Three SSH login attempts were observed over 19 seconds using SSH-2.0-libssh_0.9.6. Tried credentials ...
show moreThree SSH login attempts were observed over 19 seconds using SSH-2.0-libssh_0.9.6. Tried credentials: 345gs5662d34/345gs5662d34, engine/3245gs5662d34, and engine/engine. After access, the attacker attempted to remove and recreate the .ssh directory and write an SSH public key to authorized access: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... A second command tried to clear immutability/attributes on .ssh: cd ~; chattr -ia .ssh; lockr -ia .ssh. No downloads, malware execution, lateral movement, or other persistence was observed beyond the SSH key setup attempt.
show less
Single SSH session with unknown credentials. Attacker uploaded /home/honeypot/.16, then attempted to ...
show moreSingle SSH session with unknown credentials. Attacker uploaded /home/honeypot/.16, then attempted to execute it via sudo using password 'wasd'. They ran chmod +x /home/<user>/.16, then executed /home/<user>/.16, then removed it with rm -rf /home/<user>/.16. Cleanup commands also targeted log/history removal: echo -n '' > /var/log/wtmp, rm -rf .bash_history, and history -c. No lateral movement or port forwarding observed. No hashes available.
show less
logged in with master/wasd and root/root over SSH-2.0-Go, then ran sudo-wrapped shell commands to ex ...
show morelogged in with master/wasd and root/root over SSH-2.0-Go, then ran sudo-wrapped shell commands to execute, chmod +x, and delete /home/<user>/.16. They probed host details with uname, exported PATH, and executed multiple check_* transport markers plus shell function stubs. File upload observed: /home/honeypot/.16. No persistence, port forwarding, lateral movement, or additional downloads were observed in the session.
show less
Multiple SSH login attempts used common weak credentials for root: 123456a, 123456b, 123abc, 123qwe, ...
show moreMultiple SSH login attempts used common weak credentials for root: 123456a, 123456b, 123abc, 123qwe, 1q2w3e4r, 555555, and 654321. After access, the actor ran repeated sudo-wrapped CPU enumeration commands using nproc and /proc/cpuinfo, then issued many test/marker commands such as echo; echo 'check_0e577ba2081098e027ddb2fd63ee21fa_transport_done' and similar check_*_transport_done strings. Total activity spanned 7 sessions, 134 commands, and 113 unique commands over about 14 minutes. SSH client identified as SSH-2.0-Go. No file downloads, dropped artifacts, persistence, port forwarding, or lateral movement were observed.
show less
7 SSH sessions in ~3 minutes using SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. Login attempts: admin/letm ...
show more7 SSH sessions in ~3 minutes using SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. Login attempts: admin/letmein, admin1/123, ec2-user/123456, master/wasd, root/root. After access, the actor checked for command execution with “check_064f8eb2d42780d13430898d658e356b_transport_done” and “check_69f38fe69e6a76823b2b2271a7e006c2_transport_done”, then used sudo with supplied passwords to run, chmod +x, and delete a dropped file at /home/<user>/.16. Two uploads of /home/honeypot/.16 were observed. Commands show execution of the uploaded payload and cleanup attempts, but no persistence, port forwarding, lateral movement, or additional downloads were observed.
show less
SSH brute-force activity across 6 sessions using SSH-2.0-Go. Tried root with weak passwords: 000000, ...
show moreSSH brute-force activity across 6 sessions using SSH-2.0-Go. Tried root with weak passwords: 000000, 111111, 123, 123123, 123321, 1234. After login attempts, the client issued system discovery commands and repeatedly tried privilege checks with sudo, including nproc via sh -c and fallbacks to /usr/bin/nproc, busybox nproc, and /proc/cpuinfo. No file downloads, dropped files, persistence actions, port forwarding, lateral movement, or malware artifacts were observed in the provided data. Several commands echoed transport check strings such as check_3c6ec6856286dc85fb286599f29cd014_transport_done, check_4198ca8bc2ac4111e3e2bb1e5ab0338e_transport_done, check_5a361c87e9457856b1fee7ae76e3d30e_transport_done, and check_6aae7120462152949b40acc6dba49c16_transport_done. Overall behavior was automated credential-guessing followed by basic host reconnaissance and privilege probing.
show less
Observed one SSH session that uploaded /home/honeypot/.16 and then tried to execute it from /home/<u ...
show moreObserved one SSH session that uploaded /home/honeypot/.16 and then tried to execute it from /home/<user>/.16. The session used sudo with echoed password 'root' in repeated command fallbacks, then ran chmod +x on /home/<user>/.16 and removed /home/<user>/.16 with rm -rf. No successful login credentials were observed, no lateral movement, port forwarding, or network download activity was seen, and no additional commands or persistence beyond the uploaded file and execution attempt were observed. The activity shows direct malware/payload staging, execution attempt, permission change, and cleanup of the dropped file.
show less
Multiple SSH login attempts used admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/r ...
show moreMultiple SSH login attempts used admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root from SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 clients. After login, the actor uploaded /home/honeypot/.16 twice, then ran it from /home/<user>/.16, marked it executable with chmod +x, and removed it with rm -rf, indicating a drop-execute-delete workflow. The session also included sudo -S attempts using the guessed passwords and repeated command wrappers to invoke the uploaded file. Additional commands only showed transport check strings such as check_00ace10d7ca24f461465cf0ea02c471e_transport_done and check_1944f8bd3b6f93261c5278d4a53974f9_transport_done. No persistence, lateral movement, port forwarding, or other downloads were observed.
show less
3 SSH sessions from SSH-2.0-Go using root/111111. Activity was limited to shell-check probes and com ...
show more3 SSH sessions from SSH-2.0-Go using root/111111. Activity was limited to shell-check probes and command echo tests: multiple echo and sh -c printf invocations with random check_* tokens, “*_transport_done”, “*_small_function”, “*_small_done”, “*_small_control”, “*_small_math”, and “*_small_pid”. No downloads, file drops, persistence, port forwarding, lateral movement, or additional credential attempts were observed. This looks like automated SSH validation/recon against exposed SSH access.
show less
Observed 2 SSH sessions from SSH-2.0-Go using admin/letmein. Attacker uploaded /home/honeypot/.16, t ...
show moreObserved 2 SSH sessions from SSH-2.0-Go using admin/letmein. Attacker uploaded /home/honeypot/.16, then repeatedly tried to execute it via sudo with both 123456 and letmein, made it executable with chmod +x, and later removed it with rm -rf. The session also issued marker commands echoing check_156eebb2237c973890d81d2165e1423d_transport_done and check_7e6757e8bb153dbb61d99ba198bedbb4_transport_done. No successful command output, persistence, port forwarding, lateral movement, or additional downloads were observed. Activity shows credential abuse, file staging, execution attempts, and cleanup of the dropped payload.
show less
Single SSH session with no successful auth details observed. The actor used sudo with password strin ...
show moreSingle SSH session with no successful auth details observed. The actor used sudo with password string "letmein" in repeated command wrappers, then worked on /home/<user>/.16: chmod +x, execution, and rm -rf to remove it. Observed sequence: attempted to run the dropped file via sudo/sh -c, made it executable, executed /home/<user>/.16, then deleted it. No download URLs, file transfers, persistence, port forwards, lateral movement, or other commands were observed. No hashes or artifacts were provided.
show less
Observed repeated SSH logins with weak credentials: admin/letmein, admin1/123, ec2-user/123456, mast ...
show moreObserved repeated SSH logins with weak credentials: admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root. Sessions used SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. The attacker uploaded a file named .16 twice, then tried to run it from /home/<user>/.16, made it executable with chmod +x, and later removed it with rm -rf. Commands also show sudo attempts using the guessed passwords (123456 and wasd) to execute the dropped file. Additional commands were simple transport/status checks like echo 'check_..._transport_done'. No lateral movement, port forwarding, or other payloads were observed beyond the uploaded executable and its execution/persistence cleanup attempts.
show less
SSH brute-force and post-login recon from SSH-2.0-Go over 8 sessions. Tried weak credentials on mult ...
show moreSSH brute-force and post-login recon from SSH-2.0-Go over 8 sessions. Tried weak credentials on multiple accounts: administrator/1234, 123abc, 1q2w3e4r, admin123, qwerty123, apache/1234, backup/123, backup/12345678. After login, the actor repeatedly ran sudo-wrapped nproc/cpu-count checks using the supplied passwords, then issued numerous probe strings like “check_..._transport_done”. Observed only reconnaissance/enumeration and privilege-check activity. No downloads, file drops, persistence, lateral movement, or malware artifacts were observed.
show less
Observed 8 SSH sessions over 14 minutes using SSH-2.0-Go. The client attempted multiple admin logins ...
show moreObserved 8 SSH sessions over 14 minutes using SSH-2.0-Go. The client attempted multiple admin logins: admin/P@ssw0rd123, admin/abc123, admin/admin123, admin/letmein, admin/pass123, admin/password, admin/password1, and admin/qwerty123. After login attempts, the activity focused on host discovery and privilege checks: repeated sudo-wrapped nproc/cpu-count probes and shell checks. The operator issued many test markers such as echo; echo 'check_019b4f16b2baf1d316ce99b3a2865fbf_transport_done' and echo; echo 'check_0b75728b629d23045cf9f589ce05ae1b_transport_done', plus 119 additional unique commands. No downloads, dropped files, persistence actions, port forwarding, lateral movement, or malware artifacts were observed in the session.
show less
7 SSH sessions from a Go-based client used a simple credential spray against admin with weak passwor ...
show more7 SSH sessions from a Go-based client used a simple credential spray against admin with weak passwords: 12345, 123456, 1234567, 12345678, 123456789, 1234567890, and 1q2w3e4r. After login attempts, the actor ran sudo-prefixed probes to discover CPU count with nproc/grep /proc/cpuinfo, then issued many check_*_transport_done marker commands. No successful file downloads, dropped files, persistence setup, port forwards, lateral movement, or malware execution were observed. Activity was limited to credential testing, system reconnaissance, and repeated shell probing across 126 commands in 113 unique variants.
show less
Observed SSH login attempts with admin/letmein and ec2-user/123456 over SSH-2.0-Go. After access, th ...
show moreObserved SSH login attempts with admin/letmein and ec2-user/123456 over SSH-2.0-Go. After access, the actor targeted /home/<user>/.16: ran it directly, changed it to executable with chmod +x, then tried to remove it with rm -rf. Commands also showed sudo usage with the password letmein, PATH export, uname enumeration, and multiple check_* probe commands. No lateral movement, port forwarding, or additional downloads were observed in this session. Uploaded artifact: /home/honeypot/.16.
show less
SSH brute-force and post-login probing observed across 7 sessions from SSH-2.0-Go. Tried root with c ...
show moreSSH brute-force and post-login probing observed across 7 sessions from SSH-2.0-Go. Tried root with common passwords: 123abc, 1q2w3e4r, P@ssw0rd123, abc123, admin123, letmein, pass123. After login attempts, attacker ran repeated sudo-wrapped shell probes using the supplied passwords to check CPU count via nproc/grep /proc/cpuinfo, suggesting environment discovery and privilege testing. Also issued many echo-based marker commands like check_0b3d980386c9fc004afa9b634c73c3d8_transport_done, check_24646bb54ac08942408f057a1370b0ae_transport_done, and check_2a83c99a5f17cd53dcd3ca569ad9ffa3_transport_done. No downloads, dropped files, persistence, lateral movement, or malware artifacts were observed in this session.
show less
SSH login with admin/letmein from SSH-2.0-Go. Two sessions in 12 seconds. Attacker uploaded /home/ho ...
show moreSSH login with admin/letmein from SSH-2.0-Go. Two sessions in 12 seconds. Attacker uploaded /home/honeypot/.16 twice, then executed it directly and via sudo wrappers after chmod +x. They tried multiple sudo password prompts using letmein and wasd, then removed /home/<user>/.16 with rm -rf. Commands also included echo markers check_3b4bf4f8f8aaaab7dff1c32061e668cf_transport_done and check_c59c45ad8f7d206be66ede8169e1b643_transport_done. Activity shows file upload, execution, permission changes, and cleanup of the dropped binary. No lateral movement or port forwarding observed.
