AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Birdo joined AbuseIPDB in January 2024 and has reported 1,043,632 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇦🇷 186.56.11.2	7 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-09-24 13:26 to 2026-09-24 14:10 UTC \| 56 sessions \| 131 events \| SSH (port 22) Attack chain: 1. 56 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/1234Qwer!, alan/alan, dream/123456 (+27 more pairs) 2. Shell access obtained; 2 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza Signatures: Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/186.56.11.2.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇲🇽 189.222.219.121	7 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-09-24 15:10 to 2026-09-24 16:01 UTC \| 58 sessions \| 176 events \| SSH (port 22) Attack chain: 1. 58 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, ling/ling, tanya/123456, tanya/3245gs5662d34 (+32 more pairs) 2. Shell access obtained; 3 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: Persistence Mechanism, Host Reconnaissance Commands Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/189.222.219.121.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇵🇰 203.128.10.201	7 hours ago	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), DrayTek router. Observed: 2026-09-24 15:23 to 2026-09-24 18:01 UTC \| 1,834 sessions \| 29,261 events \| Telnet (port 23) Attack chain: 1. 1,829 credential attempts: root/xc3511, root/Zte521, 888888/888888, root/25802580, root/12345 (+35 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://119.115.162.197:41449/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/203.128.10.201.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇵🇰 139.135.59.1	7 hours ago	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), DrayTek router. Observed: 2026-09-24 14:06 to 2026-09-24 16:55 UTC \| 2,855 sessions \| 45,680 events \| Telnet (port 23) Attack chain: 1. 2,855 credential attempts: admin/888888, root/xc3511, root/Zte521, admin/1234, admin/v2mprt (+35 more pairs) 2. Shell access obtained; 12 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://140.237.44.158:39073/i, http://58.245.6.124:35667/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/139.135.59.1.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇮🇳 115.97.191.65	7 hours ago	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), DrayTek router. Observed: 2026-09-24 13:26 to 2026-09-24 18:01 UTC \| 8,971 sessions \| 143,374 events \| Telnet (port 23) Attack chain: 1. 8,964 credential attempts: super/PhrQjGzk, root/, root/root, root/2011vesta, rapport/r@p8p0r+ (+35 more pairs) 2. Shell access obtained; 12 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://103.160.130.109:52338/i, http://58.245.6.124:35667/bin.sh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/115.97.191.65.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇩🇪 142.93.105.106	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained shell access and executed commands. Observed: 2026-09-23 11:01 UTC \| 2 sessions \| 5 events \| SMB (port 445) Attack chain: 1. Shell access obtained; 1 distinct command executed: SMB1 NEGOTIATE (8 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/142.93.105.106.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇺🇸 66.132.195.62	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained shell access and executed commands. Observed: 2026-09-23 09:53 UTC \| 1 session \| 4 events \| FTP (port 21) Attack chain: 1. Shell access obtained; 2 distinct commands executed: AUTH TLS ; AUTH SSL Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/66.132.195.62.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇺🇸 20.14.94.94	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained shell access and executed commands. Observed: 2026-09-23 07:48 UTC \| 2 sessions \| 5 events \| FTP (port 21) Attack chain: 1. Shell access obtained; 1 distinct command executed: MGLNDD_[sensor]_21 Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/20.14.94.94.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇺🇸 20.64.98.130	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained shell access and executed commands. Observed: 2026-09-23 04:49 UTC \| 2 sessions \| 5 events \| FTP (port 21) Attack chain: 1. Shell access obtained; 1 distinct command executed: MGLNDD_[sensor]_21 Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/20.64.98.130.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇹🇼 198.235.24.115	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained shell access and executed commands. Observed: 2026-09-23 02:59 UTC \| 1 session \| 4 events \| FTP (port 21) Attack chain: 1. Shell access obtained; 2 distinct commands executed: AUTH TLS ; AUTH SSL Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/198.235.24.115.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇺🇸 44.204.37.191	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained shell access and executed commands. Observed: 2026-09-22 21:17 UTC \| 1 session \| 4 events \| FTP (port 21) Attack chain: 1. Shell access obtained; 2 distinct commands executed: AUTH TLS ; AUTH SSL Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/44.204.37.191.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇭🇰 199.45.155.46	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained shell access and executed commands. Observed: 2026-09-22 20:22 UTC \| 1 session \| 4 events \| FTP (port 21) Attack chain: 1. Shell access obtained; 2 distinct commands executed: AUTH TLS ; AUTH SSL Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/199.45.155.46.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇮🇳 49.43.94.24	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained shell access and executed commands. Observed: 2026-09-24 07:52 UTC \| 1 session \| 6 events \| SMB (port 445) Attack chain: 1. Shell access obtained; 4 distinct commands executed: SMB1 NEGOTIATE (6 dialects) ; SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/49.43.94.24.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇺🇸 66.132.195.68	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via REDIS A remote host obtained ... show more [Honeypot Report] Unauthorised shell access and command execution via REDIS A remote host obtained shell access and executed commands. Observed: 2026-09-24 06:34 UTC \| 1 session \| 6 events \| REDIS (port 6379) Attack chain: 1. Shell access obtained; 4 distinct commands executed: PING ; INFO ; NONEXISTENT Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/66.132.195.68.