AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Birdo joined AbuseIPDB in January 2024 and has reported 1,049,231 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇨🇳 115.190.245.176	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted t ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-10-30 14:31 to 2026-10-30 16:44 UTC \| 1 session \| 5 events \| SSH (port 22) Attack chain: 1. 1 credential attempt: intel/123 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/115.190.245.176.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 106.12.4.208	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted t ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-10-30 07:07 UTC \| 1 session \| 5 events \| SSH (port 2222) Attack chain: 1. 1 credential attempt: intel/123 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/106.12.4.208.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 120.48.53.156	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 01:16 UTC \| 2 sessions \| 6 events \| SSH (port 2222) Attack chain: 1. 2 credential attempts: root/---fuck_you----, root/123456 2. Shell access obtained; 1 distinct command executed: uname -s -m Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/120.48.53.156.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 106.124.135.239	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 00:13 UTC \| 2 sessions \| 6 events \| SSH (port 2222) Attack chain: 1. 2 credential attempts: root/------fuck------, root/Test@2022 2. Shell access obtained; 1 distinct command executed: uname -s -m Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/106.124.135.239.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇨🇳 118.196.103.2	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-03 14:23 UTC \| 2 sessions \| 6 events \| SSH (port 22) Attack chain: 1. 2 credential attempts: root/---fuck_you----, root/123456 2. Shell access obtained; 1 distinct command executed: uname -s -m Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/118.196.103.2.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇭🇰 43.103.4.191	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted m ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-03 04:32 UTC \| 2 sessions \| 6 events \| SSH (port 2222) Attack chain: 1. 2 credential attempts: root/---fuck_you----, root/123456 2. Shell access obtained; 1 distinct command executed: uname -s -m Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/43.103.4.191.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇹🇼 34.81.19.39	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via Telnet An automated malware l ... show more [Honeypot Report] Unauthorised shell access and command execution via Telnet An automated malware loader attempted multiple logins against our emulated Telnet service, then obtained shell access and executed commands. Observed: 2026-11-04 05:10 to 2026-11-04 05:43 UTC \| 5 sessions \| 20 events \| Telnet (port 23) Attack chain: 1. 3 credential attempts: root/, root/root 2. Shell access obtained; 2 distinct commands executed: echo SHELL_TEST ; /bin/busybox TEST Classification: IoT botnet loader \| Signatures: Mirai/IoT Botnet Busybox Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/34.81.19.39.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking IoT Targeted Brute-Force
🇺🇸 73.21.133.161	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted t ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host attempted to log in to our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 04:15 to 2026-11-04 04:17 UTC \| 1 session \| 13 events \| SSH (port 22) Attack chain: 1. 1 credential attempt: usuario/1234 2. Shell access obtained; 9 distinct commands executed: /ip cloud print ; ifconfig ; uname -a Signatures: Host Reconnaissance Commands Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/73.21.133.161.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇺🇸 73.136.221.232	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via ADB A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via ADB A remote host obtained shell access and executed commands. Observed: 2026-11-03 23:52 to 2026-11-04 05:01 UTC \| 37 sessions \| 111 events \| ADB (port 5555) Attack chain: 1. Shell access obtained; 1 distinct command executed: echo hi Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/73.136.221.232.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇺🇸 66.132.159.101	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via HTTP and REDIS A remote host ... show more [Honeypot Report] Unauthorised shell access and command execution via HTTP and REDIS A remote host probed for vulnerable web applications, then obtained shell access and executed commands. Observed: 2026-11-02 12:52 to 2026-11-04 01:58 UTC \| 4 sessions \| 15 events \| HTTP/REDIS (port 6379, 7547) Attack chain: 1. Requested 3 distinct paths, including: /login \| /favicon.ico 2. Shell access obtained; 4 distinct commands executed: PING ; INFO ; NONEXISTENT Classification: scanner \| Signatures: Automated Scanner User-Agent Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/66.132.159.101.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Web App Attack Port Scan
🇳🇱 95.85.34.71	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 05:28 to 2026-11-04 06:00 UTC \| 13 sessions \| 53 events \| SSH (port 22) Attack chain: 1. 13 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, root/alohomora, root/Fy123456, myuser/1234 (+3 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/95.85.34.71.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇺🇸 38.110.46.235	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via FTP, HTTP and Telnet A remote ... show more [Honeypot Report] Unauthorised shell access and command execution via FTP, HTTP and Telnet A remote host probed for vulnerable web applications, then obtained shell access and executed commands. Observed: 2026-10-31 01:56 to 2026-11-04 02:11 UTC \| 3 sessions \| 9 events \| FTP/HTTP/Telnet (port 21, 23, 80) Attack chain: 1. Requested 1 distinct path, including: / 2. Shell access obtained; 2 distinct commands executed: AUTH TLS ; AUTH SSL Classification: scanner Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/38.110.46.235.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Web App Attack Port Scan
