This IP address has been reported a total of
14
times from
12 distinct
sources.
120.26.54.238 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
France
with 3
reports;
Brazil
with 2
reports;
Germany
with 2
reports.
The most common categories in these recent reports were:
SSH
8
times;
Brute-Force
8
times;
Port Scan
5
times;
FTP Brute-Force
1
time;
Hacking
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
This IP address carried out 2 SSH credential attack (attempts) on 12-10-2026. For more information o ...
show moreThis IP address carried out 2 SSH credential attack (attempts) on 12-10-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter.
show less
Fail2ban ban on jail 'sshd'. Repeated failed authentication attempts against a monitored host. Detec ...
show moreFail2ban ban on jail 'sshd'. Repeated failed authentication attempts against a monitored host. Detected and correlated by Wazuh SIEM (rule 100110, level 10). Reported automatically.
show less
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted m ...
show more[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-10-11 16:00 UTC | 2 sessions | 6 events | SSH (port 2222)
Attack chain:
1. 2 credential attempts: root/---fuck_you----, root/123456
2. Shell access obtained; 1 distinct command executed: uname -s -m
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/120.26.54.238.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
SSH
Brute-Force
Anonymous
2026-10-11T11:48:33.452004+00:00 arrow-de-ru1 sshd-session[285697]: Failed password for root from 12 ...
show more2026-10-11T11:48:33.452004+00:00 arrow-de-ru1 sshd-session[285697]: Failed password for root from 120.26.54.238 port 40560 ssh2
2026-10-11T11:48:35.577732+00:00 arrow-de-ru1 sshd-session[285700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.26.54.238 user=root
2026-10-11T11:48:37.404077+00:00 arrow-de-ru1 sshd-session[285700]: Failed password for root from 120.26.54.238 port 33984 ssh2
...
show less
Oct 11 11:43:52 SKYCITYRP sshd[99197]: Failed password for root from 120.26.54.238 port 60826 ssh2
O ...
show moreOct 11 11:43:52 SKYCITYRP sshd[99197]: Failed password for root from 120.26.54.238 port 60826 ssh2
Oct 11 11:43:56 SKYCITYRP sshd[99199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.26.54.238 user=root
Oct 11 11:43:58 SKYCITYRP sshd[99199]: Failed password for root from 120.26.54.238 port 59744 ssh2
Oct 11 11:44:03 SKYCITYRP sshd[99201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.26.54.238 user=root
Oct 11 11:44:04 SKYCITYRP sshd[99201]: Failed password for root from 120.26.54.238 port 59752 ssh2
Oct 11 11:44:07 SKYCITYRP sshd[99203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.26.54.238 user=root
Oct 11 11:44:10 SKYCITYRP sshd[99203]: Failed password for root from 120.26.54.238 port 43302 ssh2
...
show less
Fail2ban ban on jail 'sshd'. Repeated failed authentication attempts against a monitored host. Detec ...
show moreFail2ban ban on jail 'sshd'. Repeated failed authentication attempts against a monitored host. Detected and correlated by Wazuh SIEM (rule 100110, level 10). Reported automatically.
show less
2026-10-10T16:49:35.642573+00:00 seraph sshd[3842130]: Failed password for invalid user root from 12 ...
show more2026-10-10T16:49:35.642573+00:00 seraph sshd[3842130]: Failed password for invalid user root from 120.26.54.238 port 42278 ssh2
2026-10-10T16:49:38.036543+00:00 seraph sshd[3842182]: User root from 120.26.54.238 not allowed because not listed in AllowUsers
2026-10-10T16:49:38.417223+00:00 seraph sshd[3842182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.26.54.238 user=root
2026-10-10T16:49:40.430401+00:00 seraph sshd[3842182]: Failed password for invalid user root from 120.26.54.238 port 46236 ssh2
2026-10-10T16:49:43.476565+00:00 seraph sshd[3842227]: User root from 120.26.54.238 not allowed because not listed in AllowUsers
...
show less
