This IP address has been reported a total of
633
times from
231 distinct
sources.
80.113.20.70 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 24
reports;
United States of America
with 16
reports;
Netherlands
with 4
reports.
The most common categories in these recent reports were:
Brute-Force
47
times;
SSH
43
times;
Port Scan
11
times;
Hacking
6
times;
Exploited Host
3
times;
Other
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-10-12T10:10:00.121089+00:00 erdbeerbaerlp.de sshd[3735571]: Invalid user ubuntu from 80.113.20. ...
show more2026-10-12T10:10:00.121089+00:00 erdbeerbaerlp.de sshd[3735571]: Invalid user ubuntu from 80.113.20.70 port 49448
2026-10-12T10:15:17.892665+00:00 erdbeerbaerlp.de sshd[3926633]: Invalid user admin from 80.113.20.70 port 36336
2026-10-12T10:15:22.997162+00:00 erdbeerbaerlp.de sshd[3929682]: Invalid user ec2-user from 80.113.20.70 port 37538
...
show less
2026-10-12T11:32:37.381969+03:00 gre sshd-session[344795]: Invalid user ubuntu from 80.113.20.70 por ...
show more2026-10-12T11:32:37.381969+03:00 gre sshd-session[344795]: Invalid user ubuntu from 80.113.20.70 port 44756
...
show less
Fail2Ban SSH brute-force ban on bebricow.hostes.io. jail=sshd; source=fail2ban; no raw log lines inc ...
show moreFail2Ban SSH brute-force ban on bebricow.hostes.io. jail=sshd; source=fail2ban; no raw log lines included.
show less
SSH login used username hadoop with password _i!vJ3=t#d2Tc+T over SSH-2.0-Go. After login, the sessi ...
show moreSSH login used username hadoop with password _i!vJ3=t#d2Tc+T over SSH-2.0-Go. After login, the session enumerated CPU/process activity with /proc/cpuinfo and ps commands, then searched for running astats and kstats processes. The actor attempted persistence by checking crontab and adding an @reboot entry for /dev/shm/w.sh with arguments "astats" "netai", "kstats", "ssh 2 az". It created/overwrote files via cat > in writable locations, including /dev/shm/w.sh, astats, and kstats, then set execute permissions on w.sh. The session also issued cleanup/anti-forensics commands removing shell history and log files such as .bash_history, utmp, wtmp, lastlog, secure, and yum.log. No downloads, port forwards, lateral movement, or dropped-file artifacts were observed in the provided activity.
show less
Single SSH session from SSH-2.0-Go using credential ubuntu/ef@+tj-YUbvcQr-. The actor enumerated CPU ...
show moreSingle SSH session from SSH-2.0-Go using credential ubuntu/ef@+tj-YUbvcQr-. The actor enumerated CPU count and top processes, then searched for and managed files named astats, kstats, and w.sh under writable locations. They created /tmp/w.sh, marked it executable, and checked for existing processes matching astats and kstats while excluding system services. Persistence was attempted by reading the crontab and adding an @reboot entry to execute /tmp/w.sh with arguments "astats" "netai" "kstats" and "ssh 2 az". Cleanup commands removed shell history and log files including /var/run/utmp, /var/run/wtmp, /var/log/lastlog, /home/yum.log, /var/log/wtmp, and /var/log/secure. The session shows download/deployment staging, cron-based persistence, process checks, and log wiping.
show less
2026-10-10T19:04:58.053147+02:00 rahona.network sshd-session[3001062]: Failed password for invalid u ...
show more2026-10-10T19:04:58.053147+02:00 rahona.network sshd-session[3001062]: Failed password for invalid user admin from 80.113.20.70 port 34210 ssh2
2026-10-10T19:05:10.715269+02:00 rahona.network sshd-session[3001102]: Invalid user ubuntu from 80.113.20.70 port 36400
2026-10-10T19:05:11.683132+02:00 rahona.network sshd-session[3001102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.113.20.70
2026-10-10T19:05:14.306303+02:00 rahona.network sshd-session[3001102]: Failed password for invalid user ubuntu from 80.113.20.70 port 36400 ssh2
show less
