09-14T01:26:40-07:00: Failed password for invalid user root from 20.102.95.51 port 29712 ssh2 2 ... show more 2026-09-14T01:26:40-07:00: Failed password for invalid user root from 20.102.95.51 port 29712 ssh2 2026-09-14T00:52:20-07:00: Failed password for invalid user root from 20.102.95.51 port 29712 ssh2 2026-09-14T00:52:20-07:00: Failed password for invalid user root from 20.102.95.51 port 29712 ssh2 2026-09-14T00:18:23-07:00: Failed password for invalid user root from 20.102.95.51 port 29712 ssh2 2026-09-14T00:18:21-07:00: Failed password for invalid user root from 20.102.95.51 port 29712 ssh2 show less	Brute-Force SSH
🇺🇸 psh-ack	2026-09-14 08:13:10 (15 hours ago)	Honeypot reconnaissance via SSH using creds root/__hp_b63123340f15371c360f6172 and root/password. At ... show more Honeypot reconnaissance via SSH using creds root/__hp_b63123340f15371c360f6172 and root/password. Attack chain: environment enumeration (PID/PPID checks), /tmp marker files w/ tokens, honeypot dir checks (/home/cowrie, /opt/cowrie, /srv/cowrie), /proc/1/cmdline extraction, /proc/version read, uname execution for kernel/OS fingerprinting. No malware, persistence, lateral movement, data exfiltration, or file artifacts. Automated scanner pattern - structured cmd execution w/ printf/token generation indicates purpose-built probe. ~6sec session duration across both attempts consistent w/ automated scanning. Low-risk infrastructure identification activity, no exploitation/compromise. show less	Brute-Force SSH

Showing 1 to 15 of 58 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 210.208.110.4

🇲🇾 210.195.149.95

🇯🇵 210.194.245.77

🇮🇳 103.189.217.170

🇳🇱 94.154.43.104

🇧🇬 79.124.62.218

🇺🇸 66.240.223.214

🇭🇰 20.205.45.36

🇮🇪 2a05:d018:1d9d:e701:97f:c71c:a6c:ae84

🇰🇷 210.192.94.13

🇮🇳 210.18.177.53

🇩🇪 188.95.65.43

🇮🇳 152.52.240.162

🇫🇷 143.244.57.121

🇮🇳 128.185.33.227

🇷🇺 89.109.4.236

🇿🇼 66.9.171.84

🇺🇸 47.251.75.100

🇷🇴 37.251.221.177

🇺🇸 216.150.16.92