SSH brute-force attack targeting root account with 7 password variants: root, root123, root@123, roo ...
show moreSSH brute-force attack targeting root account with 7 password variants: root, root123, root@123, rootme, system, toor, welcome. Used SSH-2.0-Go client (Go-based implementation common in botnets). 14-minute duration, 7 sessions. Reconnaissance payload: CPU core enumeration via nproc/busybox/proc/cpuinfo parsing, PATH manipulation, uname commands for OS fingerprinting (kernel, hostname, architecture). Sequential commands indicate multi-stage reconnaissance assessing system resources and feasibility for compromise. Pattern consistent with Mirai-family or similar IoT botnet pre-compromise profiling. Credentials are common defaults typical of botnet wordlists targeting IoT/embedded Linux. All execution failed (honeypot rejection). No malware dl, persistence mechanisms, or lateral movement observed. Attack demonstrates intent to profile systems for potential botnet recruitment or resource hijacking.
show less
conducted systematic host reconnaissance over 4 minutes using Go-based SSH client. Credentials attem ...
show moreconducted systematic host reconnaissance over 4 minutes using Go-based SSH client. Credentials attempted: sol/sol, solana/solana. Attack focused on GPU/compute resource enumeration: executed uname for OS/kernel details, lspci queries to identify 3D controllers and VGA devices (including counting GPU presence), nproc to enumerate CPU cores, and nvidia-smi queries to extract GPU product names and specifications. Final command checked system uptime. No persistence mechanisms, lateral movement, or payload delivery observed. Pattern consistent with botnet reconnaissance or resource discovery for compromised host classification prior to malware deployment or cryptocurrency mining setup. No files downloaded or modified during sessions.
show less
51 brute-force login attempts using weak/predictable credentials containing variations of "dugu," "d ...
show more51 brute-force login attempts using weak/predictable credentials containing variations of "dugu," "du," and other short usernames paired with identical passwords. SSH client identifies as Go-based tool. Two reconnaissance commands executed post-authentication: system architecture query (uname -m) and detailed OS fingerprinting (uname -s -v -n -r -m). No file downloads, persistence mechanisms, lateral movement, or secondary payloads observed. Attack pattern consistent with automated credential scanning targeting systems with default or weak authentication. Activity timespan: 4 minutes 37 seconds across 51 sessions suggests rapid sequential login attempts rather than interactive sessions.
show less
Credential brute-force attack targeting root account using weak passwords. Seven sessions attempted ...
show moreCredential brute-force attack targeting root account using weak passwords. Seven sessions attempted sequential password variants (123123, 1234, 12345, 123456, 12345678, 123456789, P@ssw0rd) via SSH-2.0-Go client. Attack methodology focused on system reconnaissance without successful authentication. Commands enumerated CPU core count using multiple fallback methods (nproc, /proc/cpuinfo, busybox), consistent with botnet fingerprinting or resource assessment for crypto-mining payload deployment. Each credential attempt paired with sudo command execution using password piping. Final recon phase executed PATH manipulation and uname system information gathering to identify OS details and architecture. No persistence mechanisms, malware downloads, or lateral movement observed within honeypot scope. Attack pattern typical of automated scanner or botnet propagation probing for vulnerable systems. Go SSH client suggests scripted reconnaissance rather than human-operated access.
show less
Brute-force SSH login attempt using credential root/teste3 via Go-based SSH client. Attack chain con ...
show moreBrute-force SSH login attempt using credential root/teste3 via Go-based SSH client. Attack chain consisted of post-compromise reconnaissance only. Attacker enumerated system configuration: OS version, CPU details, network interfaces, user accounts, environment variables, process listings, and disk usage. Executed 33 unique commands targeting /proc, /etc, and /sys filesystems for host profiling. Created test file at /tmp/test_1789170490 to verify write permissions. No malware payloads, persistence mechanisms, lateral movement, or exfiltration observed. Attack duration 34 seconds. Session terminated after reconnaissance phase without further activity. Indicates automated scanning behavior typical of botnet reconnaissance or credential-stuffing campaigns testing SSH access across large IP ranges.
show less
Mirai-variant reconnaissance activity. Go SSH client attempted three sessions using weak credentials ...
show moreMirai-variant reconnaissance activity. Go SSH client attempted three sessions using weak credentials (root/!root, root/111111). Attack focused on system profiling: CPU core enumeration via nproc/proc fallback chains, kernel/hostname/architecture enumeration via uname. PATH manipulation suggests preparation for command injection or botnet binary deployment. Commands executed with sudo privilege escalation attempts. No malware downloads, persistence mechanisms, or lateral movement observed in captured activity. Standard botnet fingerprinting pattern targeting Linux systems for potential recruitment into DDoS infrastructure.
show less
119 sessions over 11 minutes using Go SSH client targeting 119 unique weak/common credentials, all w ...
show more119 sessions over 11 minutes using Go SSH client targeting 119 unique weak/common credentials, all with matching username-password pairs. Credentials are predominantly Chinese personal names and database-related accounts (db1inst1, db2fencl, db2instl, db2prod, dbmadmin, dbmaker, dbo, datacom, datafeedadm, datamining, dataops). Command execution limited to two recon probes: uname queries to enumerate system architecture and kernel details. No persistence mechanisms, lateral movement, or malware downloads observed. Attack pattern consistent with dictionary-based credential scanning using generic weak account-password combinations to identify vulnerable systems and map target OS/hardware profiles for potential secondary exploitation. No exfiltration or payload delivery attempted.
show less
Brute force SSH attack: 13 login attempts using operator/oracle usernames with weak numeric password ...
show moreBrute force SSH attack: 13 login attempts using operator/oracle usernames with weak numeric passwords (123-123456789) and "password". Go-based SSH client used. After access gained: executed CPU enumeration via sudo -S (nproc, /proc/cpuinfo, busybox with stderr redirect). Host fingerprinting via uname (kernel, hostname, arch). PATH manipulation for payload precedence. Reconnaissance pattern indicates system profiling for botnet deployment or cryptomining staging. No malware/persistence/C2 observed in session, but command sequence consistent with pre-exploitation profiling. Attack chain suggests Shodan-based targeting of exposed SSH with default creds. IOCs: creds (operator, oracle, numeric dicts), cmds (nproc, uname, sudo -S, /proc/cpuinfo parsing), automated tooling (Go SSH client).
show less
Credential stuffing attack targeting service accounts (mysql, nginx, operator) with 12 password vari ...
show moreCredential stuffing attack targeting service accounts (mysql, nginx, operator) with 12 password variants. Go-based SSH client suggests automated scanner. Attack: brute force cred enumeration across 13 sessions in 15min. Cmd exec focused on recon—CPU enumeration via nproc, /proc/cpuinfo. Attempted sudo priv escalation using echo password | sudo -S with fallback mechanisms querying processor count (nproc, busybox, grep). No successful exploitation; cmds probed system capabilities/escalation paths. No malware dl, persistence, lateral movement, or exfil detected. Pre-compromise recon phase typical of botnet/automated vuln scanner profiling environment before payload delivery. Service acct targeting suggests prior knowledge of default installations. Go SSH client indicates non-standard tooling—possibly Mirai derivative, Masscan, or custom scanner. Low complexity attack relying on weak/default creds and sudo misconfiguration.
show less
tempted brute force authentication using credential root/---fuck_you---- via SSH client SSH-2.0-Go ( ...
show moretempted brute force authentication using credential root/---fuck_you---- via SSH client SSH-2.0-Go (Go standard library SSH implementation). Single successful login resulted in execution of uname -s -m for OS/architecture fingerprinting. No malware downloads, persistence mechanisms, lateral movement, or additional reconnaissance observed. Attack pattern consistent with automated scanning and basic system profiling. Session duration approximately 1 minute 42 seconds across 2 total SSH connections.
