AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Birdo joined AbuseIPDB in January 2024 and has reported 1,048,791 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇮🇳 125.22.249.36	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:55 to 2026-11-02 01:06 UTC \| 11 sessions \| 23 events \| SSH (port 2222) Attack chain: 1. 11 credential attempts: 345gs5662d34/345gs5662d34, george/george, jesus/jesus, alif/alif, alif/3245gs5662d34 (+4 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/125.22.249.36.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇹🇷 213.142.159.216	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:53 to 2026-11-02 01:04 UTC \| 9 sessions \| 22 events \| SSH (port 2222) Attack chain: 1. 9 credential attempts: 345gs5662d34/345gs5662d34, ftpuser/ftpuser@123, apm/apm, root/2020, root/admin1234!@ (+3 more pairs) 2. Shell access obtained; 3 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: Persistence Mechanism, Host Reconnaissance Commands Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/213.142.159.216.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇮🇳 122.168.123.73	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 01:51 to 2026-11-02 02:08 UTC \| 12 sessions \| 32 events \| SSH (port 22) Attack chain: 1. 12 credential attempts: 345gs5662d34/345gs5662d34, frank/123, user/000000, ahsan/3245gs5662d34, root/3245gs5662d34 (+3 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/122.168.123.73.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇸🇾 185.225.41.192	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 03:26 to 2026-11-02 03:37 UTC \| 13 sessions \| 29 events \| SSH (port 2222) Attack chain: 1. 13 credential attempts: 345gs5662d34/345gs5662d34, root/tianjin, rohit/password, rohit/3245gs5662d34, root/qwe123@ (+5 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/185.225.41.192.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇦🇷 190.105.160.5	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:57 to 2026-11-02 01:12 UTC \| 13 sessions \| 29 events \| SSH (port 2222) Attack chain: 1. 13 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, shared/shared, ts/123, ts/3245gs5662d34 (+4 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/190.105.160.5.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇰🇷 47.80.19.110	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:56 to 2026-11-02 01:05 UTC \| 13 sessions \| 29 events \| SSH (port 2222) Attack chain: 1. 13 credential attempts: 345gs5662d34/345gs5662d34, gerrit/gerrit, alexis/1234, alexis/3245gs5662d34, eddie/eddie (+5 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/47.80.19.110.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇺🇸 129.121.141.166	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:52 to 2026-11-02 01:03 UTC \| 13 sessions \| 29 events \| SSH (port 2222) Attack chain: 1. 13 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, ftpuser/ftpuser@123, apm/apm, apm/3245gs5662d34 (+4 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/129.121.141.166.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇭🇰 152.32.191.226	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-10-30 07:00 to 2026-11-02 03:36 UTC \| 19 sessions \| 43 events \| SSH (port 2222) Attack chain: 1. 19 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, intel/123, intel/3245gs5662d34, root1/root (+8 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/152.32.191.226.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇦 85.217.149.66	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via ADB, HTTP, REDIS and Telnet A ... show more [Honeypot Report] Unauthorised shell access and command execution via ADB, HTTP, REDIS and Telnet A remote host probed for vulnerable web applications, then obtained shell access and executed commands. Observed: 2026-10-30 17:27 to 2026-11-02 05:29 UTC \| 4 sessions \| 15 events \| ADB/HTTP/REDIS/Telnet (port 23, 81, 5555, 6379) Attack chain: 1. Requested 2 distinct paths, including: / \| /favicon.ico 2. Shell access obtained; 4 distinct commands executed: PING ; INFO ; NONEXISTENT Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/85.217.149.66.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Web App Attack Port Scan
🇮🇳 182.70.254.196	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 01:46 to 2026-11-02 02:08 UTC \| 28 sessions \| 59 events \| SSH (port 22) Attack chain: 1. 28 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, shawn/123, aryan/aryan@123, sam/sam1234 (+15 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/182.70.254.196.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇴 177.93.61.202	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 04:13 to 2026-11-02 04:35 UTC \| 39 sessions \| 87 events \| SSH (port 22) Attack chain: 1. 39 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/nas, root/TempPass123, teamspeak/teamspeak22 (+20 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/177.93.61.202.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇯🇵 133.88.104.87	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 05:28 to 2026-11-02 05:51 UTC \| 41 sessions \| 93 events \| SSH (port 2222) Attack chain: 1. 41 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, ubuntu/P@ssw0rd123!, admin/@dm!n, root/sally (+20 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/133.88.104.87.