This IP address has been reported a total of
99
times from
88 distinct
sources.
109.199.120.203 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 19
reports;
United States of America
with 19
reports;
France
with 11
reports.
The most common categories in these recent reports were:
Web App Attack
50
times;
Brute-Force
28
times;
Port Scan
27
times;
Hacking
21
times;
SSH
17
times;
Other
18
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
This IP address carried out 2 SSH credential attack (attempts) on 12-10-2026. For more information o ...
show moreThis IP address carried out 2 SSH credential attack (attempts) on 12-10-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter.
show less
2026-10-13T03:46:44.016314+09:00 xtom-vm-cloud-2c1g-nrt sshd-session[949627]: Invalid user admin fro ...
show more2026-10-13T03:46:44.016314+09:00 xtom-vm-cloud-2c1g-nrt sshd-session[949627]: Invalid user admin from 109.199.120.203 port 59066
2026-10-13T03:47:18.558608+09:00 xtom-vm-cloud-2c1g-nrt sshd-session[949655]: Invalid user user from 109.199.120.203 port 59232
2026-10-13T03:48:44.022556+09:00 xtom-vm-cloud-2c1g-nrt sshd-session[949745]: Invalid user user from 109.199.120.203 port 59664
...
show less
[Honeypot Report] Unauthorised shell access and command execution via Telnet
A remote host attempte ...
show more[Honeypot Report] Unauthorised shell access and command execution via Telnet
A remote host attempted to log in to our emulated Telnet service, then obtained shell access and executed commands.
Observed: 2026-10-12 17:06 to 2026-10-12 17:07 UTC | 1 session | 20 events | Telnet (port 23)
Attack chain:
1. 1 credential attempt: admin/admin
2. Shell access obtained; 16 distinct commands executed: id ; cat /etc/passwd ; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"
Technique: CWE-78 OS command injection | Signatures: Host Reconnaissance Commands, Download-and-Execute Payload Chain
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/109.199.120.203.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
Brute-Force
Anonymous
Attempted access to sensitive endpoint (/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php) de ...
show moreAttempted access to sensitive endpoint (/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php) detected. Automated scan or unauthorized probing.
show less
