This IP address has been reported a total of
25
times from
24 distinct
sources.
20.83.174.48 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated: 15 requests with error status in 120s window from 20.83.174.48.
Evidence: /___proxy_subdo ...
show moreAutomated: 15 requests with error status in 120s window from 20.83.174.48.
Evidence: /___proxy_subdomain_whm/login/:404,/___proxy_subdomain_whm/login/:404,/dump.sql:301,/backup.sql:301,/.htpasswd:301,/app/config/parameters.yml:301,/config.php:301,/.DS_Store:301,/server-status:301,/phpinfo.php:301,/config/database.yml:301,/.env.production:301,/.env:301,/.git/config:301,/.git/HEAD:301
show less
Honeypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. A ...
show moreHoneypot detection: Web application scanning / reconnaissance attempt on port 8443. Severity: LOW. Aaran.cloud
show less
(modsecurity) srv104 ModSecurity 20.83.174.48 (US/United States/-): 10 in the last 3600 secs; Ports: ...
show more(modsecurity) srv104 ModSecurity 20.83.174.48 (US/United States/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
Anonymous
[02/Jun/2026:22:23:02 +0300] 178042818239.661300 20.83.174.48 48004 148.251.76.218 80
[02/Jun/2026:2 ...
show more[02/Jun/2026:22:23:02 +0300] 178042818239.661300 20.83.174.48 48004 148.251.76.218 80
[02/Jun/2026:22:23:02 +0300] 178042818253.321421 20.83.174.48 48008 148.251.76.218 80
show less
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show moreDetected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: example.com:443
show less
2026-04-30T15:11:19.441645+08:00 kltw-debian sshd[415128]: Connection closed by authenticating user ...
show more2026-04-30T15:11:19.441645+08:00 kltw-debian sshd[415128]: Connection closed by authenticating user root 20.83.174.48 port 14016 [preauth]
2026-04-30T15:11:41.951922+08:00 kltw-debian sshd[415130]: Connection closed by authenticating user root 20.83.174.48 port 14016 [preauth]
2026-04-30T15:12:09.295913+08:00 kltw-debian sshd[415132]: Connection closed by authenticating user root 20.83.174.48 port 14017 [preauth]
2026-04-30T15:12:36.134712+08:00 kltw-debian sshd[415134]: Connection closed by authenticating user root 20.83.174.48 port 14017 [preauth]
2026-04-30T15:12:57.927373+08:00 kltw-debian sshd[415136]: Connection closed by authenticating user root 20.83.174.48 port 14017 [preauth]
...
show less
2026-04-30T07:14:38.638429+00:00 edge-tyo-con01.int.pdx.net.uk sshd[3888830]: Failed password for ro ...
show more2026-04-30T07:14:38.638429+00:00 edge-tyo-con01.int.pdx.net.uk sshd[3888830]: Failed password for root from 20.83.174.48 port 14016 ssh2
2026-04-30T07:15:04.889067+00:00 edge-tyo-con01.int.pdx.net.uk sshd[3896889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.83.174.48 user=root
2026-04-30T07:15:06.540962+00:00 edge-tyo-con01.int.pdx.net.uk sshd[3896889]: Failed password for root from 20.83.174.48 port 14016 ssh2
...
show less
Brute-Force
SSH
Showing 1 to
15
of 25 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