JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.20.135.238

65.20.135.238

Recent Activity

225 reports found in our database

87% ▲ ▲ ▲ Critical

Abuse confidence score ?

ISP

Earthlink Telecommunications Equipment Trading & Services DMCC

Usage Type

Fixed Line ISP

ASN

AS203214

Domain Name

earthlink.iq

Country

🇮🇶 Iraq

City

Baghdad, Baghdad

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 65.20.135.238:

This IP address has been reported a total of 225 times from 87 distinct sources. 65.20.135.238 was first reported on July 30th 2025, and the most recent report was 1 hour ago. In the last 60 days, the top reporter locations were: Germany with 19 reports; Indonesia with 6 reports; Australia with 2 reports. The most common categories in these recent reports were: Brute-Force 34 times; Hacking 10 times; Web App Attack 7 times; Port Scan 6 times; Email Spam 2 times; Other 7 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 interbiznw.com	2026-09-05 09:57:19 (1 hour ago)	dovecot-bruteforce	Port Scan Hacking Spoofing Brute-Force Exploited Host
🇩🇪 FeG Deutschland	2026-09-04 19:58:10 (15 hours ago)	Mail: - login with unknown user - bruteforce	Brute-Force
Anonymous	2026-09-02 09:22:49 (3 days ago)	2026-09-01 09:59:34,974 INFO [ImapSSLServer-391] [ip=192.168.1.235;oip=65.20.135.238;via=192.168.1. ... show more 2026-09-01 09:59:34,974 INFO [ImapSSLServer-391] [ip=192.168.1.235;oip=65.20.135.238;via=192.168.1.235(nginx/1.20.0);ua=Zimbra/8.8.15_GA_4717;cid=2734;] imap - authentication failed for [[email protected]] (invalid password) 2026-09-01 09:59:34,974 INFO [ImapSSLServer-391] [ip=192.168.1.235;oip=65.20.135.238;via=192.168.1.235(nginx/1.20.0);ua=Zimbra/8.8.15_GA_4717;cid=2734;] account - Error occurred during authentication: authentication failed for [[email protected]]. Reason: invalid password. 2026-09-02 09:22:49,221 INFO [ImapSSLServer-467] [ip=192.168.1.235;oip=65.20.135.238;via=192.168.1.235(nginx/1.20.0);ua=Zimbra/8.8.15_GA_4717;cid=3029;] account - Error occurred during authentication: authentication failed for [[email protected]]. Reason: invalid password. 2026-09-02 09:22:49,221 INFO [ImapSSLServer-467] [ip=192.168.1.235;oip=65.20.135.238;via=192.168.1.235(nginx/1.20.0);ua=Zimbra/8.8.15_GA_4717;cid=3029;] imap - authentication failed for [[email protected]] (inva ... show less	Brute-Force Web App Attack
🇵🇦 iphezimbra	2026-08-30 08:16:19 (6 days ago)	Fail2Ban reported IP from jail zimbra-web on <hostname>	Brute-Force SSH
Anonymous	2026-08-28 16:05:24 (1 week ago)	Repeated inbound connection attempts blocked by firewall. Observed at least twice within 24 hours.	Hacking
🇩🇪 initsol	2026-08-27 16:38:51 (1 week ago)	2026-08-27T18:38:33.352575+02:00 phoenix auth[139452]: pam_unix(dovecot:auth): authentication failur ... show more 2026-08-27T18:38:33.352575+02:00 phoenix auth[139452]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=leitstand rhost=65.20.135.238 2026-08-27T18:38:42.454601+02:00 phoenix auth[139452]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=leitstand rhost=65.20.135.238 2026-08-27T18:38:50.599041+02:00 phoenix auth[139452]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=leitstand rhost=65.20.135.238 ... show less	Brute-Force
🇩🇪 itak	2026-08-26 11:28:29 (1 week ago)	IMAP SASL Brute-Force Attack	Port Scan Hacking Brute-Force
🇩🇪 IP Analyzer	2026-08-24 19:30:14 (1 week ago)	Unauthorized connection attempt from IP address 65.20.135.238 on Port 993(IMAP)	Port Scan
🇩🇪 IP Analyzer	2026-08-24 19:10:47 (1 week ago)	Unauthorized connection attempt from IP address 65.20.135.238	Brute-Force
🇺🇸 kosada.com	2026-08-24 16:11:22 (1 week ago)	IMAP password guessing	Brute-Force
🇩🇪 FeG Deutschland	2026-08-22 10:30:01 (2 weeks ago)	Mail: - login with unknown user - bruteforce	Brute-Force
🇳🇴 jlouisbiz	2026-08-21 20:10:40 (2 weeks ago)	2026-08-21T20:10:18.064829+00:00 comm.rcdrun.com auth[1344929]: pam_unix(dovecot:auth): authenticati ... show more 2026-08-21T20:10:18.064829+00:00 comm.rcdrun.com auth[1344929]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [email protected] rhost=65.20.135.238 2026-08-21T20:10:34.717655+00:00 comm.rcdrun.com auth[1344929]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [email protected] rhost=65.20.135.238 2026-08-21T20:10:39.458688+00:00 comm.rcdrun.com auth[1345344]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [email protected] rhost=65.20.135.238 ... show less	Brute-Force
🇩🇪 cybertailor	2026-08-20 07:49:02 (2 weeks ago)	Aug 20 12:48:53 sysrq dovecot: auth: ldap(zchxzcahxmwshxf3,65.20.135.238,<qjdRwHVZfaFBFIfu>): Passwo ... show more Aug 20 12:48:53 sysrq dovecot: auth: ldap(zchxzcahxmwshxf3,65.20.135.238,<qjdRwHVZfaFBFIfu>): Password mismatch (for LDAP bind) Aug 20 12:49:01 sysrq dovecot: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 9 secs): user=<zchxzcahxmwshxf3>, method=PLAIN, rip=65.20.135.238, lip=192.168.1.99, TLS, session=<qjdRwHVZfaFBFIfu> ... show less	Brute-Force
🇩🇪 FeG Deutschland	2026-08-19 13:56:16 (2 weeks ago)	Mail: - login with unknown user - bruteforce	Brute-Force
🇩🇪 ksol-hostmaster	2026-08-18 00:55:34 (2 weeks ago)	Aug 18 02:55:33 ksol dovecot[99639]: auth-worker(90079): conn unix:auth-worker (uid=143): auth-worke ... show more Aug 18 02:55:33 ksol dovecot[99639]: auth-worker(90079): conn unix:auth-worker (uid=143): auth-worker<1>: sql(anonymized@email,65.20.135.238,<dK9zvkdZGdtBFIfu>): Password mismatch (given password: I-AM-A-SUCKER-USING-A-WRONG-PASSWORD) ... show less	Brute-Force

Showing 1 to 15 of 225 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 200.130.0.11

🇨🇴 200.31.13.28

🇹🇷 195.142.175.196

🇹🇷 194.127.117.45

🇳🇱 176.65.149.230

🇮🇩 139.255.101.222

🇳🇱 108.142.112.23

🇮🇳 103.104.73.30

🇮🇩 103.97.202.163

🇳🇱 91.92.40.27

🇦🇪 86.96.195.223

🇫🇷 46.105.31.171

🇺🇸 35.237.32.156

🇺🇸 23.95.191.253

🇩🇪 2a01:4f8:c2c:ec7a::1

🇧🇷 200.250.0.45

🇵🇾 200.61.51.82

🇭🇰 199.45.155.30

🇪🇸 195.235.65.206

🇨🇱 190.215.51.15