AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Birdo joined AbuseIPDB in January 2024 and has reported 1,046,831 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇨🇦 85.217.149.5	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via ADB, HTTP and SMB A remote ho ... show more [Honeypot Report] Unauthorised shell access and command execution via ADB, HTTP and SMB A remote host probed for vulnerable web applications, then obtained shell access and executed commands. Observed: 2026-09-18 09:11 to 2026-10-14 04:34 UTC \| 4 sessions \| 13 events \| ADB/HTTP/SMB (port 445, 5555, 7547) Attack chain: 1. Requested 2 distinct paths, including: / \| /favicon.ico 2. Shell access obtained; 1 distinct command executed: SMB2 NEGOTIATE (1 dialects) Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/85.217.149.5.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Web App Attack Port Scan
🇨🇭 170.231.237.214	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via HTTP, SMB and Telnet A remote ... show more [Honeypot Report] Unauthorised shell access and command execution via HTTP, SMB and Telnet A remote host probed for vulnerable web applications, then obtained shell access and executed commands. Observed: 2026-10-12 04:47 to 2026-10-14 02:21 UTC \| 6 sessions \| 16 events \| HTTP/SMB/Telnet (port 23, 445, 7547) Attack chain: 1. Requested 3 distinct paths, including: / \| /favicon.ico 2. Shell access obtained; 1 distinct command executed: SMB1 NEGOTIATE (6 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/170.231.237.214.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Web App Attack Port Scan
🇧🇪 34.78.73.194	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained shell access and executed commands. Observed: 2026-10-14 06:06 UTC \| 32 sessions \| 83 events \| FTP (port 21) Attack chain: 1. Shell access obtained; 18 distinct commands executed: ��CLBG46h/�UGYbo��y]��y� __X;Q��O��W�Т��3ɮ7k٤3�2�+�/� ; ��/5� ; �#�'<��E� Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/34.78.73.194.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇧🇪 207.175.183.1	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempte ... show more [Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host attempted multiple logins against our emulated Telnet service, then obtained shell access and executed commands. Observed: 2026-10-14 03:41 to 2026-10-14 04:20 UTC \| 64 sessions \| 145 events \| Telnet (port 23) Attack chain: 1. 2 credential attempts: *1/$4 2. Shell access obtained; 1 distinct command executed: PING Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/207.175.183.1.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇰🇷 175.198.62.180	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-10-14 01:38 to 2026-10-14 02:14 UTC \| 56 sessions \| 128 events \| SSH (port 22) Attack chain: 1. 56 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/qwedc, root/asd123,./, postgres/changeme (+26 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/175.198.62.180.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 123.129.152.137	14 Oct 2026	[Honeypot Report] Vulnerability exploitation attempt via HTTP An automated exploitation tool attemp ... show more [Honeypot Report] Vulnerability exploitation attempt via HTTP An automated exploitation tool attempted to exploit CVE-2014-8361. Observed: 2026-10-14 04:36 UTC \| 1 session \| 3 events \| HTTP (port 52869) Attack chain: 1. Exploit attempt: CVE-2014-8361 2. Requested 1 distinct path, including: /picsdesc.xml Classification: scanner \| Signatures: Realtek SDK miniigd SOAP Command Injection, OS Command Injection Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/123.129.152.137.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Web App Attack Port Scan
🇲🇴 125.31.42.146	14 Oct 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-10-14 03:53 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/125.31.42.146.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇹🇭 223.206.240.15	14 Oct 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-10-14 03:10 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/223.206.240.15.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇮🇩 36.77.175.224	14 Oct 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-10-14 02:45 to 2026-10-14 02:46 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/36.77.175.224.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇷🇺 85.116.117.30	14 Oct 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-10-14 01:08 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/85.116.117.30.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇮🇳 103.159.33.98	14 Oct 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-10-14 06:06 to 2026-10-14 06:07 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/103.159.33.98.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇮🇳 103.147.70.131	14 Oct 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-10-14 04:04 to 2026-10-14 04:05 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/103.147.70.131.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇻🇪 200.35.94.45	14 Oct 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-10-14 02:47 to 2026-10-14 02:49 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/200.35.94.45.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇩🇿 154.242.143.53	14 Oct 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-10-14 02:08 to 2026-10-14 02:10 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/154.242.143.53.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇨🇳 219.155.14.20	14 Oct 2026	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal. Observed: 2026-10-14 02:58 to 2026-10-14 06:08 UTC \| 45 sessions \| 707 events \| Telnet (port 23) Attack chain: 1. 45 credential attempts: 666666/666666, admin/1q2w3e, Manager/friend, admin/CenturyL1nk, cuadmin/cu@Hnunicom (+28 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://123.129.32.65:44603/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/219.155.14.20.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇨🇳 218.60.183.2	14 Oct 2026	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), ISP-branded DSL gateway. Observed: 2026-10-14 04:55 to 2026-10-14 05:55 UTC \| 72 sessions \| 1,139 events \| Telnet (port 23) Attack chain: 1. 72 credential attempts: root/hi3518, service/service, admin/epicrouter, root/25802580, root/xmhdipc (+27 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://27.96.228.235:2069/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/218.60.183.2.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇵🇰 153.117.29.187	14 Oct 2026	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), DrayTek router. Observed: 2026-10-14 02:33 to 2026-10-14 05:02 UTC \| 1,114 sessions \| 17,808 events \| Telnet (port 23) Attack chain: 1. 1,114 credential attempts: root/Zte521, telnet/telnet, root/Fireitup, root/dreambox, admin/h@32LuyD (+35 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://175.151.222.225:33901/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/153.117.29.187.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇵🇰 182.190.223.232	14 Oct 2026	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal. Observed: 2026-10-14 05:06 to 2026-10-14 06:09 UTC \| 439 sessions \| 6,607 events \| Telnet (port 23) Attack chain: 1. 411 credential attempts: e8ehome/e8ehome, admin/meinsm, root/adminpass, admin/gw1admin, admin/adminHW (+35 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://105.184.198.135:45633/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/182.190.223.232.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇫🇷 75.119.156.74	14 Oct 2026	[Honeypot Report] Malware dropped following HTTP intrusion An automated malware loader attempted to ... show more [Honeypot Report] Malware dropped following HTTP intrusion An automated malware loader attempted to exploit CVE-2012-1823, then delivered an executable payload. Credentials and request paths match Apache HTTP Server (CGI), PHP-CGI. Observed: 2026-10-14 01:56 UTC \| 1 session \| 93 events \| HTTP (port 80) Attack chain: 1. Exploit attempt: CVE-2012-1823 - PHP-CGI argument injection RCE [CISA KEV] 2. Exploit attempt: CVE-2021-41773 - Apache HTTP Server path traversal to RCE [CISA KEV] 3. Requested 40 distinct paths, including: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh \| /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%... 4. Malicious script dropped: SHA-256 9b7215fd7907a07b7b6601370623a5bcda2ae6f5f896cbfc1ddf5e3e3096dc49, 1,189 bytes, PHP source (likely webshell) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/75.119.156.74.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Web App Attack
🇧🇪 207.175.36.136	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via REDIS A remote host obtained ... show more [Honeypot Report] Unauthorised shell access and command execution via REDIS A remote host obtained shell access and executed commands. Observed: 2026-10-09 05:05 UTC \| 2 sessions \| 10 events \| REDIS (port 6379) Attack chain: 1. Shell access obtained; 5 distinct commands executed: INFO ; CONFIG GET bind ; PUBSUB CHANNELS Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/207.175.36.136.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇳🇬 197.211.52.14	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained shell access and executed commands. Observed: 2026-10-07 15:55 UTC \| 3 sessions \| 12 events \| SMB (port 445) Attack chain: 1. Shell access obtained; 4 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/197.211.52.14.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇧🇪 35.241.140.22	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via REDIS A remote host obtained ... show more [Honeypot Report] Unauthorised shell access and command execution via REDIS A remote host obtained shell access and executed commands. Observed: 2026-10-07 08:03 UTC \| 2 sessions \| 10 events \| REDIS (port 6379) Attack chain: 1. Shell access obtained; 5 distinct commands executed: INFO ; CONFIG GET bind ; PUBSUB CHANNELS Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/35.241.140.22.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇺🇸 172.210.9.220	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP A remote host obtained shell access and executed commands. Observed: 2026-10-07 04:38 to 2026-10-09 13:01 UTC \| 4 sessions \| 12 events \| FTP (port 21) Attack chain: 1. Shell access obtained; 3 distinct commands executed: MGLNDD_[sensor]_21 ; AUTH TLS ; AUTH SSL Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/172.210.9.220.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇧🇪 34.38.203.42	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via REDIS A remote host obtained ... show more [Honeypot Report] Unauthorised shell access and command execution via REDIS A remote host obtained shell access and executed commands. Observed: 2026-10-06 11:52 to 2026-10-06 11:53 UTC \| 2 sessions \| 10 events \| REDIS (port 6379) Attack chain: 1. Shell access obtained; 5 distinct commands executed: INFO ; CONFIG GET bind ; PUBSUB CHANNELS Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/34.38.203.42.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇨🇴 181.225.69.13	14 Oct 2026	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained shell access and executed commands. Observed: 2026-10-06 06:11 to 2026-10-06 06:13 UTC \| 3 sessions \| 12 events \| SMB (port 445) Attack chain: 1. Shell access obtained; 4 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/181.225.69.13.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan