JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 35.80.21.128

35.80.21.128 was found in our database!

This IP was reported 63 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-35-80-21-128.us-west-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Boardman, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 35.80.21.128

Whois 35.80.21.128

IP Abuse Reports for 35.80.21.128:

This IP address has been reported a total of 63 times from 61 distinct sources. 35.80.21.128 was first reported on October 14th 2026, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 WinterGateIC	2026-10-17 00:07:57 (10 hours ago)	SSH handshake — protocol/banner capture \| Stage 1 (Reconnaissance) \| Category: SSH Enumeration \| ATT ... show more SSH handshake — protocol/banner capture \| Stage 1 (Reconnaissance) \| Category: SSH Enumeration \| ATT&CK:T1021.004 (SSH) \| via ssh:// \| at edge perimeter \| ssh_client=SSH-2.0-paramiko_3.4.1 \| raw=Client: SSH-2.0-paramiko_3.4.1 \| src_port=22 ASN=AS16509 attempts=58 sev=high conf=45% as=AMAZON-02 org=AWS EC2 (us-west-2) geo=US/Boardman rdns=ec2-35-80-21-128.us-west-2.compute.amazonaws.com infra=hosting usage=Data_Center/Web_Hosting/Transit sensor=honeypot active=10-16 23:08..10-17 00:07Z \| 20 correlated nodes campaign=camp_000d cohort=20ips NOVEL_PAYLOAD fp=6953728bbe7e \| 2026-10-17 00:07:57 UTC report#48 [community: convicted=100%] [zero-day candidate, with prior observed variants] [BOTNET: 20] show less	SSH Port Scan Hacking
🇮🇱 spd.co.il	2026-10-17 00:02:30 (10 hours ago)	Unauthorized access attempts on ports: 22	Brute-Force SSH
🇩🇪 WinterGateIC	2026-10-16 20:43:41 (14 hours ago)	SSH handshake — protocol/banner capture \| Stage 1 (Reconnaissance) \| Category: SSH Enumeration \| ATT ... show more SSH handshake — protocol/banner capture \| Stage 1 (Reconnaissance) \| Category: SSH Enumeration \| ATT&CK:T1021.004 (SSH) \| via ssh:// \| at edge perimeter \| ssh_client=SSH-2.0-paramiko_3.4.1 \| raw=Client: SSH-2.0-paramiko_3.4.1 \| src_port=22 ASN=AS16509 sev=critical conf=45% as=AMAZON-02 org=AWS EC2 (us-west-2) geo=US/Boardman rdns=ec2-35-80-21-128.us-west-2.compute.amazonaws.com infra=hosting usage=Data_Center/Web_Hosting/Transit sensor=honeypot active=10-16 20:43..20:43Z \| NOVEL_PAYLOAD fp=6953728bbe7e \| 2026-10-16 20:43:41 UTC report#37 [community: convicted=100%] [zero-day candidate, correlated with prior observed variants] show less	SSH Port Scan Hacking
🇪🇸 raiolanetworks.com	2026-10-15 04:46:06 (2 days ago)	Honeypot detection: SSH/Telnet brute-force. 2 events observed. Reported automatically from a honeypo ... show more Honeypot detection: SSH/Telnet brute-force. 2 events observed. Reported automatically from a honeypot sensor. show less	Brute-Force SSH
🇫🇷 edoram	2026-10-15 04:07:02 (2 days ago)	SSH brute-force from honeypot. 32 attempts in 24h, 0 unique usernames tried.	Brute-Force SSH
🇧🇷 Douglas Jorge	2026-10-15 04:00:23 (2 days ago)	Repeated failed SSH authentication; blocked by local Fail2ban sshd jail.	Brute-Force SSH
🇩🇪 Riko	2026-10-15 04:00:07 (2 days ago)	Fail2ban SSH Bruteforce	Brute-Force SSH
🇫🇮 hellasleeper	2026-10-15 03:35:47 (2 days ago)	SSH honeypot attacker (Cowrie) on Hermes-NOC	Port Scan Brute-Force
🇷🇺 Reaper	2026-10-15 03:20:48 (2 days ago)	SSH abuse or brute-force attack from 35.80.21.128	Brute-Force SSH
🇳🇱 ras07	2026-10-15 03:00:06 (2 days ago)	Brute force SSH login attempts.	Brute-Force SSH
🇩🇪 SiyCah	2026-10-15 03:00:02 (2 days ago)	35.80.21.128 fell into Endlessh tarpit; 0/8 total connections are currently still open. Total time w ... show more 35.80.21.128 fell into Endlessh tarpit; 0/8 total connections are currently still open. Total time wasted: 1m 36s. Total bytes sent by tarpit: 10.00KiB. Report generated by Endlessh Report Generator v1.2.3 show less	Brute-Force Port Scan SSH Hacking
🇯🇵 CowGL	2026-10-15 02:57:40 (2 days ago)	2026-10-15T02:57:33.796695cowgrassland sshd[2329084]: Connection closed by 35.80.21.128 port 60662 [ ... show more 2026-10-15T02:57:33.796695cowgrassland sshd[2329084]: Connection closed by 35.80.21.128 port 60662 [preauth] 2026-10-15T02:57:36.272026cowgrassland sshd[2329091]: Connection closed by 35.80.21.128 port 60672 [preauth] 2026-10-15T02:57:36.598786cowgrassland sshd[2329122]: Unable to negotiate with 35.80.21.128 port 60684: no matching host key type found. Their offer: ecdsa-sha2-nistp384,[email protected] [preauth] 2026-10-15T02:57:38.306590cowgrassland sshd[2329126]: Unable to negotiate with 35.80.21.128 port 60690: no matching host key type found. Their offer: ecdsa-sha2-nistp521,[email protected] [preauth] show less	Brute-Force SSH
🇬🇧 VA567	2026-10-15 02:44:54 (2 days ago)	SSH brute force (fail2ban)	Brute-Force SSH
🇩🇪 vanlueckn	2026-10-15 02:19:41 (2 days ago)	2026-10-15T02:19:39.542435+00:00 active-hunting.de sshd[565935]: Connection closed by 35.80.21.128 p ... show more 2026-10-15T02:19:39.542435+00:00 active-hunting.de sshd[565935]: Connection closed by 35.80.21.128 port 50934 [preauth] 2026-10-15T02:19:40.579080+00:00 active-hunting.de sshd[565955]: Connection closed by 35.80.21.128 port 50948 [preauth] 2026-10-15T02:19:41.103412+00:00 active-hunting.de sshd[565960]: Unable to negotiate with 35.80.21.128 port 40166: no matching host key type found. Their offer: ecdsa-sha2-nistp384,[email protected] [preauth] ... show less	Brute-Force SSH
🇫🇷 Melua	2026-10-15 02:00:03 (2 days ago)	Attempted connection to SSH tarpit	Brute-Force SSH

Showing 1 to 15 of 63 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.252.182.210

🇺🇸 172.252.119.102

🇺🇸 172.121.117.236

🇩🇪 167.94.145.20

🇨🇳 121.229.202.143

🇮🇩 103.172.20.218

🇵🇰 103.113.102.3

🇫🇷 91.231.89.180

🇫🇷 91.196.152.20

🇺🇸 65.49.1.163

🇺🇸 65.49.1.162

🇭🇰 219.77.169.219

🇮🇳 210.212.136.3

🇹🇼 198.235.24.3

🇩🇪 195.182.16.23

🇺🇸 162.216.150.207

🇺🇸 162.216.149.178

🇮🇹 151.77.237.150

🇨🇳 117.50.70.169

🇧🇩 103.159.2.113