IP address

Passive DNS

Tags: Scanner

IP blacklists

CI Army

80.82.70.118 is listed on the CI Army blacklist.

Description: Collective Intelligence Network Security is a Threat Intelligence database that provides scores for IPs. Source of unspecified malicious attacks most of them will be active attackers/scanners
Type of feed: primary (feed detail page)

Last checked at: 2026-02-16 03:50:00.943000
Was present on blacklist at: 2026-02-05 03:50, 2026-02-06 03:50, 2026-02-07 03:50, 2026-02-08 03:50, 2026-02-09 03:50, 2026-02-11 03:50, 2026-02-12 03:50, 2026-02-13 03:50, 2026-02-14 03:50, 2026-02-15 03:50, 2026-02-16 03:50

AbuseIPDB

80.82.70.118 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc. Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-02-15 05:00:00.570000
Was present on blacklist at: 2026-02-05 05:00, 2026-02-06 05:00, 2026-02-07 05:00, 2026-02-08 05:00, 2026-02-09 05:00, 2026-02-10 05:00, 2026-02-11 05:00, 2026-02-12 05:00, 2026-02-13 05:00, 2026-02-14 05:00, 2026-02-15 05:00

LightScope

80.82.70.118 is listed on the LightScope blacklist.

Description: LightScope observes traffic sent to closed ports on production machines
Type of feed: primary (feed detail page)

Last checked at: 2026-02-16 10:30:01.239000
Was present on blacklist at: 2026-02-05 10:30, 2026-02-06 10:30, 2026-02-07 10:30, 2026-02-08 10:30, 2026-02-09 10:30, 2026-02-10 10:30, 2026-02-11 10:30, 2026-02-12 10:30, 2026-02-13 10:30, 2026-02-14 10:30, 2026-02-15 10:30, 2026-02-16 10:30

DataPlane VNC RFB

80.82.70.118 is listed on the DataPlane VNC RFB blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds, and measurement resource for operators, by operators. IPs initiating an unsolicited VNC remote frame buffer (RFB) session to a remote host.
Type of feed: primary (feed detail page)

Last checked at: 2026-02-17 03:10:00.751000
Was present on blacklist at: 2026-02-05 15:10, 2026-02-05 19:10, 2026-02-05 23:10, 2026-02-06 03:10, 2026-02-06 07:10, 2026-02-06 11:10, 2026-02-06 15:10, 2026-02-06 19:10, 2026-02-06 23:10, 2026-02-07 03:10, 2026-02-07 07:10, 2026-02-07 11:10, 2026-02-07 15:10, 2026-02-07 19:10, 2026-02-07 23:10, 2026-02-08 03:10, 2026-02-08 07:10, 2026-02-08 11:10, 2026-02-08 15:10, 2026-02-08 19:10, 2026-02-08 23:10, 2026-02-09 03:10, 2026-02-09 07:10, 2026-02-09 11:10, 2026-02-09 15:10, 2026-02-09 19:10, 2026-02-09 23:10, 2026-02-10 03:10, 2026-02-10 07:10, 2026-02-10 11:10, 2026-02-10 15:10, 2026-02-10 19:10, 2026-02-10 23:10, 2026-02-11 03:10, 2026-02-11 07:10, 2026-02-11 11:10, 2026-02-11 15:10, 2026-02-11 19:10, 2026-02-11 23:10, 2026-02-12 03:10, 2026-02-12 07:10, 2026-02-12 11:10, 2026-02-12 15:10, 2026-02-12 19:10, 2026-02-12 23:10, 2026-02-13 03:10, 2026-02-13 07:10, 2026-02-13 11:10, 2026-02-13 15:10, 2026-02-13 19:10, 2026-02-13 23:10, 2026-02-14 03:10, 2026-02-14 07:10, 2026-02-14 11:10, 2026-02-14 15:10, 2026-02-14 19:10, 2026-02-14 23:10, 2026-02-15 03:10, 2026-02-15 07:10, 2026-02-15 11:10, 2026-02-15 15:10, 2026-02-15 19:10, 2026-02-15 23:10, 2026-02-16 03:10, 2026-02-16 07:10, 2026-02-16 11:10, 2026-02-16 15:10, 2026-02-16 19:10, 2026-02-16 23:10, 2026-02-17 03:10

Threat categories

TL	Role	Category	Details
50	src	scan	port: many

Warden events (3444)

2026-02-15: ReconScanning (node.4dc198): 27; ReconScanning (node.9c1411): 10
2026-02-14: ReconScanning (node.4dc198): 253; ReconScanning (node.9c1411): 60
2026-02-12: ReconScanning (node.368407): 103; ReconScanning (node.4dc198): 213; ReconScanning (node.9c1411): 54
2026-02-11: ReconScanning (node.368407): 180; ReconScanning (node.4dc198): 288; ReconScanning (node.9c1411): 76
2026-02-10: ReconScanning (node.4dc198): 287; ReconScanning (node.9c1411): 77; ReconScanning (node.368407): 65
2026-02-09: ReconScanning (node.9c1411): 58; ReconScanning (node.4dc198): 287
2026-02-08: ReconScanning (node.9c1411): 66; ReconScanning (node.4dc198): 286; ReconScanning (node.368407): 15
2026-02-07: ReconScanning (node.4dc198): 212; ReconScanning (node.9c1411): 54; ReconScanning (node.368407): 14
2026-02-06: ReconScanning (node.4dc198): 214; ReconScanning (node.9c1411): 69; ReconScanning (node.368407): 3
2026-02-05: ReconScanning (node.4dc198): 286; ReconScanning (node.9c1411): 64
2026-02-04: ReconScanning (node.4dc198): 102; ReconScanning (node.9c1411): 21

Origin AS: AS29073 - QUASINETWORKS; AS202425 - INT-NETWORK
BGP Prefix: 80.82.70.0/24
geo: Seychelles, Anse aux Pins; 🕑 Indian/Mahe
hostname: rnd.group-ib.com
Address block ('inetnum' or 'NetRange' in whois database): 80.82.64.0 - 80.82.79.255
last_activity: 2026-02-15 02:21:58
last_warden_event: 2026-02-15 02:21:58
rep: 0.6142857142857142
reserved_range: 0
ts_added: 2026-02-04 15:30:50.116000
ts_last_update: 2026-02-17 03:11:16.336000

Warden event timeline

DShield event timeline

Presence on blacklists