Total reports
3 from
2 distinct
reporters
First reported
Most recent report
Old reports
The most recent abuse report for this IP address is from
.
It is possible that this IP is no longer involved in abusive activities.
| Reporter |
IoA Timestamp (UTC)
|
Comment |
Categories |
|
🇫🇮
Birdo
|
|
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Crede ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), DrayTek router.
Observed: 2026-10-11 09:57 to 2026-10-14 02:28 UTC | 838 sessions | 13,100 events | Telnet (port 23)
Attack chain:
1. 818 credential attempts: 666666/666666, service/service, admin/chzhdpl, CUAdmin/CUAdmin, root/system (+35 more pairs)
2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://123.129.32.65:44603/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/125.41.226.121.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
|
Exploited Host
Hacking
IoT Targeted
Brute-Force
|
|
Anonymous
|
|
denied Telnet access attempt. destination port 23.
|
Port Scan
Brute-Force
|
|
🇫🇮
Birdo
|
|
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Crede ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal.
Observed: 2026-10-11 09:57 to 2026-10-11 11:58 UTC | 26 sessions | 390 events | Telnet (port 23)
Attack chain:
1. 26 credential attempts: 666666/666666, root/hme12345, admin/vnpt, root/xmhdipc, root/1234 (+13 more pairs)
2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://123.129.32.65:44603/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/125.41.226.121.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
|
Exploited Host
Hacking
IoT Targeted
Brute-Force
|
