Total reports
4 from
3 distinct
reporters
First reported
Most recent report
Old reports
The most recent abuse report for this IP address is from
.
It is possible that this IP is no longer involved in abusive activities.
| Reporter |
IoA Timestamp (UTC)
|
Comment |
Categories |
|
🇫🇮
Birdo
|
|
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Crede ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal.
Observed: 2026-10-03 21:46 to 2026-10-06 20:14 UTC | 1,454 sessions | 22,955 events | Telnet (port 23)
Attack chain:
1. 1,439 credential attempts: root/zte, root/Fireitup, root/xc3511, root/hme12345, user/1234 (+35 more pairs)
2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://221.3.87.188:42241/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/182.112.94.149.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
|
Exploited Host
Hacking
IoT Targeted
Brute-Force
|
|
🇺🇸
MPL
|
|
tcp/80 (6 or more attempts)
|
Port Scan
|
|
Anonymous
|
|
denied Telnet-like access attempt. destination port 2323.
|
Port Scan
Brute-Force
|
|
🇫🇮
Birdo
|
|
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Crede ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal.
Observed: 2026-10-03 21:46 to 2026-10-04 00:02 UTC | 36 sessions | 561 events | Telnet (port 23)
Attack chain:
1. 36 credential attempts: root/zte, root/Fireitup, telecomadmin/nE7jA%5m, root/888888, root/root (+16 more pairs)
2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://221.3.87.188:42241/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/182.112.94.149.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
|
Exploited Host
Hacking
IoT Targeted
Brute-Force
|
