AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Birdo joined AbuseIPDB in January 2024 and has reported 1,049,071 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇳🇱 46.151.178.14	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via FTP, MYSQL and SMB A remote h ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP, MYSQL and SMB A remote host obtained shell access and executed commands. Observed: 2026-11-01 07:23 to 2026-11-01 07:31 UTC \| 3 sessions \| 7 events \| FTP/MYSQL/SMB (port 21, 445, 3306) Attack chain: 1. Shell access obtained; 1 distinct command executed: SMB2 NEGOTIATE (2 dialects) Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/46.151.178.14.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇺🇸 199.165.159.169	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via ADB, MYSQL and SMB A remote h ... show more [Honeypot Report] Unauthorised shell access and command execution via ADB, MYSQL and SMB A remote host obtained shell access and executed commands. Observed: 2026-10-31 12:30 to 2026-11-03 12:59 UTC \| 3 sessions \| 8 events \| ADB/MYSQL/SMB (port 445, 3306, 5555) Attack chain: 1. Shell access obtained; 1 distinct command executed: SMB2 NEGOTIATE (1 dialects) Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/199.165.159.169.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇨🇦 85.217.149.56	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via ADB, MYSQL and SMB A remote h ... show more [Honeypot Report] Unauthorised shell access and command execution via ADB, MYSQL and SMB A remote host obtained shell access and executed commands. Observed: 2026-10-30 17:28 to 2026-11-02 05:31 UTC \| 3 sessions \| 8 events \| ADB/MYSQL/SMB (port 445, 3306, 5555) Attack chain: 1. Shell access obtained; 1 distinct command executed: SMB2 NEGOTIATE (1 dialects) Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/85.217.149.56.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇨🇳 120.48.57.133	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted t ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 11:40 UTC \| 1 session \| 5 events \| SSH (port 22) Attack chain: 1. 1 credential attempt: pal/1234 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/120.48.57.133.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇷🇺 176.112.110.168	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempte ... show more [Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempted to log in to our emulated Telnet service, then obtained shell access and executed commands. Observed: 2026-11-03 19:54 UTC \| 1 session \| 5 events \| Telnet (port 23) Attack chain: 1. 1 credential attempt: root/ 2. Shell access obtained; 1 distinct command executed: enable Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/176.112.110.168.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇨🇳 171.220.244.134	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted t ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-03 05:19 UTC \| 1 session \| 5 events \| SSH (port 2222) Attack chain: 1. 1 credential attempt: samira/123456 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/171.220.244.134.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 118.122.147.195	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted t ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 18:23 UTC \| 1 session \| 5 events \| SSH (port 2222) Attack chain: 1. 1 credential attempt: ops/1234 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/118.122.147.195.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇷🇺 82.208.115.121	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempte ... show more [Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempted to log in to our emulated Telnet service, then obtained shell access and executed commands. Observed: 2026-11-01 21:37 UTC \| 1 session \| 5 events \| Telnet (port 23) Attack chain: 1. 1 credential attempt: root/ 2. Shell access obtained; 1 distinct command executed: enable Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/82.208.115.121.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇺🇦 193.34.173.212	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempte ... show more [Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempted to log in to our emulated Telnet service, then obtained shell access and executed commands. Observed: 2026-11-01 20:11 UTC \| 1 session \| 5 events \| Telnet (port 23) Attack chain: 1. 1 credential attempt: root/ 2. Shell access obtained; 1 distinct command executed: enable Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/193.34.173.212.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇫🇮 178.20.210.137	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via ADB, FTP and Telnet A remote ... show more [Honeypot Report] Unauthorised shell access and command execution via ADB, FTP and Telnet A remote host obtained shell access and executed commands. Observed: 2026-10-31 23:06 UTC \| 3 sessions \| 8 events \| ADB/FTP/Telnet (port 21, 23, 5555) Attack chain: 1. Protocol probing / service fingerprinting: 1 probe 2. Shell access obtained; 1 distinct command executed: /*�Cookie: mstshash=Administr Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/178.20.210.137.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇧🇩 103.171.69.93	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted t ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-10-30 14:44 UTC \| 1 session \| 5 events \| SSH (port 22) Attack chain: 1. 1 credential attempt: intel/123 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.171.69.93.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 124.174.32.95	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted t ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-10-30 14:37 to 2026-10-30 14:53 UTC \| 1 session \| 5 events \| SSH (port 22) Attack chain: 1. 