Total reports
9 from
6 distinct
reporters
First reported
November 7th 2026
Most recent report
10 hours ago
Last 60 days
Top reporter locations
🇫🇷
France
6
🇩🇪
Germany
1
🇫🇮
Finland
1
Most common categories
Port Scan
9
Hacking
1
Exploited Host
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
2026-11-11 10:43:46
UTC ·
(10 hours ago)
Unauthorized access (445/tcp/microsoft-ds)
Port Scan
🇫🇷
Kejult
2026-11-10 07:09:37
UTC ·
(1 day ago)
Honeypot Finding: SMB activity on TCP/445; 4 Dionaea events.
Port Scan
🇺🇸
xclmp
2026-11-10 02:10:35
UTC ·
(1 day ago)
Unauthorized connection attempts consistent with that of port probing and scanning from 195.60.249.34 were detected at 2026-11-10 02:10:34 UTC. Learn More: https://fia.project-furina.com/report/21935
Port Scan
🇫🇷
Kejult
2026-11-08 06:03:33
UTC ·
(3 days ago)
Honeypot Finding: SMB activity on TCP/445; 4 Dionaea events.
Port Scan
🇫🇮
Birdo
2026-11-08 01:46:01
UTC ·
(3 days ago)
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-08 01:44 to 2026-11-08 01:46 UTC | 4 sessions | 16 e ...
show more
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-08 01:44 to 2026-11-08 01:46 UTC | 4 sessions | 16 events | SMB (port 445)
Attack chain:
1. Exploit attempt: CVE-2017-0144
2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects)
Classification: scanner | Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/195.60.249.34.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
Port Scan
🇫🇷
sthoyer.de
2026-11-07 22:34:54
UTC ·
(3 days ago)
Nov 7 23:34:53 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=195.60.249.34 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=6445 DF PROTO=TCP SPT=55736 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ...
show more
Nov 7 23:34:53 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=195.60.249.34 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=6445 DF PROTO=TCP SPT=55736 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇫🇷
sthoyer.de
2026-11-07 17:58:10
UTC ·
(4 days ago)
Nov 7 18:58:09 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=195.60.249.34 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=29561 DF PROTO=TCP SPT=57560 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ...
show more
Nov 7 18:58:09 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=195.60.249.34 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=29561 DF PROTO=TCP SPT=57560 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇫🇷
sthoyer.de
2026-11-07 17:02:14
UTC ·
(4 days ago)
Nov 7 18:02:13 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=195.60.249.34 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=659 DF PROTO=TCP SPT=60296 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show more
Nov 7 18:02:13 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=195.60.249.34 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=659 DF PROTO=TCP SPT=60296 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇫🇷
Little Iguana
2026-11-07 17:01:03
UTC ·
(4 days ago)
trying to access non-authorized port
Port Scan
