This IP address has been reported a total of
29
times from
13 distinct
sources.
51.254.210.11 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 18
reports;
Germany
with 3
reports;
Finland
with 2
reports.
The most common categories in these recent reports were:
SSH
24
times;
Brute-Force
20
times;
Hacking
9
times;
Port Scan
3
times;
Exploited Host
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Attempted SSH login with ubuntu/ef@+tj-YUbvcQr- in 2 sessions. After entry, attacker checked system ...
show moreAttempted SSH login with ubuntu/ef@+tj-YUbvcQr- in 2 sessions. After entry, attacker checked system info (uname -a), CPU count (/proc/cpuinfo), and top processes (ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10). They searched for a writable working directory, then created /tmp/w.sh and marked it executable. Recovered artifact: w.sh, script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28. They then queried crontab and added an @reboot persistence line to run /tmp/w.sh with arguments "astats" "netai" "kstats" and "ssh 2 az". No downloads, lateral movement, or other payload execution were observed beyond the dropped script and persistence setup.
show less
Attempted login with ubuntu/ef@+tj-YUbvcQr- using SSH-2.0-Go. After access, it ran host enumeration ...
show moreAttempted login with ubuntu/ef@+tj-YUbvcQr- using SSH-2.0-Go. After access, it ran host enumeration (uname -a, cat /proc/cpuinfo | grep processor | wc -l, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10) and checked writable locations with sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "$d" 2>/dev/null && pwd && break; done'. It then moved to /tmp and attempted to create a script: cd "/tmp" && if [ ! -f "w.sh" ]; then cat > "w.sh" && chmod +x "w.sh"; fi. It also queried crontab and tried to add persistence via @reboot in cron, referencing /tmp/w.sh and arguments "astats" "netai" "kstats" and "ssh 2 az". No dropped files or downloads were observed in this session.
show less
propolis: 51.254.210.11 - 36 event(s) across 1 category since 2026-10-07T19:33:01.662585+00:00, curr ...
show morepropolis: 51.254.210.11 - 36 event(s) across 1 category since 2026-10-07T19:33:01.662585+00:00, current score 0.8
show less
propolis: 51.254.210.11 - 36 event(s) across 1 category since 2026-10-07T19:33:01.662585+00:00, curr ...
show morepropolis: 51.254.210.11 - 36 event(s) across 1 category since 2026-10-07T19:33:01.662585+00:00, current score 13.0
show less
SSH honeypot: 7 failed login attempt(s) in 15 minute(s) from 51.254.210.11.
Usernames tried: odoo, s ...
show moreSSH honeypot: 7 failed login attempt(s) in 15 minute(s) from 51.254.210.11.
Usernames tried: odoo, steam, test, testuser, ubuntu, vps.
Credentials were eventually guessed and a session was opened.
7 distinct password(s) tried, redacted.
Client: SSH-2.0-Go
2026-10-11 22:03:45 Failed password for 'odoo' from 51.254.210.11 (password '<redacted>')
2026-10-11 22:03:51 Failed password for 'test' from 51.254.210.11 (password '<redacted>')
2026-10-11 22:03:52 Failed password for 'steam' from 51.254.210.11 (password '<redacted>')
2026-10-11 22:03:54 Failed password for 'ubuntu' from 51.254.210.11 (password '<redacted>')
2026-10-11 22:04:25 Failed password for 'ubuntu' from 51.254.210.11 (password '<redacted>')
2026-10-11 22:04:27 Failed password for 'vps' from 51.254.210.11 (password '<redacted>')
2026-10-11 22:04:28 Failed password for 'testuser' from 51.254.210.11 (password '<redacted>')
2026-10-11 22:04:29 Accepted password for 'admin' from 51.254.210.11 -- credentials guessed successfully
show less
Used SSH client SSH-2.0-Go with pi/pi. Activity focused on dropping and running files in /dev/shm an ...
show moreUsed SSH client SSH-2.0-Go with pi/pi. Activity focused on dropping and running files in /dev/shm and building persistence. Commands created /dev/shm/w.sh, then wrote files named astats and kstats in writable paths. It queried CPU count and top processes, and checked for running astats/kstats processes while excluding system services. It also attempted cron persistence by reading crontab and adding an @reboot entry for /dev/shm/w.sh with arguments "astats" "netai" "kstats" "ssh 2 az". Cleanup commands removed shell history and multiple log/utmp/wtmp/lastlog files. No downloads were observed in this session.
show less
propolis: 51.254.210.11 - 30 event(s) across 1 category since 2026-10-07T19:33:01.662585+00:00, curr ...
show morepropolis: 51.254.210.11 - 30 event(s) across 1 category since 2026-10-07T19:33:01.662585+00:00, current score 99.9
show less
propolis: 51.254.210.11 - 30 event(s) across 1 category since 2026-10-07T19:33:01.662585+00:00, curr ...
show morepropolis: 51.254.210.11 - 30 event(s) across 1 category since 2026-10-07T19:33:01.662585+00:00, current score 6.2
show less
Observed SSH login with ftpuser/ftpuser using SSH-2.0-Go. Attacker ran recon commands uname -a, cat ...
show moreObserved SSH login with ftpuser/ftpuser using SSH-2.0-Go. Attacker ran recon commands uname -a, cat /proc/cpuinfo | grep processor | wc -l, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, and ps aux | grep astats | grep -v grep |grep -v systemd-networkd |grep -v ld-musl-x86_64 |grep -v rsyslogd | wc -l. They checked writable locations with sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "$d" 2>/dev/null && pwd && break; done'. Persistence was attempted by creating /dev/shm/w.sh, making it executable, checking crontab for a line invoking /dev/shm/w.sh "astats" "netai" "kstats" "ssh 2 az", and adding an @reboot crontab entry for /dev/shm/w.sh. A second persistence method created ~/.config/systemd/user/watcher-netai.service and executed systemctl --user daemon-reload && systemctl --user enable --now watcher-netai.service. No downloads, dropped files, lateral movement, or hashes were observed.
show less
Observed SSH login with ftpuser/ftpuser using SSH-2.0-Go. The session performed Linux recon and pers ...
show moreObserved SSH login with ftpuser/ftpuser using SSH-2.0-Go. The session performed Linux recon and persistence setup: checked CPU count and top CPU processes; searched for running astats and kstats; enumerated crontab and wrote an @reboot entry pointing to /dev/shm/w.sh; created/marked executable /dev/shm/w.sh; created files named astats and kstats in writable directories. It also tried to remove history and log artifacts with rm -rf against .bash_history, wtmp, lastlog, secure, and yum.log. No downloads, port forwards, lateral movement, or dropped file artifacts were observed in the provided data.
show less
[Honeypot Report] Malware dropped following SSH intrusion
An automated malware loader attempted mul ...
show more[Honeypot Report] Malware dropped following SSH intrusion
An automated malware loader attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands, and finally delivered an executable payload.
Observed: 2026-10-09 22:26 to 2026-10-10 07:59 UTC | 2 sessions | 28 events | SSH (port 22)
Attack chain:
1. 2 credential attempts: ansible/w+pD#Xz-_vkqCI5, root/123
2. Shell access obtained; 8 distinct commands executed: cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root ; uname -a ; sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "
3. Malicious script dropped: SHA-256 bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28, 1,421 bytes, script (#!/usr/bin/env bash)
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/51.254.210.11.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