🇸🇬 72.46.87.211	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host brute-fo ... show more [Honeypot Report] Unauthorised shell access and command execution via Telnet A remote host brute-forced our emulated Telnet service, then obtained shell access and executed commands. Observed: 2026-11-04 00:46 to 2026-11-04 05:59 UTC \| 16 sessions \| 112 events \| Telnet (port 23) Attack chain: 1. 16 credential attempts: admin/admin, telnetadmin/telnetadmin, default/default 2. Shell access obtained; 3 distinct commands executed: uname -m ; cat /proc ; > Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/72.46.87.211.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Brute-Force
🇨🇦 50.6.243.128	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 01:42 to 2026-11-04 02:52 UTC \| 43 sessions \| 183 events \| SSH (port 22) Attack chain: 1. 43 credential attempts: rootssssss23424123123/rootssssss23424123123, root/root3245gs5662d34111111111, root/Li147258, admin/qwertyu, admin/root3245gs5662d34111111111 (+21 more pairs) 2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh Signatures: SSH Key Lockdown (Outlaw-style) Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/50.6.243.128.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇳🇱 77.239.124.151	04 Nov 2026	[Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-force ... show more [Honeypot Report] Unauthorised shell access and command execution via SSH A remote host brute-forced our emulated SSH service, then obtained shell access and executed commands. Observed: 2026-11-04 05:49 to 2026-11-04 06:01 UTC \| 130 sessions \| 775 events \| SSH (port 22) Attack chain: 1. 130 credential attempts: erpnext/erpnext, sb/sb, deploy/qwerty123, support/asdf1234, claude/123 (+35 more pairs) 2. Shell access obtained; 2 distinct commands executed: uname -s -v -n -r -m ; uname -m \| awk '{printf $1}' Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/77.239.124.151.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking SSH Brute-Force
🇵🇰 103.26.86.242	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via HTTP An automated exploitation tool attemp ... show more [Honeypot Report] Vulnerability exploitation attempt via HTTP An automated exploitation tool attempted to exploit CVE-2014-8361. Observed: 2026-11-04 01:20 UTC \| 1 session \| 3 events \| HTTP (port 52869) Attack chain: 1. Exploit attempt: CVE-2014-8361 2. Requested 1 distinct path, including: /picsdesc.xml Classification: scanner \| Signatures: Realtek SDK miniigd SOAP Command Injection, OS Command Injection Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.26.86.242.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Web App Attack Port Scan
🇨🇳 202.105.31.90	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 00:18 to 2026-11-04 00:20 UTC \| 3 sessions \| 10 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 4 distinct commands executed: SMB1 NEGOTIATE (6 dialects) ; SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/202.105.31.90.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇷🇺 185.90.101.64	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 05:48 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/185.90.101.64.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇮🇩 103.235.181.196	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 05:46 to 2026-11-04 05:47 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.235.181.196.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇿🇦 169.0.224.113	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 03:17 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/169.0.224.113.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇹🇷 176.237.204.113	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 02:54 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/176.237.204.113.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇹🇼 1.169.223.190	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 01:38 UTC \| 3 sessions \| 14 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/1.169.223.190.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇭🇰 5.187.38.30	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via HTTP An automated exploitation tool attemp ... show more [Honeypot Report] Vulnerability exploitation attempt via HTTP An automated exploitation tool attempted to exploit CVE-2021-36260. Credentials and request paths match Hikvision / ONVIF camera. Observed: 2026-11-02 14:50 to 2026-11-04 03:40 UTC \| 19 sessions \| 57 events \| HTTP (port 80, 81) Attack chain: 1. Exploit attempt: CVE-2021-36260 2. Requested 1 distinct path, including: /SDK/webLanguage Classification: scanner \| Signatures: Hikvision Web Server Command Injection Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/5.187.38.30.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Web App Attack Port Scan
🇮🇹 83.217.182.240	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 05:26 to 2026-11-04 05:27 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/83.217.182.240.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇩🇿 154.241.25.201	04 Nov 2026	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-11-04 04:56 to 2026-11-04 04:58 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/154.241.25.201.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan