188.166.25.97

Malicious activity detected on Honeypot.

IP matched detection query 20 more in short time bad rqs.

Detected WordPress attack from different servers

wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (88020-193)

$f2bV_matches

Web attack/malicious scanning detected

several attempts to forbidden dns transfers

$f2bV_matches

Brute-force SSH attack with weak creds (mysql, oracle, root, support, ubuntu, user). Go-based and paramiko 4.0.0 clients detected—automated tools. Attack chain: credential guessing→SCP transfers to /dev/shm, /tmp, /var/tmp→sudo password injection for ... show more Brute-force SSH attack with weak creds (mysql, oracle, root, support, ubuntu, user). Go-based and paramiko 4.0.0 clients detected—automated tools. Attack chain: credential guessing→SCP transfers to /dev/shm, /tmp, /var/tmp→sudo password injection for cmd execution. Payload dl from 130[.]12[.]180[.]179/f/aarch64/ via curl/wget with retry logic and --no-check-certificate flag. Execution: sudo bash wrapper→dl binary .b0s→chmod +x→exec. Persistence: .b0s dropped to /.b0s then copied to temp dirs, indicating privilege escalation or successful sudo. Cleanup: rm -rf to remove evidence. Cross-user exploitation: creds oracle/test123 and user/user1 both triggered identical dl/exec sequences across account hierarchy. No confirmed cmd exec success but payload staging completed. C2: 130[.]12[.]180[.]179 serving aarch64 binary—targets ARM systems/IoT. .b0s filename consistent with Linux botnet malware families. show less

SSH honeypot | Privilege Escalation + Auth Attempts (Moderate) | 4 auths (2 users), 20 cmds, 2.5m | python_framework | tactics: remote file download, sudo spray | URLs: hxxp://130[.]12[.]180[.]179/f/[.]b0s | ext IPs: 130[.]12[.]180[.]179

🚨 Recon detected (nft drop) SRC=188.166.25.97 Observed=TCP dpt=22 in=enp0s6 ttl=57 Time=recent(journalctl: 10 minutes ago) Assessment=SSH recon (PORT_SCAN+SSH) — treat as brute-force ONLY if repeated SSH auth failures occur

Mar 4 12:12:12 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=188.166.25.97 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=49885 PROTO=TCP SPT=42696 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0 .. ... show more Mar 4 12:12:12 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=188.166.25.97 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=49885 PROTO=TCP SPT=42696 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0 ... show less

SSH honeypot (Cowrie) attack detected. // Attack phases: system recon, malware drop. // HASSH: 2ec37a7cc8daf20b10e1ad6221061ca5 // SSH client: SSH-2.0-Go // Auth: 10 attempts (10 success, 0 failed). // Creds: root/password | zabbix/12 | centos/passwo ... show more SSH honeypot (Cowrie) attack detected. // Attack phases: system recon, malware drop. // HASSH: 2ec37a7cc8daf20b10e1ad6221061ca5 // SSH client: SSH-2.0-Go // Auth: 10 attempts (10 success, 0 failed). // Creds: root/password | zabbix/12 | centos/password | ec2-user/123123 | support/1234 // Post-exploit: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH a ; echo $HOME // Files dropped: /root/.b0s // SHA256: 076afbb1dfe74b210576f6016c97f2bf12e4d0e1c90cee50d3e8a9b133d18e77 // Malware ID (YARA): Dot16_XMRig [high]: XMRig miner with RandomX JIT — deployed as .16/.b0s/.X0-lock by Dot16 actor show less

list.rtbh.com.tr report: tcp/0

list.rtbh.com.tr report: tcp/0