Attacker from 77.232.38.170 conducted 195 SSH sessions over approximately 16 minutes using default c ...
show moreAttacker from 77.232.38.170 conducted 195 SSH sessions over approximately 16 minutes using default credentials (support/support) via a Go-based SSH client, with no shell commands executed but repeated port forwarding attempts to external IP 125.209.233.34 on port 993 (IMAPS), indicating potential reconnaissance or setup for command and control tunneling infrastructure.
show less
Attacker from 77.232.38.170 conducted 81 SSH sessions over 3 minutes using the support/support crede ...
show moreAttacker from 77.232.38.170 conducted 81 SSH sessions over 3 minutes using the support/support credential pair with a Go-based SSH client, with no interactive commands executed. The attacker repeatedly attempted port forwarding to 125.209.233.34:993 (IMAPS) across multiple sessions, suggesting reconnaissance or preparation for lateral movement or data exfiltration, with no malware or persistence artifacts recovered.
show less
The attacker conducted 410 SSH sessions over approximately 16 minutes using weak credentials (suppor ...
show moreThe attacker conducted 410 SSH sessions over approximately 16 minutes using weak credentials (support/support) via a Go SSH client, with no interactive commands executed. All activity focused on repeated port forwarding attempts to external IP 125.209.233.34 on port 993 (IMAPS), suggesting reconnaissance or setup for tunneling traffic through the compromised system for potential command and control or data exfiltration purposes.
show less
SSH honeypot attack from 77.232.38.170 on 2026-02-28 involving 358 sessions authenticated with suppo ...
show moreSSH honeypot attack from 77.232.38.170 on 2026-02-28 involving 358 sessions authenticated with support/support credentials using Go SSH client. The attacker attempted port forwarding to multiple external hosts including 125.209.233.34 on port 993 (IMAPS) and 18.165.140.93 on port 443, suggesting reconnaissance or lateral movement capabilities, though no command execution or malware artifacts were recovered during the attack window.
show less
Attacker conducted 344 SSH sessions over 14 minutes using support/support credentials with a Go-base ...
show moreAttacker conducted 344 SSH sessions over 14 minutes using support/support credentials with a Go-based SSH client, with no command execution but multiple port forwarding attempts targeting 125.209.233.34:993, suggesting reconnaissance or SOCKS proxy establishment activity.
show less
IP 77.232.38.170 conducted 226 SSH sessions over 14 minutes using the Go SSH client with default cre ...
show moreIP 77.232.38.170 conducted 226 SSH sessions over 14 minutes using the Go SSH client with default credentials (support/support), establishing port forwarding tunnels to external IP 125.209.233.34 on port 993 (IMAPS) in at least five separate attempts, indicating potential credential stuffing and unauthorized tunnel establishment for mail server reconnaissance or exfiltration purposes.
show less
Attacker from 77.232.38.170 established 3 SSH sessions using support/support credentials via Go SSH ...
show moreAttacker from 77.232.38.170 established 3 SSH sessions using support/support credentials via Go SSH client and attempted port forwarding to external IPs on ports 993 and 80, indicating potential command and control communication or data exfiltration setup, though no commands were executed during the observed sessions.
show less
This SSH honeypot activity involved 3 sessions from IP 77.232.38.170 using Go-based SSH client with ...
show moreThis SSH honeypot activity involved 3 sessions from IP 77.232.38.170 using Go-based SSH client with credentials support/support. The attacker attempted port forwarding to external IP 125.209.233.34 on port 993 (IMAPS) in multiple instances, suggesting potential exfiltration or command-and-control communication attempts. No commands were executed and no malware artifacts were recovered during the attack window.
show less
Attacker from 77.232.38.170 established 2 SSH sessions using Go-based SSH client with credentials su ...
show moreAttacker from 77.232.38.170 established 2 SSH sessions using Go-based SSH client with credentials support/support, attempted port forwarding to 125.209.233.34:993 (likely IMAPS), but executed no shell commands during the 4-minute attack window.
show less
Attacker at 77.232.38.170 established 3 SSH sessions using support/support credentials with a Go-bas ...
show moreAttacker at 77.232.38.170 established 3 SSH sessions using support/support credentials with a Go-based SSH client, with no commands executed but multiple port forwarding attempts to external hosts on ports 443 and 993, suggesting reconnaissance or setup for proxy-based command and control infrastructure.
show less
Single SSH session using default credentials (support/support) from a Go-based SSH client with no co ...
show moreSingle SSH session using default credentials (support/support) from a Go-based SSH client with no commands executed, but three port forwarding attempts targeting IMAP/HTTPS services on external IPs (125.209.233.34:993, 91.206.14.139:443, 176.114.124.24:443), suggesting reconnaissance or lateral movement probing.
show less