This IP address has been reported a total of
12
times from
12 distinct
sources.
45.136.54.27 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[Honeypot Report] Malware dropped following SSH intrusion
An automated malware loader attempted to ...
show more[Honeypot Report] Malware dropped following SSH intrusion
An automated malware loader attempted to log in to our emulated SSH service, then obtained shell access and executed commands, and finally delivered an executable payload.
Observed: 2026-09-16 14:42 to 2026-09-16 14:44 UTC | 1 session | 25 events | SSH (port 22)
Attack chain:
1. 1 credential attempt: test/123456
2. Shell access obtained; 8 distinct commands executed: cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root ; uname -a ; sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "
3. Malicious script dropped: SHA-256 bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28, 1,421 bytes, script (#!/usr/bin/env bash)
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/45.136.54.27.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Attempt on port 22 (SSH) - potential remote access / brute-force attempt. Blocked by firewall (unsol ...
show moreAttempt on port 22 (SSH) - potential remote access / brute-force attempt. Blocked by firewall (unsolicited inbound, no prior outbound connection).
show less