AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Birdo joined AbuseIPDB in January 2024 and has reported 1,048,831 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇵🇰 125.209.88.110	22 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-02 08:27 to 2026-11-02 09:10 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/125.209.88.110.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇪🇬 156.207.133.76	22 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-02 07:18 to 2026-11-02 07:20 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/156.207.133.76.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇨🇴 181.206.54.6	22 hours ago	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-02 06:38 to 2026-11-02 06:39 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/181.206.54.6.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇫🇷 157.173.121.147	22 hours ago	[Honeypot Report] Vulnerability exploitation attempt via REDIS An automated exploitation tool attem ... show more [Honeypot Report] Vulnerability exploitation attempt via REDIS An automated exploitation tool attempted to exploit CVE-2022-0543, then obtained shell access and executed commands, and finally uploaded a file to the emulated filesystem. Observed: 2026-11-02 05:00 to 2026-11-02 06:13 UTC \| 3 sessions \| 16 events \| REDIS (port 6379) Attack chain: 1. Exploit attempt: CVE-2022-0543 2. Shell access obtained; 7 distinct commands executed: PING ; DBSIZE ; KEYS * 3. File uploaded (not identified as executable): SHA-256 eb23cf90697f9f05686859e31271bbe953122f47714f955b9a8de56dca3d9a5c, 99 bytes, ASCII text, unidentified Technique: CWE-1188 unauthorized credential implant \| Classification: SSH key implant \| Signatures: Redis Unauthenticated RCE Kill Chain, Redis Cron / authorized_keys Persistence Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/157.173.121.147.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking
🇨🇳 42.235.98.30	22 hours ago	[Honeypot Report] Exploitation attempt against known-exploited CVE via HTTP An automated exploitati ... show more [Honeypot Report] Exploitation attempt against known-exploited CVE via HTTP An automated exploitation tool attempted to exploit CVE-2018-10561. Observed: 2026-11-02 08:01 UTC \| 1 session \| 3 events \| HTTP (port 80) Attack chain: 1. Exploit attempt: CVE-2018-10561 - Dasan GPON authentication bypass [CISA KEV] 2. Requested 1 distinct path, including: /GponForm/diag_Form?images/ Classification: scanner \| Signatures: GPON Home Router Command Injection, Dasan GPON diag_Form Command Injection Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/42.235.98.30.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Web App Attack Port Scan
🇵🇰 110.38.12.25	22 hours ago	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal. Observed: 2026-11-02 09:33 to 2026-11-02 11:56 UTC \| 26 sessions \| 377 events \| Telnet (port 23) Attack chain: 1. 26 credential attempts: admin/bayandsl, Administrator/admin, root/Admin, root/gpon, admin/conexant (+15 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://113.254.36.153:50445/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/110.38.12.25.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇨🇳 122.97.215.195	22 hours ago	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), Huawei HG gateway. Observed: 2026-11-02 07:44 to 2026-11-02 12:00 UTC \| 504 sessions \| 8,038 events \| Telnet (port 23) Attack chain: 1. 503 credential attempts: root/jvbzd, mother/fucker, root/12345, support/1234, 1234/1234 (+35 more pairs) 2. Shell access obtained; 12 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://222.142.243.47:37970/i, http://102.33.24.209:48508/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/122.97.215.195.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇵🇰 59.103.216.221	22 hours ago	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal. Observed: 2026-11-02 11:08 to 2026-11-02 12:00 UTC \| 116 sessions \| 1,843 events \| Telnet (port 23) Attack chain: 1. 116 credential attempts: root/Zte521, root/xc3511, support/support, admin/admin, admin/password (+13 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://42.176.37.244:36863/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/59.103.216.221.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇷🇺 93.178.119.71	22 hours ago	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), DrayTek router. Observed: 2026-11-02 11:00 to 2026-11-02 12:00 UTC \| 2,399 sessions \| 37,343 events \| Telnet (port 23) Attack chain: 1. 2,337 credential attempts: admin/1234, admin/conexant, root/, root/admin, root/root (+35 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://119.118.233.253:37448/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/93.178.119.71.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇨🇳 122.97.212.129	22 hours ago	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), DrayTek router. Observed: 2026-11-02 07:44 to 2026-11-02 12:00 UTC \| 539 sessions \| 8,553 events \| Telnet (port 23) Attack chain: 1. 535 credential attempts: root/jvbzd, root/12345, mother/fucker, support/1234, root/1234567890 (+35 more pairs) 2. Shell access obtained; 12 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://222.142.243.47:37970/i, http://102.33.24.209:48508/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/122.97.212.129.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇨🇴 181.48.105.218	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 03:24 to 2026-11-02 03:36 UTC \| 9 sessions \| 18 events \| SSH (port 2222) Attack chain: 1. 9 credential attempts: 345gs5662d34/345gs5662d34, root/qwe123@, test/TEST, ubuntu/ubuntu2024, root/tianjin (+3 more pairs) 2. Shell access obtained; 2 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza Signatures: Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/181.48.105.218.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇭🇰 221.124.3.140	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:56 to 2026-11-02 01:11 UTC \| 9 sessions \| 22 events \| SSH (port 2222) Attack chain: 1. 