|
🇫🇮
Birdo
|
|
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Crede ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), DrayTek router.
Observed: 2026-09-14 20:00 to 2026-09-22 19:16 UTC | 2,977 sessions | 47,435 events | Telnet (port 23)
Attack chain:
1. 2,972 credential attempts: root/GM8182, root/hg2x0, root/pass, root/12345, root/xc3511 (+35 more pairs)
2. Shell access obtained; 15 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://42.7.139.85:48486/i, http://42.55.220.149:55031/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/119.114.166.99.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
|
Exploited Host
Hacking
IoT Targeted
Brute-Force
|
|
🇺🇸
RAP
|
|
2026-09-20 14:30:42 UTC Unauthorized activity to TCP port 23. Telnet
|
Port Scan
|
|
🇦🇹
begou.dev
|
|
[Threat Intelligence] Port Scanning and/or Unauthorized access -> TCP/23
|
Port Scan
|
|
Anonymous
|
|
denied Telnet-like access attempt. destination port 2323.
|
Port Scan
Brute-Force
|
|
🇺🇸
MPL
|
|
tcp/23 (2 or more attempts)
|
Port Scan
|
|
🇺🇸
RAP
|
|
2026-09-18 09:17:25 UTC Unauthorized activity to TCP port 23. Telnet
|
Port Scan
|
|
🇺🇸
MPL
|
|
tcp/23
|
Port Scan
|
|
🇺🇸
cybsecaoccol
|
|
multiple malicious connection attempts on tcp port 23 - dr
|
DDoS Attack
Port Scan
Hacking
Brute-Force
|
|
🇫🇮
Birdo
|
|
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Crede ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), DrayTek router.
Observed: 2026-09-14 20:00 to 2026-09-15 00:01 UTC | 73 sessions | 1,168 events | Telnet (port 23)
Attack chain:
1. 73 credential attempts: root/GM8182, Administrator/admin, admin/aquario, root/12345, cht/chtngpon (+35 more pairs)
2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://42.7.139.85:48486/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/119.114.166.99.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
|
Exploited Host
Hacking
IoT Targeted
Brute-Force
|
|
🇰🇷
2048
|
|
Telnet credential brute-force observed by honeypot. | Source IP: 119.114.166.99 | Targeted device: OpenWrt router | First seen: 14 Sep 2026 23:46:24 UTC | Last seen: 14 Sep 2026 23:49:00 UTC | Attempts: 24 | Sample credentials: admin1:password, root: ...
show more
Telnet credential brute-force observed by honeypot. | Source IP: 119.114.166.99 | Targeted device: OpenWrt router | First seen: 14 Sep 2026 23:46:24 UTC | Last seen: 14 Sep 2026 23:49:00 UTC | Attempts: 24 | Sample credentials: admin1:password, root:1234, root:root, root:25802580, admin:admin1234, admin:chzhdpl, root:12345678, e8telnet:e8telnet, admin:7ujMko0admin, admin:GeNeXiS@19
show less
|
Brute-Force
IoT Targeted
|