1 credential attempt: joel/1234 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/124.174.32.95.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 42.51.33.162	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 07:09 to 2026-11-04 07:57 UTC \| 4 sessions \| 11 events \| SSH (port 2222) Attack chain: 1. 4 credential attempts: root/Master@123, root/Abc@12345, mcserver/mcserver, mcserver/root3245gs5662d34111111111 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/42.51.33.162.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 14.18.113.233	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 08:45 to 2026-11-04 09:52 UTC \| 5 sessions \| 19 events \| SSH (port 22) Attack chain: 1. 5 credential attempts: root/password1!, hussain/hussain, james/james, rootssssss23424123123/rootssssss23424123123, james/root3245gs5662d34111111111 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/14.18.113.233.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇳🇱 192.42.116.97	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 09:28 UTC \| 1 session \| 12 events \| SSH (port 22) Attack chain: 1. 2 credential attempts: usuario/, usuario/1234 2. Shell access obtained; 7 distinct commands executed: LC_ALL=C sudo -S sh -c 'mkdir -p ~root/.ssh' ; LC_ALL=C sudo -S sh -c 'chmod 700 ~root/.ssh' ; LC_ALL=C sudo -S sh -c 'chattr -i -a ~root/.ssh/authorized_k Technique: CWE-1188 unauthorized credential implant \| Classification: SSH key implant Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/192.42.116.97.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇺🇸 50.6.202.5	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 06:03 UTC \| 6 sessions \| 20 events \| SSH (port 2222) Attack chain: 1. 6 credential attempts: bob/1234, rootssssss23424123123/rootssssss23424123123, bob/root3245gs5662d34111111111 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/50.6.202.5.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 121.14.34.219	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 06:27 to 2026-11-04 06:44 UTC \| 9 sessions \| 17 events \| SSH (port 2222) Attack chain: 1. 9 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/123456a., rmsadm/rmsadm, mmt/mmt (+2 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/121.14.34.219.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇸🇬 47.237.172.204	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 06:19 to 2026-11-04 08:52 UTC \| 23 sessions \| 170 events \| SSH (port 22) Attack chain: 1. 23 credential attempts: adminuser/adminuser, root/test@123, root/Huawei123, vm/vm, ubuntu/P@ssw0rd (+18 more pairs) 2. Shell access obtained; 4 distinct commands executed: uname -s -v -n -r -m ; nproc ; lspci \| egrep VGA && lspci \| grep 3D Signatures: Host Reconnaissance Commands Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/47.237.172.204.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇷🇺 109.195.179.94	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 06:31 to 2026-11-04 07:15 UTC \| 26 sessions \| 106 events \| SSH (port 22) Attack chain: 1. 26 credential attempts: rootssssss23424123123/rootssssss23424123123, capella/capella, dep/dep, wapmail/wapmail, wapmail/root3245gs5662d34111111111 (+14 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/109.195.179.94.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇺🇸 192.227.249.3	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 10:29 to 2026-11-04 11:06 UTC \| 27 sessions \| 114 events \| SSH (port 2222) Attack chain: 1. 27 credential attempts: rootssssss23424123123/rootssssss23424123123, wind/wind, wind/root3245gs5662d34111111111, jw/jw, jw/root3245gs5662d34111111111 (+15 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/192.227.249.3.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇫🇮 65.21.111.76	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 09:02 to 2026-11-04 09:55 UTC \| 41 sessions \| 171 events \| SSH (port 2222) Attack chain: 1. 41 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, root/Admin12345, deploy/asd, root/root@12 (+19 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/65.21.111.76.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇵🇰 111.68.98.152	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 09:01 to 2026-11-04 10:01 UTC \| 41 sessions \| 171 events \| SSH (port 2222) Attack chain: 1. 41 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, root/aA112233, jason/Jason123!, den/den (+19 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/111.68.98.152.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇫🇷 169.58.163.123	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 07:05 to 2026-11-04 08:25 UTC \| 43 sessions \| 184 events \| SSH (port 22) Attack chain: 1. 43 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, admin/admin12, root/Admin@2025, root/Admin@123! (+18 more pairs) 2. Shell access obtained; 2 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/169.58.163.123.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇹🇼 61.231.193.189	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 08:36 to 2026-11-04 10:17 UTC \| 41 sessions \| 96 events \| SSH (port 2222) Attack chain: 1. 41 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, ubuntu/3245gs5662d34, system/nigger, root/root (+17 more pairs) 2. Shell access obtained; 3 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/61.231.193.189.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇸🇬 103.187.147.214	3 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 08:34 to 2026-11-04 08:57 UTC \| 43 sessions \| 102 events \| SSH (port 2222) Attack chain: 1. 43 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/1qaz@WSX., wang/123456, wang/3245gs5662d34 (+20 more pairs) 2. Shell access obtained; 3 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.187.147.214.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force