AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Birdo joined AbuseIPDB in January 2024 and has reported 1,049,191 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇭🇰 118.193.40.88	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via FTP A remote host attempted t ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP A remote host attempted to log in to our emulated FTP service, then obtained shell access and executed commands. Observed: 2026-11-04 22:14 UTC \| 3 sessions \| 14 events \| FTP (port 21) Attack chain: 1. 1 credential attempt: anonymous/anonymous 2. Shell access obtained; 6 distinct commands executed: QUIT ; HELP ; SYST Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/118.193.40.88.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇨🇳 218.94.137.166	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 18:31 to 2026-11-04 18:53 UTC \| 9 sessions \| 17 events \| SSH (port 22) Attack chain: 1. 9 credential attempts: 345gs5662d34/345gs5662d34, piyush/piyush@123, runner/runner, john/john123, wedding/wedding (+3 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/218.94.137.166.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇦🇺 223.27.18.80	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 18:44 to 2026-11-04 19:08 UTC \| 13 sessions \| 34 events \| SSH (port 2222) Attack chain: 1. 13 credential attempts: 345gs5662d34/345gs5662d34, florence/florence, starwars/starwars, aura/aura, bcc/bcc (+7 more pairs) 2. Shell access obtained; 2 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/223.27.18.80.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇫🇷 46.8.224.233	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 18:44 to 2026-11-04 20:13 UTC \| 14 sessions \| 48 events \| SSH (port 2222) Attack chain: 1. 14 credential attempts: 345gs5662d34/345gs5662d34, admin/3245gs5662d34, test/88888888, root/0000, juan/juan (+6 more pairs) 2. Shell access obtained; 3 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/46.8.224.233.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇦🇷 190.230.219.208	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 19:26 to 2026-11-04 20:03 UTC \| 24 sessions \| 94 events \| SSH (port 22) Attack chain: 1. 24 credential attempts: rootssssss23424123123/rootssssss23424123123, sso/sso, bic/bic, charity/charity, catering/catering (+13 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/190.230.219.208.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇸🇾 178.253.95.34	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 18:32 to 2026-11-04 18:53 UTC \| 34 sessions \| 85 events \| SSH (port 22) Attack chain: 1. 34 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, ubuntu/3245gs5662d34, ubuntu/Admin@123, root/nsfocus123 (+13 more pairs) 2. Shell access obtained; 3 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/178.253.95.34.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇮🇱 5.29.135.63	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 20:41 to 2026-11-04 21:56 UTC \| 41 sessions \| 171 events \| SSH (port 22) Attack chain: 1. 41 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, myuser/mypassword, teamcity/teamcity123!, c/123456 (+18 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/5.29.135.63.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇧🇩 163.61.156.21	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 19:04 to 2026-11-04 20:03 UTC \| 43 sessions \| 183 events \| SSH (port 22) Attack chain: 1. 43 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, root/1qaz#EDC5tgb, root/1234Abcd, gg/gg (+18 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/163.61.156.21.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇺🇸 67.205.141.247	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 22:20 to 2026-11-04 23:31 UTC \| 43 sessions \| 183 events \| SSH (port 2222) Attack chain: 1. 43 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, onyx/onyx, onyx/root3245gs5662d34111111111, root/Admin123. (+19 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/67.205.141.247.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇭🇰 101.36.116.216	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 18:41 to 2026-11-04 19:54 UTC \| 43 sessions \| 193 events \| SSH (port 22) Attack chain: 1. 43 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, mk/mk123, oleg/123, oleg/root3245gs5662d34111111111 (+20 more pairs) 2. Shell access obtained; 2 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/101.36.116.216.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇮🇩 103.175.225.238	8 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 21:17 to 2026-11-04 21:40 UTC \| 43 sessions \| 108 events \| SSH (port 2222) Attack chain: 1. 43 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/amir123, root/Abc123456., root/asdasd123 (+17 more pairs) 2. Shell access obtained; 3 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.175.225.238.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 180.165.41.5	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 21:23 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/180.165.41.5.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇲🇪 46.33.204.76	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 20:54 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/46.33.204.76.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇨🇱 181.190.22.242	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 19:47 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/181.190.22.242.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇳🇵 202.70.82.59	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 19:34 to 2026-11-04 19:35 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/202.70.82.59.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇧🇷 164.163.97.124	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 19:13 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/164.163.97.124.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇲🇳 66.181.186.146	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 22:50 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/66.181.186.146.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇹🇭 101.109.132.175	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-05 00:01 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/101.109.132.175.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇨🇴 177.253.168.2	8 hours ago	[Honeypot Report] Malware dropped following SSH intrusion An automated malware loader attempted mul ... show more [Honeypot Report] Malware dropped following SSH intrusion An automated malware loader attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands, and finally delivered an executable payload. Observed: 2026-11-04 22:41 UTC \| 3 sessions \| 13 events \| SSH (port 22) Attack chain: 1. 3 credential attempts: pi/raspberry, pi/raspberryraspberry993311 2. Shell access obtained; 2 distinct commands executed: scp -t /tmp/7uRsY97V ; cd /tmp && chmod +x 7uRsY97V && bash -c ./7uRsY97V 3. Malicious script dropped: SHA-256 6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c195267c9b, 4,745 bytes, script (#!/bin/bash) Technique: CWE-78 OS command injection \| Classification: malware loader \| Signatures: Download-and-Execute Payload Chain Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/177.253.168.2.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking SSH Brute-Force
🇨🇳 222.210.216.92	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 22:32 to 2026-11-04 22:33 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/222.210.216.92.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇺🇸 173.54.65.53	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 21:39 to 2026-11-04 21:41 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/173.54.65.53.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇮🇳 183.82.108.234	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 20:55 to 2026-11-04 20:57 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/183.82.108.234.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇮🇳 106.215.85.224	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 20:30 to 2026-11-04 20:32 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/106.215.85.224.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇲🇽 201.138.28.172	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 19:25 to 2026-11-04 19:27 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/201.138.28.172.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇮🇩 180.252.90.131	8 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 18:29 to 2026-11-04 18:31 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/180.252.90.131.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan