This IP address has been reported a total of
39
times from
33 distinct
sources.
98.152.75.199 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 11
reports;
Germany
with 9
reports;
France
with 4
reports.
The most common categories in these recent reports were:
Brute-Force
22
times;
SSH
17
times;
Port Scan
13
times;
Hacking
12
times;
Web App Attack
6
times;
Other
5
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Successful login with ubuntu/Ubuntu@1234 via SSH-2.0-Go. Attacker ran host recon (uname -a, /proc/cp ...
show moreSuccessful login with ubuntu/Ubuntu@1234 via SSH-2.0-Go. Attacker ran host recon (uname -a, /proc/cpuinfo, ps -eo ... --sort=-pcpu) and checked writable locations (/dev/shm, /tmp, /var/run, /mnt, /root, /). Persistence attempted by creating /dev/shm/w.sh, making it executable, and adding an @reboot crontab entry referencing /dev/shm/w.sh with args "astats" "netai" "kstats" "ssh 2 az". Also attempted user-level systemd persistence by creating ~/.config/systemd/user/watcher-netai.service, reloading the user daemon, and enabling it with systemctl --user. No file downloads or lateral movement were observed.
show less
[mm-111] Web scan / malformed HTTP requests to public endpoint: 2 event(s) from 98.152.75.199; fail2 ...
show more[mm-111] Web scan / malformed HTTP requests to public endpoint: 2 event(s) from 98.152.75.199; fail2ban auto-ban. Log sample: 98.152.75.199 - - [12/Oct/2026:02:17:17 +0000] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 157 "-" "-" "-"
show less
[Honeypot Report] Malware dropped following SSH intrusion
An automated malware loader attempted mul ...
show more[Honeypot Report] Malware dropped following SSH intrusion
An automated malware loader attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands, and finally delivered an executable payload.
Observed: 2026-10-10 21:27 to 2026-10-12 01:14 UTC | 2 sessions | 28 events | SSH (port 22)
Attack chain:
1. 2 credential attempts: ansible/ansible, ubuntu/123456
2. Shell access obtained; 8 distinct commands executed: cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root ; uname -a ; sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "
3. Malicious script dropped: SHA-256 bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28, 1,421 bytes, script (#!/usr/bin/env bash)
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/98.152.75.199.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Observed one SSH session from SSH-2.0-Go using ftpuser/ftpuser. Activity focused on dropping and per ...
show moreObserved one SSH session from SSH-2.0-Go using ftpuser/ftpuser. Activity focused on dropping and persisting files in /dev/shm and cleaning traces. Commands created/managed w.sh, astats, and kstats under /dev/shm or fallback dirs, checked for existing instances with ps/grep, and queried CPU count via /proc/cpuinfo. Persistence was attempted by reading crontab and adding an @reboot entry to run /dev/shm/w.sh with arguments including "astats" "netai" "kstats" "ssh 2 az". No downloads, port forwarding, or lateral movement were observed. Trace-cleanup commands removed .bash_history and attempted deletion of utmp/wtmp/lastlog and related log files.
show less
2026-10-11T14:33:20.997229-06:00 b146-49 sshd[422762]: pam_sss(sshd:auth): authentication failure; l ...
show more2026-10-11T14:33:20.997229-06:00 b146-49 sshd[422762]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.152.75.199 user=devops
2026-10-11T14:33:23.169203-06:00 b146-49 sshd[422762]: Failed password for invalid user devops from 98.152.75.199 port 35502 ssh2
2026-10-11T14:33:26.557116-06:00 b146-49 sshd[422767]: Invalid user ubuntu from 98.152.75.199 port 39446
...
show less
Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT | PORTS ...
show moreVerified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT | PORTS=23 | HITS=2 | IPSET=ADD | FIRST=2026-10-11 07:21:42 | LAST=2026-10-11 07:21:42. Last seen 2026-10-11 07:21:42.
show less