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇮🇳 162.216.142.81	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained shell access and executed commands. Observed: 2026-09-24 06:47 UTC \| 2 sessions \| 10 events \| SMB (port 445) Attack chain: 1. Shell access obtained; 4 distinct commands executed: SMB1 NEGOTIATE (1 dialects) ; SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/162.216.142.81.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇺🇿 213.230.110.88	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained shell access and executed commands. Observed: 2026-09-24 06:22 UTC \| 2 sessions \| 10 events \| SMB (port 445) Attack chain: 1. Shell access obtained; 4 distinct commands executed: SMB1 NEGOTIATE (1 dialects) ; SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/213.230.110.88.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇮🇳 103.245.34.92	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained shell access and executed commands. Observed: 2026-09-24 04:08 to 2026-09-24 04:09 UTC \| 2 sessions \| 10 events \| SMB (port 445) Attack chain: 1. Shell access obtained; 4 distinct commands executed: SMB1 NEGOTIATE (1 dialects) ; SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/103.245.34.92.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇫🇷 188.165.2.38	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained shell access and executed commands. Observed: 2026-09-24 11:48 to 2026-09-24 11:49 UTC \| 2 sessions \| 10 events \| SMB (port 445) Attack chain: 1. Shell access obtained; 4 distinct commands executed: SMB1 NEGOTIATE (1 dialects) ; SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/188.165.2.38.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇧🇪 104.155.126.205	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via REDIS A remote host obtained ... show more [Honeypot Report] Unauthorised shell access and command execution via REDIS A remote host obtained shell access and executed commands. Observed: 2026-09-24 06:47 UTC \| 2 sessions \| 10 events \| REDIS (port 6379) Attack chain: 1. Shell access obtained; 5 distinct commands executed: INFO ; CONFIG GET bind ; PUBSUB CHANNELS Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/104.155.126.205.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇨🇭 209.99.187.10	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempte ... show more [Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempted to log in to our emulated Telnet service, then obtained shell access and executed commands. Observed: 2026-09-24 09:25 to 2026-09-24 09:28 UTC \| 1 session \| 7 events \| Telnet (port 23) Attack chain: 1. 1 credential attempt: admin/admin 2. Shell access obtained; 3 distinct commands executed: id ; cat /etc/passwd ; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A" Signatures: Host Reconnaissance Commands Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/209.99.187.10.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇨🇳 124.174.82.178	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-09-24 05:53 to 2026-09-24 06:32 UTC \| 4 sessions \| 8 events \| SSH (port 22) Attack chain: 1. 4 credential attempts: dal/dal, dev/devdev, root2/1234, root2/3245gs5662d34 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/124.174.82.178.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇧🇪 198.235.24.238	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via HTTP and SMB A remote host pr ... show more [Honeypot Report] Unauthorised shell access and command execution via HTTP and SMB A remote host probed for vulnerable web applications, then obtained shell access and executed commands. Observed: 2026-09-21 03:12 to 2026-09-24 08:28 UTC \| 4 sessions \| 11 events \| HTTP/SMB (port 80, 445) Attack chain: 1. Requested 1 distinct path, including: / 2. Shell access obtained; 2 distinct commands executed: SMB1 NEGOTIATE (2 dialects) ; SMB2 NEGOTIATE (1 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/198.235.24.238.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Web App Attack Port Scan
🇨🇳 42.193.181.128	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempte ... show more [Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempted to log in to our emulated Telnet service, then obtained shell access and executed commands. Observed: 2026-09-24 10:33 to 2026-09-24 10:34 UTC \| 1 session \| 20 events \| Telnet (port 23) Attack chain: 1. 1 credential attempt: admin/admin 2. Shell access obtained; 16 distinct commands executed: id ; cat /etc/passwd ; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A" Technique: CWE-78 OS command injection \| Signatures: Host Reconnaissance Commands, Download-and-Execute Payload Chain Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/42.193.181.128.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇨🇳 120.26.220.254	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempte ... show more [Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempted to log in to our emulated Telnet service, then obtained shell access and executed commands. Observed: 2026-09-24 09:46 to 2026-09-24 09:48 UTC \| 1 session \| 20 events \| Telnet (port 23) Attack chain: 1. 1 credential attempt: admin/admin 2. Shell access obtained; 16 distinct commands executed: id ; cat /etc/passwd ; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A" Technique: CWE-78 OS command injection \| Signatures: Host Reconnaissance Commands, Download-and-Execute Payload Chain Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/120.26.220.254.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇺🇸 65.49.20.69	13 hours ago	[Honeypot Report] Unauthorised shell access and command execution via HTTP, SMB and Telnet A remote ... show more [Honeypot Report] Unauthorised shell access and command execution via HTTP, SMB and Telnet A remote host probed for vulnerable web applications, then obtained shell access and executed commands. Observed: 2026-09-18 02:57 to 2026-09-24 08:33 UTC \| 10 sessions \| 30 events \| HTTP/SMB/Telnet (port 23, 80, 81, 445) Attack chain: 1. Protocol probing / service fingerprinting: 1 probe 2. Requested 6 distinct paths, including: / \| /favicon.ico 3. Shell access obtained; 1 distinct command executed: SMB2 NEGOTIATE (1 dialects) Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/65.49.20.69.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Web App Attack Port Scan