This IP address has been reported a total of
9
times from
9 distinct
sources.
47.100.9.164 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 3
reports;
Czechia
with 1
report;
Spain
with 1
report.
The most common categories in these recent reports were:
Brute-Force
9
times;
SSH
7
times;
Hacking
1
time;
Port Scan
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-10-22T14:55:44.250294 redacted sshd[317110]: Failed password for invalid user palworld from 47. ...
show more2026-10-22T14:55:44.250294 redacted sshd[317110]: Failed password for invalid user palworld from 47.100.9.164 port 40346 ssh2
2026-10-22T15:02:53.395856 redacted sshd[317261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.100.9.164 user=root
2026-10-22T15:02:55.627676 redacted sshd[317261]: Failed password for root from 47.100.9.164 port 36718 ssh2
show less
2026-10-17T00:37:21.399227-06:00 jump sshd[202571]: Invalid user ec2-user from 47.100.9.164 port 535 ...
show more2026-10-17T00:37:21.399227-06:00 jump sshd[202571]: Invalid user ec2-user from 47.100.9.164 port 53588
2026-10-17T00:50:37.786097-06:00 jump sshd[203074]: Invalid user pzuser from 47.100.9.164 port 37362
...
show less
2026-10-16T15:47:47.173445+00:00 pre-blog sshd[1515094]: Invalid user dmdba from 47.100.9.164 port 4 ...
show more2026-10-16T15:47:47.173445+00:00 pre-blog sshd[1515094]: Invalid user dmdba from 47.100.9.164 port 43718
2026-10-16T15:50:26.216342+00:00 pre-blog sshd[1515490]: Invalid user oneadmin from 47.100.9.164 port 57944
2026-10-16T15:50:59.390102+00:00 pre-blog sshd[1515558]: Invalid user salam from 47.100.9.164 port 44772
...
show less
Oct 14 07:06:32 rooty sshd-session[612]: Invalid user aaaa from 47.100.9.164 port 38654
Oct 14 07:07 ...
show moreOct 14 07:06:32 rooty sshd-session[612]: Invalid user aaaa from 47.100.9.164 port 38654
Oct 14 07:07:58 rooty sshd-session[642]: Invalid user vika from 47.100.9.164 port 41948
Oct 14 07:08:29 rooty sshd-session[649]: Invalid user mjkim from 47.100.9.164 port 58690
Oct 14 07:09:00 rooty sshd-session[660]: Invalid user frappe from 47.100.9.164 port 38366
Oct 14 07:09:28 rooty sshd-session[669]: Invalid user dana from 47.100.9.164 port 36864
...
show less
Brute-Force
SSH
Anonymous
2026-10-14T05:53:07.631987+02:00 myserver sshd[19751]: pam_unix(sshd:auth): authentication failure; ...
show more2026-10-14T05:53:07.631987+02:00 myserver sshd[19751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.100.9.164
2026-10-14T05:53:10.374619+02:00 myserver sshd[19751]: Failed password for invalid user aaaa from 47.100.9.164 port 51424 ssh2
...
show less
SSH Brute force: 2 attempts were recorded from 47.100.9.164
2026-10-11T20:37:46+02:00 Invalid user a ...
show moreSSH Brute force: 2 attempts were recorded from 47.100.9.164
2026-10-11T20:37:46+02:00 Invalid user angel from 47.100.9.164 port 33876
2026-10-12T09:10:47+02:00 Invalid user user4 from 47.100.9.164 port 49374
show less
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted m ...
show more[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-10-11 18:48 to 2026-10-11 18:49 UTC | 3 sessions | 7 events | SSH (port 2222)
Attack chain:
1. 3 credential attempts: angel/1234, 345gs5662d34/345gs5662d34, angel/3245gs5662d34
2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/47.100.9.164.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
SSH
Brute-Force
Showing 1 to
9
of 9 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
