🇸🇬
ksi_digital
2026-11-14 00:11:00
UTC ·
(1 day ago)
Cowrie honeypot (telnet/23), 2026-11-14 00:11 UTC: 9 successful login(s) (user: admin,cuadmin,default), then 91 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev ...
show more
Cowrie honeypot (telnet/23), 2026-11-14 00:11 UTC: 9 successful login(s) (user: admin,cuadmin,default), then 91 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tm ;; /bin/busybox wget;/bin/busybox echo -ne '\x53\x4b\x4f\x43\x55\x44'. Attempted payload fetch: http://112.82.137.139:39661/i. Automated bot behaviour; payloads (if any) quarantined, never executed.
show less
Brute-Force
IoT Targeted
2026-11-13 19:55:31
UTC ·
(2 days ago)
denied traffic to a honeypot network. destination port 23.
Port Scan
Hacking
🇸🇬
ksi_digital
2026-11-13 00:12:00
UTC ·
(2 days ago)
Cowrie honeypot (telnet/23), 2026-11-13 00:12 UTC: 1 successful login(s) (user: service), then 10 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tm ;; / ...
show more
Cowrie honeypot (telnet/23), 2026-11-13 00:12 UTC: 1 successful login(s) (user: service), then 10 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tm ;; /bin/busybox wget;/bin/busybox echo -ne '\x53\x4b\x4f\x43\x55\x44'. Attempted payload fetch: http://112.82.137.139:39661/i. Automated bot behaviour; payloads (if any) quarantined, never executed.
show less
Brute-Force
IoT Targeted
🇺🇸
RAP
2026-11-12 16:26:46
UTC ·
(3 days ago)
2026-11-12 16:26:46 UTC Unauthorized activity to TCP port 23. Telnet
Port Scan
🇸🇬
ksi_digital
2026-11-12 00:05:00
UTC ·
(3 days ago)
Cowrie honeypot (telnet/23), 2026-11-12 00:05 UTC: 4 successful login(s) (user: admin,root), then 43 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tm ; ...
show more
Cowrie honeypot (telnet/23), 2026-11-12 00:05 UTC: 4 successful login(s) (user: admin,root), then 43 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tm ;; /bin/busybox wget;/bin/busybox echo -ne '\x53\x4b\x4f\x43\x55\x44'. Attempted payload fetch: http://112.82.137.139:39661/i. Automated bot behaviour; payloads (if any) quarantined, never executed.
show less
Brute-Force
IoT Targeted
🇫🇮
Birdo
2026-11-11 23:59:20
UTC ·
(3 days ago)
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Crede ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match ZTE CPE, firmware backdoor account.
Observed: 2026-11-11 21:40 to 2026-11-11 23:59 UTC | 26 sessions | 416 events | Telnet (port 23)
Attack chain:
1. 26 credential attempts: CUAdmin/CUAdmin, root/Zte521, service/service, root/ikwb, Manager/friend (+16 more pairs)
2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://112.82.137.139:39661/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/42.234.232.218.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
IoT Targeted
Brute-Force
🇸🇬
ksi_digital
2026-11-11 21:32:00
UTC ·
(4 days ago)
Cowrie honeypot (telnet/23), 2026-11-11 21:32 UTC: 4 successful login(s) (user: CUAdmin,admin,root), then 41 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/sh ...
show more
Cowrie honeypot (telnet/23), 2026-11-11 21:32 UTC: 4 successful login(s) (user: CUAdmin,admin,root), then 41 command(s), e.g.: config terminal ;; >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tm ;; /bin/busybox wget;/bin/busybox echo -ne '\x53\x4b\x4f\x43\x55\x44'. Attempted payload fetch: http://112.82.137.139:39661/i. Automated bot behaviour; payloads (if any) quarantined, never executed.
show less
Brute-Force
IoT Targeted
🇵🇱
kolya
2022-06-18 06:30:05
UTC ·
(4 years ago)
[18/06/2022 10:30:05] Unauthorized connection attempt to port 80, server 9a0b801d.
Port Scan