show less
6 SSH sessions in ~24s from SSH-2.0-libssh_0.9.6. Tried weak credentials: root/qwerty, root/root3245 ...
show more6 SSH sessions in ~24s from SSH-2.0-libssh_0.9.6. Tried weak credentials: root/qwerty, root/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. After login, attacker executed 2 commands: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... and cd ~; chattr -ia .ssh; lockr -ia .ssh. Activity focused on modifying or replacing the SSH authorized_keys directory and attempting to remove immutability attributes for persistence/access retention. No downloads, file drops, port forwards, lateral movement, or additional commands were observed.
show less
6 SSH sessions from SSH-2.0-libssh_0.9.6 using tried credentials astro/astro, astro/root3245gs5662d3 ...
show more6 SSH sessions from SSH-2.0-libssh_0.9.6 using tried credentials astro/astro, astro/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. Post-login activity focused on SSH access persistence: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... and cd ~; chattr -ia .ssh; lockr -ia .ssh. No downloads, file drops, port forwards, lateral movement, or other commands were observed in the captured activity.
show less
Attempted SSH login with root/123 from SSH-2.0-Go over 2 sessions. After login, the actor ran discov ...
show moreAttempted SSH login with root/123 from SSH-2.0-Go over 2 sessions. After login, the actor ran discovery and shell-validation commands only: PATH export, uname collection, nproc via sudo, and multiple echo/printf/sh wrappers that printed marker strings such as check_41a4799853edc0af2c5d0bf0fbcd107e_transport_done, check_87c04f06ce4e413b5766b63f5b499d0e_transport_done, and several check_*_small_function/_small_done/_small_control probes. No downloads, file writes, persistence, port forwarding, lateral movement, or malware artifacts were observed. Activity indicates automated post-auth recon and environment checking after successful brute-force/default-credential access.
show less
7 SSH sessions used weak credentials: admin/letmein, admin1/123, ec2-user/123456, master/wasd, and r ...
show more7 SSH sessions used weak credentials: admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root. Clients identified as SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. Attacker uploaded /home/honeypot/.16 twice, then attempted to execute it directly and through sudo with password strings 123456 and letmein. They ran chmod +x on /home/honeypot/.16, then rm -rf /home/honeypot/.16, showing execution, permission change, and cleanup of the dropped payload. Additional commands included repeated check_*_transport_done echo probes. No lateral movement, port forwarding, or other artifacts were observed.
show less
Observed 6 SSH sessions using SSH-2.0-libssh_0.9.6 with failed login attempts for root/0, root/root3 ...
show moreObserved 6 SSH sessions using SSH-2.0-libssh_0.9.6 with failed login attempts for root/0, root/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. After access attempts, the actor ran cd ~ && rm -rf .ssh && mkdir .ssh and began writing an SSH authorized key entry with an ssh-rsa public key. A second command ran cd ~; chattr -ia .ssh; lockr -ia .ssh to remove immutable attributes from the .ssh directory before modifying it. No downloads, additional payloads, persistence beyond .ssh key setup, port forwards, lateral movement, or artifacts were observed.
show less
6 SSH sessions in 23s from SSH-2.0-libssh_0.9.6 using brute-force logins: cinema/cinema, cinema/root ...
show more6 SSH sessions in 23s from SSH-2.0-libssh_0.9.6 using brute-force logins: cinema/cinema, cinema/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. After access, the actor ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx to replace the SSH authorized_keys area, and cd ~; chattr -ia .ssh; lockr -ia .ssh to remove immutable/append-only attributes and modify the directory. No downloads, malware artifacts, port forwarding, or lateral movement were observed.
show less
SSH brute-force/login succeeded with root/4815162342 using SSH-2.0-libssh_0.9.6. Attacker performed ...
show moreSSH brute-force/login succeeded with root/4815162342 using SSH-2.0-libssh_0.9.6. Attacker performed host recon with CPU and memory/disk checks: /proc/cpuinfo parsing, free -m, df -h, ls -lh $(which ls), and crontab -l. Persistence activity observed: cd ~ && rm -rf .ssh && mkdir .ssh and creation of an SSH authorized key entry beginning with ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... Also attempted to remove file immutability with chattr -ia .ssh and lockr -ia .ssh. Credential abuse observed: echo "root:5ZVmWS5ANUta"|chpasswd|bash to change the root password. No downloads, malware drops, port forwarding, or lateral movement were observed.
show less
Brute-ForceSSH
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.