The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse.
Malware botnet controller located at 20.113.26.85 on port 8808 TCP:
$ telnet 20.113.26.85 8808
Trying 20.113.26.85…
Connected to 20.113.26.85.
Escape character is ‘^]’
$ dig +short helpserver.ddns.net
20.113.26.85
Referencing malware samples (MD5 hash):
b45d6724ff9c0ab179be572d4fbde103 — AV detection: 40 / 68 (58.82%)