This IP address has been reported a total of
43
times from
42 distinct
sources.
139.129.24.29 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Report 2686214 with IP 3733781 for SSH brute-force attack by source 3728439 via ssh-honeypot/0.2.0+h ...
show moreReport 2686214 with IP 3733781 for SSH brute-force attack by source 3728439 via ssh-honeypot/0.2.0+http
show less
2026-09-17T03:01:34.852680+00:00 de-milk-fsn01-100 sshd[2527329]: Invalid user ubnt from 139.129.24. ...
show more2026-09-17T03:01:34.852680+00:00 de-milk-fsn01-100 sshd[2527329]: Invalid user ubnt from 139.129.24.29 port 36702
2026-09-17T03:01:36.320609+00:00 de-milk-fsn01-100 sshd[2527332]: Invalid user mysql from 139.129.24.29 port 36714
2026-09-17T03:01:38.100679+00:00 de-milk-fsn01-100 sshd[2527379]: Invalid user user from 139.129.24.29 port 36740
2026-09-17T03:01:39.248969+00:00 de-milk-fsn01-100 sshd[2527402]: Invalid user deploy from 139.129.24.29 port 36748
2026-09-17T03:01:41.374333+00:00 de-milk-fsn01-100 sshd[2527406]: Invalid user moxa from 139.129.24.29 port 36828
...
show less
2026-09-17T01:57:13.936086+00:00 do sshd[3626656]: Invalid user ubnt from 139.129.24.29 port 49010
2 ...
show more2026-09-17T01:57:13.936086+00:00 do sshd[3626656]: Invalid user ubnt from 139.129.24.29 port 49010
2026-09-17T01:57:17.304945+00:00 do sshd[3626668]: Connection from 139.129.24.29 port 49046 on 178.62.4.87 port 22 rdomain ""
2026-09-17T01:57:18.282061+00:00 do sshd[3626668]: Invalid user user from 139.129.24.29 port 49046
2026-09-17T01:57:18.759392+00:00 do sshd[3626670]: Connection from 139.129.24.29 port 49050 on 178.62.4.87 port 22 rdomain ""
2026-09-17T01:57:19.664750+00:00 do sshd[3626670]: Invalid user deploy from 139.129.24.29 port 49050
...
show less
2026-09-16T07:40:08.967350+00:00 az100-jp sshd[715259]: Invalid user vpsuser from 139.129.24.29 port ...
show more2026-09-16T07:40:08.967350+00:00 az100-jp sshd[715259]: Invalid user vpsuser from 139.129.24.29 port 49582
2026-09-16T07:40:09.347595+00:00 az100-jp sshd[715261]: Invalid user ansible from 139.129.24.29 port 56100
2026-09-16T07:40:09.633631+00:00 az100-jp sshd[715263]: Invalid user ubnt from 139.129.24.29 port 56112
2026-09-16T07:40:10.021601+00:00 az100-jp sshd[715265]: Invalid user mysql from 139.129.24.29 port 56122
2026-09-16T07:40:10.640155+00:00 az100-jp sshd[715269]: Invalid user user from 139.129.24.29 port 56132
...
show less
SSH brute-force / unauthorized pre-auth probing against production node Manual-Audit. Filtered & dro ...
show moreSSH brute-force / unauthorized pre-auth probing against production node Manual-Audit. Filtered & dropped by iptables. Raw audit:
Manual audit command trigger
show less
Sep 15 14:33:41 synth sshd[4103553]: Invalid user vpsuser from 139.129.24.29 port 45356
Sep 15 14:33 ...
show moreSep 15 14:33:41 synth sshd[4103553]: Invalid user vpsuser from 139.129.24.29 port 45356
Sep 15 14:33:42 synth sshd[4103555]: Invalid user ansible from 139.129.24.29 port 45368
Sep 15 14:33:43 synth sshd[4103557]: Invalid user ubnt from 139.129.24.29 port 45382
Sep 15 14:33:44 synth sshd[4103578]: Invalid user mysql from 139.129.24.29 port 45390
Sep 15 14:33:47 synth sshd[4103602]: Invalid user user from 139.129.24.29 port 45412
Sep 15 14:33:48 synth sshd[4103604]: Invalid user deploy from 139.129.24.29 port 45422
Sep 15 14:33:50 synth sshd[4103606]: Invalid user git from 139.129.24.29 port 50274
Sep 15 14:33:51 synth sshd[4103608]: Invalid user moxa from 139.129.24.29 port 50280
Sep 15 14:33:52 synth sshd[4103610]: Invalid user steam from 139.129.24.29 port 50284
Sep 15 14:33:57 synth sshd[4103636]: Invalid user ubuntu from 139.129.24.29 port 50330
...
show less
2026-09-15T10:09:38.288682+00:00 server sshd-session[3441832]: Invalid user vpsuser from 139.129.24. ...
show more2026-09-15T10:09:38.288682+00:00 server sshd-session[3441832]: Invalid user vpsuser from 139.129.24.29 port 33934
2026-09-15T10:09:38.592397+00:00 server sshd-session[3441832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.129.24.29
2026-09-15T10:09:40.577673+00:00 server sshd-session[3441832]: Failed password for invalid user vpsuser from 139.129.24.29 port 33934 ssh2
show less
2026-09-15T09:03:59.568656+00:00 ubuntu-4gb-hel1-1 sshd-session[671450]: Invalid user vpsuser from 1 ...
show more2026-09-15T09:03:59.568656+00:00 ubuntu-4gb-hel1-1 sshd-session[671450]: Invalid user vpsuser from 139.129.24.29 port 55820
2026-09-15T09:04:00.621762+00:00 ubuntu-4gb-hel1-1 sshd-session[671452]: Invalid user ansible from 139.129.24.29 port 46774
2026-09-15T09:04:01.619569+00:00 ubuntu-4gb-hel1-1 sshd-session[671454]: Invalid user ubnt from 139.129.24.29 port 46778
2026-09-15T09:04:02.958991+00:00 ubuntu-4gb-hel1-1 sshd-session[671456]: Invalid user mysql from 139.129.24.29 port 46784
...
show less
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted t ...
show more[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-09-15 09:00 UTC | 1 session | 7 events | SSH (port 22)
Attack chain:
1. 1 credential attempt: root/root
2. Shell access obtained; 3 distinct commands executed: uname -a ; cat /etc/passwd ; passwd
Signatures: Host Reconnaissance Commands
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/139.129.24.29.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
SSH
Brute-Force
Showing 1 to
15
of 43 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