show less
conducted single SSH session using Go-based client with credentials temp/12345678. Executed system r ...
show moreconducted single SSH session using Go-based client with credentials temp/12345678. Executed system reconnaissance command (uname -a) to identify target OS and architecture. No malware downloads, persistence mechanisms, lateral movement, or secondary payloads observed. Activity represents initial reconnaissance phase typical of automated scanning or credential stuffing campaigns targeting weak/default credentials. Brief session duration (4.1 seconds) suggests script-driven attack rather than interactive access attempt.
show less
Automated brute-force attack using Go-based SSH client against common Linux user accounts (developer ...
show moreAutomated brute-force attack using Go-based SSH client against common Linux user accounts (developer, docker, ec2-user, ftp) with dictionary passwords (123, 123456, 12345678, 123456789, abc123, docker, password, qwerty). Attack executed across 13 sessions within 15-minute window. Post-authentication reconnaissance focused on system profiling: repeated CPU core enumeration attempts via nproc with fallback to /proc/cpuinfo parsing, combined with multi-method uname invocations for OS/kernel/hostname/architecture enumeration. Commands demonstrate credential-to-reconnaissance progression typical of botnet or cryptomining payload deployment workflow. Sudo invocation with inline password submission indicates targeting systems with passwordless sudo or weak sudo configuration. No file downloads, persistence mechanisms, or lateral movement observed in captured activity, suggesting reconnaissance phase preceding payload delivery.
show less
Credential-stuffing attack using Go SSH client. Attacker brute-forced 12 weak credentials against ba ...
show moreCredential-stuffing attack using Go SSH client. Attacker brute-forced 12 weak credentials against backup and developer accounts across 13 sessions. All commands executed attempted CPU enumeration via sudo with password piping, testing multiple fallback methods (nproc, /usr/bin/nproc, busybox, /proc/cpuinfo grep). Command structure indicates automated reconnaissance of system resources, likely for botnet deployment or cryptominer installation assessment. No successful command execution observed based on honeypot responses. Attack demonstrates systematic password variation approach (numeric increments: 1, 12345678, 123456789, 1234567890) and common credential combinations. Go-based SSH client suggests custom scanning tool or modified botnet variant. No persistence mechanisms, lateral movement, or payload delivery attempted. No secondary downloads observed.
show less
Attacked with libssh 0.9.6 client. Attempted creds: 345gs5662d34/345gs5662d34, root/3245gs5662d34, r ...
show moreAttacked with libssh 0.9.6 client. Attempted creds: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/passer. SSH key injection: removed .ssh dir, recreated it, injected RSA pubkey (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) into authorized_keys for persistent access. Second cmd attempted chattr -ia on .ssh dir to prevent removal, followed by lockr cmd (obfuscation). Pattern indicates persistence mechanism targeting SSH backdoor via authorized_keys mod and filesystem attribute manipulation. Multiple cred attempts suggest credential stuffing/dictionary attack. 6-sec session with rapid cmd exec typical of automated tools. No file dls observed. Attack focused on SSH access persistence.
show less
Credential brute-force attack targeting admin and root accounts with common weak passwords (111111, ...
show moreCredential brute-force attack targeting admin and root accounts with common weak passwords (111111, 123123, 1234, 12345, 123456, 12345678, 123456789, Administrator, access, admin, toor). Attacker used Go-based SSH client executing reconnaissance commands via sudo to enumerate CPU core count using multiple fallback methods (nproc, /proc/cpuinfo, busybox). Attack pattern consistent with automated scanning for vulnerable systems or botnet recruitment. Credentials piped directly into sudo commands suggests targeting systems with passwordless sudo or weak sudo configuration. No evidence of successful command execution, file downloads, or persistence mechanisms in observed activity. Attack duration 15 minutes across 11 sessions indicates systematic credential cycling rather than targeted exploitation.