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 58.57.240.186	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host brute-forced our emulated SMB service, then obtained shell access and executed commands. Observed: 2026-11-02 03:45 to 2026-11-02 05:44 UTC \| 3,110 sessions \| 15,541 events \| SMB (port 445) Attack chain: 1. 3,106 credential attempts: administrator/ 2. Shell access obtained; 2 distinct commands executed: SMB1 NEGOTIATE (3 dialects) ; SMB2 NEGOTIATE (3 dialects) Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/58.57.240.186.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇹🇼 114.37.2.188	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host brute-forced our emulated SMB service, then obtained shell access and executed commands. Observed: 2026-11-01 23:47 to 2026-11-02 02:46 UTC \| 3,119 sessions \| 15,586 events \| SMB (port 445) Attack chain: 1. 3,115 credential attempts: administrator/ 2. Shell access obtained; 2 distinct commands executed: SMB1 NEGOTIATE (3 dialects) ; SMB2 NEGOTIATE (3 dialects) Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/114.37.2.188.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇮🇷 81.29.245.77	20 hours ago	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host brute-forced our emulated SMB service, then obtained shell access and executed commands. Observed: 2026-11-02 04:59 to 2026-11-02 05:04 UTC \| 413 sessions \| 2,069 events \| SMB (port 445) Attack chain: 1. 408 credential attempts: Administrator/, PC-3862-3838\new/, for/, admin/, ahmadzadeh/ (+3 more pairs) 2. Shell access obtained; 8 distinct commands executed: SMB1 NEGOTIATE (3 dialects) ; SMB2 NEGOTIATE (3 dialects) ; TREE_CONNECT \\<target>\IPC$ Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/81.29.245.77.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇨🇳 114.66.37.74	20 hours ago	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader attempted to log in to our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Observed: 2026-11-02 05:40 UTC \| 1 session \| 13 events \| Telnet (port 23) Attack chain: 1. 1 credential attempt: admin/admin 2. Shell access obtained; 8 distinct commands executed: id ; cat /etc/passwd ; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A" 3. Payload retrieval attempted from: https://217.60.102.5/sh) Technique: CWE-78 OS command injection \| Classification: malware loader \| Signatures: Host Reconnaissance Commands, Download-and-Execute Payload Chain Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/114.66.37.74.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Brute-Force
🇨🇳 58.44.130.180	20 hours ago	[Honeypot Report] Vulnerability exploitation attempt via HTTP An automated exploitation tool attemp ... show more [Honeypot Report] Vulnerability exploitation attempt via HTTP An automated exploitation tool attempted to exploit CVE-2014-8361. Observed: 2026-11-02 04:45 UTC \| 1 session \| 3 events \| HTTP (port 52869) Attack chain: 1. Exploit attempt: CVE-2014-8361 2. Requested 1 distinct path, including: /picsdesc.xml Classification: scanner \| Signatures: Realtek SDK miniigd SOAP Command Injection, OS Command Injection Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/58.44.130.180.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Web App Attack Port Scan
🇺🇸 37.19.221.154	20 hours ago	[Honeypot Report] Vulnerability exploitation attempt via REDIS An automated exploitation tool attem ... show more [Honeypot Report] Vulnerability exploitation attempt via REDIS An automated exploitation tool attempted to exploit CVE-2022-0543, then obtained shell access and executed commands. Observed: 2026-11-02 04:13 UTC \| 1 session \| 5 events \| REDIS (port 6379) Attack chain: 1. Exploit attempt: CVE-2022-0543 2. Shell access obtained; 3 distinct commands executed: PING ; CONFIG SET ; SLAVEOF Classification: scanner \| Signatures: Redis Unauthenticated RCE Kill Chain Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/37.19.221.154.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇲🇾 121.122.138.3	20 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-02 01:23 UTC \| 3 sessions \| 13 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 5 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/121.122.138.3.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇹🇳 41.226.66.8	20 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-02 04:17 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/41.226.66.8.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇷🇺 188.17.174.3	20 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-02 05:56 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/188.17.174.3.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇧🇷 177.223.39.145	20 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-02 03:10 to 2026-11-02 03:11 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/177.223.39.145.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇻🇳 14.164.7.163	20 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-02 01:01 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/14.164.7.163.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇮🇩 39.194.1.143	20 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-02 00:52 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/39.194.1.143.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇮🇩 103.156.14.198	20 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-02 04:38 to 2026-11-02 04:40 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.156.14.198.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan