This IP address has been reported a total of
58
times from
45 distinct
sources.
20.80.86.196 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 22
reports;
Germany
with 13
reports;
United Kingdom of Great Britain and Northern Ireland
with 6
reports.
The most common categories in these recent reports were:
Brute-Force
49
times;
SSH
42
times;
Port Scan
13
times;
Hacking
5
times;
Exploited Host
4
times;
Other
4
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-10-17T23:48:35.101442+02:00 web psad[5915]: scan detected (Nmap -sT or -sS scan): 20.80.86.196 ...
show more2026-10-17T23:48:35.101442+02:00 web psad[5915]: scan detected (Nmap -sT or -sS scan): 20.80.86.196 -> 150.251.48.2 tcp: [8888] flags: SYN tcp pkts: 1 DL: 2 total scan dsts: 1
...
show less
Blocked by UFW (TCP on 8000)
Source port: 5168
TTL: 242
Packet length: 40
TOS: 0x00
This report (fo ...
show moreBlocked by UFW (TCP on 8000)
Source port: 5168
TTL: 242
Packet length: 40
TOS: 0x00
This report (for 20.80.86.196) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Blocked by UFW (TCP on 1081)
Source port: 5168
TTL: 243
Packet length: 40
TOS: 0x00
This report (fo ...
show moreBlocked by UFW (TCP on 1081)
Source port: 5168
TTL: 243
Packet length: 40
TOS: 0x00
This report (for 20.80.86.196) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Blocked by UFW (TCP on 8889)
Source port: 5168
TTL: 243
Packet length: 40
TOS: 0x00
This report (fo ...
show moreBlocked by UFW (TCP on 8889)
Source port: 5168
TTL: 243
Packet length: 40
TOS: 0x00
This report (for 20.80.86.196) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Automated honeypot observation: SSH brute-force / credential-stuffing. Failed logins: 2, successful: ...
show moreAutomated honeypot observation: SSH brute-force / credential-stuffing. Failed logins: 2, successful: 0, commands: 0, file transfers: 0. Seen on 1 sensor(s) (ch1) over 2026-09-14..2026-09-14. Reported by an SSH honeypot network; no production service involved.
show less
Cowrie honeypot: SSH brute-force login, then ran commands and wrote files to disk. 4 sessions 2026-0 ...
show moreCowrie honeypot: SSH brute-force login, then ran commands and wrote files to disk. 4 sessions 2026-09-14 06:05 to 2026-09-14 09:53 UTC.
show less
2026-09-14T05:34:28.671348+00:00 instance-20260914-0258 sshd-session[63927]: Connection closed by au ...
show more2026-09-14T05:34:28.671348+00:00 instance-20260914-0258 sshd-session[63927]: Connection closed by authenticating user root 20.80.86.196 port 44064 [preauth]
2026-09-14T07:33:16.033295+00:00 instance-20260914-0258 sshd-session[68139]: Connection closed by authenticating user root 20.80.86.196 port 44064 [preauth]
2026-09-14T09:25:06.585906+00:00 instance-20260914-0258 sshd-session[68380]: Connection closed by authenticating user root 20.80.86.196 port 44064 [preauth]
...
show less
Cowrie SSH honeypot detected unauthorized SSH activity. Username: root. Failed SSH login attempts fr ...
show moreCowrie SSH honeypot detected unauthorized SSH activity. Username: root. Failed SSH login attempts from this IP in the last 24 hours: 2. New failed login attempts since the previous report: 1. Reason: Failed SSH login attempt. Target: SSH honeypot.
show less
2026-09-14T08:48:46.730343+00:00 instance-20241105-1951 sshd[3023733]: Connection closed by authenti ...
show more2026-09-14T08:48:46.730343+00:00 instance-20241105-1951 sshd[3023733]: Connection closed by authenticating user root 20.80.86.196 port 44064 [preauth]
...
show less