show less
Brute force attack targeting root account with 7 weak passwords via SSH-2.0-Go client: 123123, 1234, ...
show moreBrute force attack targeting root account with 7 weak passwords via SSH-2.0-Go client: 123123, 1234, 12345, 123456, 12345678, 123456789, Password1. Attacker probed system specs using nproc (multiple methods: binary, busybox, /proc/cpuinfo) and uname flags (-s -v -n -m) across different paths to enumerate OS type, version, hostname, architecture. All cmds attempted sudo elevation, suggesting attacker expected passwordless sudo or cached sessions. Attack pattern consistent with automated botnet scanner: credential stuffing with dict passwords, systematic OS/hardware profiling to determine exploit vectors, PATH manipulation for payload delivery. Go-based SSH client indicates programmatic framework, not manual access. No successful auth, no persistence, no malware dl, no lateral movement. Attack remained in initial recon phase focused on cred validation and info gathering.
show less
Brute-force SSH login attack using credential root/111111 via Go-based SSH client. Two sessions esta ...
show moreBrute-force SSH login attack using credential root/111111 via Go-based SSH client. Two sessions established over 4-minute window. Attacker executed system reconnaissance commands to enumerate CPU core count (nproc via multiple fallback methods including busybox and /proc/cpuinfo parsing) and system information (uname -s -v -n -m). Commands used sudo with password piping, indicating testing for privileged code execution. PATH environment variable exported to ensure command availability across common binary locations. No file downloads, persistence mechanisms, or lateral movement observed. Attack pattern consistent with automated reconnaissance toolkit probing target system capabilities prior to potential payload deployment.
show less
SSH brute-force via Go client. Single successful login: root/teste. 35 cmds across 33 payloads in 34 ...
show moreSSH brute-force via Go client. Single successful login: root/teste. 35 cmds across 33 payloads in 34sec session. Reconnaissance only: passwd/shadow, CPU arch, kernel version, network interfaces, processes, user/group memberships, shell history, mounted filesystems, packages, services, uptime, DNS config, routing tables, iptables rules, sudo perms, SSH keys, cron jobs, kernel params. Test file created /tmp/test_1789158007 to verify write access. No malware dl, no persistence, no lateral movement. Go SSH client suggests automated scanning tool/botnet component. 34sec duration indicates scripted recon execution. No shell spawning or cmd injection attempts. Attack halted before privilege escalation, backdoor install, or data exfiltration. Single-session footprint suggests scanning pass through multiple targets using weak creds.
show less
Reconnaissance-focused SSH brute-force attack using weak credentials root/test9. Attacker connected ...
show moreReconnaissance-focused SSH brute-force attack using weak credentials root/test9. Attacker connected via Go-based SSH client and executed 33 reconnaissance commands across 35 total invocations to enumerate system configuration, hardware, OS version, network interfaces, and user accounts. Commands targeted /etc/passwd, /etc/shadow, /proc/cpuinfo, /proc/version, hostname resolution, IP configuration, environment variables, user permissions, and shell history. Created test file /tmp/test_1789154369 indicating write-access verification. Attack pattern consistent with automated scanning toolkit performing initial compromise assessment and environmental discovery. No payload delivery, persistence mechanisms, or lateral movement observed during 35-second session window. Attack demonstrates low-sophistication opportunistic access attempt leveraging dictionary credentials against SSH service.
show less
Attempted SSH login with credential devops/174!2019 using Go SSH client. Single command executed: un ...
show moreAttempted SSH login with credential devops/174!2019 using Go SSH client. Single command executed: uname -a with stderr redirected to null, indicating system reconnaissance. Attack duration approximately 8 seconds. No malware downloads, persistence mechanisms, or lateral movement observed. Minimal footprint suggests automated scanning or credential stuffing attempt rather than targeted intrusion. Attacker gathered OS/kernel information only before session termination.
show less
Brute-ForceSSH
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.