🇷🇺
91.185.75.244
17 Sep 2026
SSH honeypot (Cowrie) recorded 54 events over 35m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 54 events over 35m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner). Usernames tried: admin, ctarazona, hector, helpdesk, jagdish, light. Passwords tried: 123, 123456, 123456Aa?, 1qazXSW@. Wazuh rules: 100100,100101,100117.
show less
Port Scan
Brute-Force
SSH
🇧🇷
201.71.192.108
17 Sep 2026
SSH honeypot (Cowrie) recorded 72 events over 30m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 72 events over 30m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner). Usernames tried: azureuser, ftp_user, git, gitlab, harsh, jose. Passwords tried: 1, 123, 123456, 12345678. Wazuh rules: 100100,100101,100117.
show less
Port Scan
Brute-Force
SSH
🇺🇸
107.180.88.176
17 Sep 2026
SSH honeypot (Cowrie) recorded 90 events over 36m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 90 events over 36m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner). Usernames tried: admin, azureuser, dockeruser, fs, gitlab, manish. Passwords tried: 123, 123456, 12345678, 123456789m. Wazuh rules: 100100,100101,100117.
show less
Port Scan
Brute-Force
SSH
🇺🇸
109.160.32.103
17 Sep 2026
SSH honeypot (Cowrie) recorded 1508 events over 54m. Activity: SSH connection to honeypot; SSH crede ...
show more
SSH honeypot (Cowrie) recorded 1508 events over 54m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner); connection flood; post-auth command execution; successful honeypot login. Usernames tried: AdminGPON, a, abigail, actian, admin, admin1. Passwords tried: !@, !Q2w3e4r, !Q@W3e4r, !QAZ2wsx. Commands: uname -s -v -n -r -m Wazuh rules: 100100,100101,100102,100103,100113,100117.
show less
Port Scan
Hacking
Brute-Force
SSH
🇺🇸
66.132.172.176
17 Sep 2026
CrowdSec detected
Brute-Force
SSH
🇫🇮
2.29.38.95
17 Sep 2026
SSH honeypot (Cowrie) recorded 6 events over 3m. Activity: SSH connection to honeypot; SSH credentia ...
show more
SSH honeypot (Cowrie) recorded 6 events over 3m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner); successful honeypot login. Usernames tried: admin, user. Passwords tried: admin, user. Wazuh rules: 100100,100101,100102,100117.
show less
Port Scan
Brute-Force
SSH
🇷🇴
80.94.92.234
17 Sep 2026
SSH honeypot (Cowrie) recorded 21 events over 11m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 21 events over 11m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner); post-auth command execution; root credential accepted. Usernames tried: root. Passwords tried: 12345, 123456, 1234567, 12345678. Commands: uname -s -v -n -m 2 > /dev/null || /bin/uname -s -v -n -m 2 > /dev/null || /usr/bin/uname -s -v -n -m 2 > /dev/null || b | export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || | export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C; uname=$(for c in una Wazuh rules: 100100,100101,100103,100106,100117.
show less
Port Scan
Hacking
Brute-Force
SSH
🇷🇴
92.118.39.71
16 Sep 2026
SSH honeypot (Cowrie) recorded 21 events over 11m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 21 events over 11m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner). Usernames tried: apache, backup. Passwords tried: 123, 1234, 12345678, admin. Wazuh rules: 100100,100101,100117.
show less
Port Scan
Brute-Force
SSH
🇳🇱
77.239.124.184
16 Sep 2026
SSH honeypot (Cowrie) recorded 270 events over 8m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 270 events over 8m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner); connection flood. Usernames tried: admin, ai, andrew, apm, app, avalanche. Passwords tried: !QAZ2wsx3edc4rfv, 0000, 051178, 0987654321. Wazuh rules: 100100,100101,100113,100117.
show less
Port Scan
Brute-Force
SSH
🇺🇸
109.160.32.30
16 Sep 2026
SSH honeypot (Cowrie) recorded 429 events over 12m. Activity: SSH connection to honeypot; SSH creden ...
show more
SSH honeypot (Cowrie) recorded 429 events over 12m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner); connection flood. Usernames tried: admin, ansible, appuser, arma3server, backup, bob. Passwords tried: 04041987, 1, 123, 123123. Wazuh rules: 100100,100101,100113,100117.
show less
Port Scan
Brute-Force
SSH
🇧🇷
177.104.180.43
16 Sep 2026
CrowdSec detected
Brute-Force
SSH
🇷🇴
193.46.255.86
16 Sep 2026
SSH honeypot (Cowrie) recorded 8 events over 78m. Activity: SSH connection to honeypot; SSH credenti ...
show more
SSH honeypot (Cowrie) recorded 8 events over 78m. Activity: SSH connection to honeypot; SSH credential brute-force. Usernames tried: admin, root. Passwords tried: 12345678, Aa112211, Aa123456, goodlife. Wazuh rules: 100100,100101.
show less
Brute-Force
SSH
🇷🇴
2.57.121.25
16 Sep 2026
SSH honeypot (Cowrie) recorded 8 events over 63m. Activity: SSH connection to honeypot; SSH credenti ...
show more
SSH honeypot (Cowrie) recorded 8 events over 63m. Activity: SSH connection to honeypot; SSH credential brute-force. Usernames tried: admin. Passwords tried: orange12, oscar123, parking, parliament. Wazuh rules: 100100,100101.
show less
Brute-Force
SSH
🇱🇹
77.90.185.17
16 Sep 2026
SSH honeypot (Cowrie) recorded 10 events over 1m. Activity: SSH connection to honeypot; proxy relay ...
show more
SSH honeypot (Cowrie) recorded 10 events over 1m. Activity: SSH connection to honeypot; proxy relay attempt through honeypot; root credential accepted. Usernames tried: root. Passwords tried: 123456. Attempted proxy relay to: 142.251.151.119:443, 142.251.155.119:443, 23.197.161.53:443, 52.211.218.56:443 Wazuh rules: 100100,100106,100121.
show less
Open Proxy
Brute-Force
SSH
🇳🇱
94.154.43.69
16 Sep 2026
SSH honeypot (Cowrie) recorded 12 events over 30m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 12 events over 30m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner). Usernames tried: admin. Passwords tried: admin. Wazuh rules: 100100,100101,100117.
show less
Port Scan
Brute-Force
SSH
🇷🇴
2.57.122.168
16 Sep 2026
SSH honeypot (Cowrie) recorded 40 events over 45m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 40 events over 45m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner); post-auth command execution; root credential accepted. Usernames tried: root. Passwords tried: 111111, 123, 123123, 123321. Commands: uname -s -v -n -m 2 > /dev/null || /bin/uname -s -v -n -m 2 > /dev/null || /usr/bin/uname -s -v -n -m 2 > /dev/null || b | export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || | export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C; uname=$(for c in una Wazuh rules: 100100,100101,100103,100106,100117.
show less
Port Scan
Hacking
Brute-Force
SSH
🇱🇹
77.90.185.20
16 Sep 2026
SSH honeypot (Cowrie) recorded 137 events over 9m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 137 events over 9m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner); connection flood. Usernames tried: admin, administrator, ae, bot, cisco, info. Passwords tried: 010203, 111111, 123, 123.321. Wazuh rules: 100100,100101,100113,100117.
show less
Port Scan
Brute-Force
SSH
🇫🇮
193.187.110.213
16 Sep 2026
SSH honeypot (Cowrie) recorded 6 events over 61m. Activity: SSH connection to honeypot; SSH credenti ...
show more
SSH honeypot (Cowrie) recorded 6 events over 61m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner). Usernames tried: root. Passwords tried: 999999, boss. Wazuh rules: 100100,100101,100117.
show less
Port Scan
Brute-Force
SSH
🇨🇳
124.161.224.81
16 Sep 2026
SSH honeypot (Cowrie) recorded 8 events over 1m. Activity: SSH connection to honeypot; SSH credentia ...
show more
SSH honeypot (Cowrie) recorded 8 events over 1m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner); post-auth command execution; root credential accepted. Usernames tried: root. Passwords tried: ---fuck_you----, 123456. Commands: uname -s -m Wazuh rules: 100100,100101,100103,100106,100117.
show less
Port Scan
Hacking
Brute-Force
SSH
🇳🇱
45.148.10.183
16 Sep 2026
SSH honeypot (Cowrie) recorded 28 events over 31m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 28 events over 31m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner). Usernames tried: gpt4all, jan, llama.cpp, ollama, sol, solana. Passwords tried: 123, 1234, gpt4all, jan. Wazuh rules: 100100,100101,100117.
show less
Port Scan
Brute-Force
SSH
🇺🇸
156.232.10.218
16 Sep 2026
SSH honeypot (Cowrie) recorded 120 events over 40m. Activity: SSH connection to honeypot; SSH creden ...
show more
SSH honeypot (Cowrie) recorded 120 events over 40m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner). Usernames tried: admin, alfalak, dev, elsearch, gunicorn, hector. Passwords tried: 1, 123, 123123, 1234. Wazuh rules: 100100,100101,100117.
show less
Port Scan
Brute-Force
SSH
🇵🇱
176.53.159.196
16 Sep 2026
SSH honeypot (Cowrie) recorded 8 events over 74m. Activity: SSH connection to honeypot; automated SS ...
show more
SSH honeypot (Cowrie) recorded 8 events over 74m. Activity: SSH connection to honeypot; automated SSH client (scanner banner); proxy relay attempt through honeypot; root credential accepted. Usernames tried: root. Passwords tried: root. Attempted proxy relay to: 1.1.1.1:53 Wazuh rules: 100100,100106,100117,100121.
show less
Open Proxy
Port Scan
Brute-Force
SSH
🇷🇴
92.118.39.49
16 Sep 2026
SSH honeypot (Cowrie) recorded 40 events over 35m. Activity: SSH connection to honeypot; SSH credent ...
show more
SSH honeypot (Cowrie) recorded 40 events over 35m. Activity: SSH connection to honeypot; SSH credential brute-force; automated SSH client (scanner banner); post-auth command execution; root credential accepted. Usernames tried: root. Passwords tried: 1, 12, 123, 1234. Commands: uname -s -v -n -m 2 > /dev/null || /bin/uname -s -v -n -m 2 > /dev/null || /usr/bin/uname -s -v -n -m 2 > /dev/null || b | export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || | export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C; uname=$(for c in una Wazuh rules: 100100,100101,100103,100106,100117.
show less
Port Scan
Hacking
Brute-Force
SSH
🇷🇴
2.57.121.112
16 Sep 2026
SSH honeypot (Cowrie) recorded 6 events over 1m. Activity: SSH connection to honeypot; SSH credentia ...
show more
SSH honeypot (Cowrie) recorded 6 events over 1m. Activity: SSH connection to honeypot; SSH credential brute-force. Usernames tried: jarek. Passwords tried: jarek, jarek1, jarek123, jarek1234. Wazuh rules: 100100,100101.
show less
Brute-Force
SSH
🇵🇰
103.82.121.13
16 Sep 2026
SSH honeypot (Cowrie) recorded 11 events over 2m. Activity: SSH connection to honeypot; connection f ...
show more
SSH honeypot (Cowrie) recorded 11 events over 2m. Activity: SSH connection to honeypot; connection flood. Wazuh rules: 100100,100113.
show less
Brute-Force
SSH