9 credential attempts: root/wangfei123, online/online123, hz/123456, 345gs5662d34/345gs5662d34, hz/3245gs5662d34 (+4 more pairs) 2. Shell access obtained; 2 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: Host Reconnaissance Commands Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/221.124.3.140.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇺🇸 129.121.138.211	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 03:27 to 2026-11-02 03:35 UTC \| 11 sessions \| 23 events \| SSH (port 2222) Attack chain: 1. 11 credential attempts: 345gs5662d34/345gs5662d34, root/qwe123@, rohit/password, rohit/3245gs5662d34, root/tianjin (+4 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/129.121.138.211.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇺🇸 50.6.206.120	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 03:24 to 2026-11-02 03:35 UTC \| 11 sessions \| 23 events \| SSH (port 2222) Attack chain: 1. 11 credential attempts: 345gs5662d34/345gs5662d34, root/q123456, yogesh/yogesh@123, test123/test123, test123/3245gs5662d34 (+4 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/50.6.206.120.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇪🇸 82.213.182.225	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:58 to 2026-11-02 01:05 UTC \| 11 sessions \| 23 events \| SSH (port 2222) Attack chain: 1. 11 credential attempts: 345gs5662d34/345gs5662d34, admin/bluffmaster, jesus/jesus, alif/alif, alif/3245gs5662d34 (+4 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/82.213.182.225.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇮🇳 125.22.249.36	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:55 to 2026-11-02 01:06 UTC \| 11 sessions \| 23 events \| SSH (port 2222) Attack chain: 1. 11 credential attempts: 345gs5662d34/345gs5662d34, george/george, jesus/jesus, alif/alif, alif/3245gs5662d34 (+4 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/125.22.249.36.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇹🇷 213.142.159.216	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:53 to 2026-11-02 01:04 UTC \| 9 sessions \| 22 events \| SSH (port 2222) Attack chain: 1. 9 credential attempts: 345gs5662d34/345gs5662d34, ftpuser/ftpuser@123, apm/apm, root/2020, root/admin1234!@ (+3 more pairs) 2. Shell access obtained; 3 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: Persistence Mechanism, Host Reconnaissance Commands Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/213.142.159.216.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇮🇳 122.168.123.73	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 01:51 to 2026-11-02 02:08 UTC \| 12 sessions \| 32 events \| SSH (port 22) Attack chain: 1. 12 credential attempts: 345gs5662d34/345gs5662d34, frank/123, user/000000, ahsan/3245gs5662d34, root/3245gs5662d34 (+3 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/122.168.123.73.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇸🇾 185.225.41.192	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 03:26 to 2026-11-02 03:37 UTC \| 13 sessions \| 29 events \| SSH (port 2222) Attack chain: 1. 13 credential attempts: 345gs5662d34/345gs5662d34, root/tianjin, rohit/password, rohit/3245gs5662d34, root/qwe123@ (+5 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/185.225.41.192.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇦🇷 190.105.160.5	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:57 to 2026-11-02 01:12 UTC \| 13 sessions \| 29 events \| SSH (port 2222) Attack chain: 1. 13 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, shared/shared, ts/123, ts/3245gs5662d34 (+4 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/190.105.160.5.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇰🇷 47.80.19.110	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:56 to 2026-11-02 01:05 UTC \| 13 sessions \| 29 events \| SSH (port 2222) Attack chain: 1. 13 credential attempts: 345gs5662d34/345gs5662d34, gerrit/gerrit, alexis/1234, alexis/3245gs5662d34, eddie/eddie (+5 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/47.80.19.110.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇺🇸 129.121.141.166	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 00:52 to 2026-11-02 01:03 UTC \| 13 sessions \| 29 events \| SSH (port 2222) Attack chain: 1. 13 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, ftpuser/ftpuser@123, apm/apm, apm/3245gs5662d34 (+4 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/129.121.141.166.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇭🇰 152.32.191.226	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-10-30 07:00 to 2026-11-02 03:36 UTC \| 19 sessions \| 43 events \| SSH (port 2222) Attack chain: 1. 19 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, intel/123, intel/3245gs5662d34, root1/root (+8 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/152.32.191.226.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇦 85.217.149.66	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via ADB, HTTP, REDIS and Telnet A ... show more [Honeypot Report] Unauthorised shell access and command execution via ADB, HTTP, REDIS and Telnet A remote host probed for vulnerable web applications, then obtained shell access and executed commands. Observed: 2026-10-30 17:27 to 2026-11-02 05:29 UTC \| 4 sessions \| 15 events \| ADB/HTTP/REDIS/Telnet (port 23, 81, 5555, 6379) Attack chain: 1. Requested 2 distinct paths, including: / \| /favicon.ico 2. Shell access obtained; 4 distinct commands executed: PING ; INFO ; NONEXISTENT Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/85.217.149.66.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Web App Attack Port Scan
🇮🇳 182.70.254.196	02 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-02 01:46 to 2026-11-02 02:08 UTC \| 28 sessions \| 59 events \| SSH (port 22) Attack chain: 1. 28 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, shawn/123, aryan/aryan@123, sam/sam1234 (+15 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/182.70.254.196.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force