SSH brute-force from SSH-2.0-Go over 9 sessions in ~13 min using root with common passwords: admin, ...
show moreSSH brute-force from SSH-2.0-Go over 9 sessions in ~13 min using root with common passwords: admin, admin123, alpine, changeme, default, letmein, passw0rd, password, qwerty. After login, attacker ran repeated sudo-wrapped nproc checks with each guessed password, then set PATH to standard system dirs and executed uname -s -v -n -m for host OS/kernel/node/arch enumeration. No downloads, file drops, persistence, port forwarding, or lateral movement were observed. Activity was limited to credential guessing and basic system reconnaissance.
show less
3 SSH sessions in 10s using SSH-2.0-libssh_0.9.6. Login attempts used 345gs5662d34/345gs5662d34, joa ...
show more3 SSH sessions in 10s using SSH-2.0-libssh_0.9.6. Login attempts used 345gs5662d34/345gs5662d34, joaquin/3245gs5662d34, and joaquin/joaquin. After access, commands attempted to remove and recreate ~/.ssh, then write an ssh-rsa public key into authorized_keys for persistence. A second command tried to change attributes on .ssh with chattr -ia and lockr -ia, indicating an attempt to disable protections on the SSH directory before or after key installation. No downloads, port forwards, lateral movement, or dropped files were observed.
show less
Single SSH login attempt used root/------fuck------. After login, attacker checked system architectu ...
show moreSingle SSH login attempt used root/------fuck------. After login, attacker checked system architecture with uname -m and uname -s, then ran /tmp/aarch64, removed any prior copy, and downloaded a new binary from hxxp://31[.]56[.]209[.]73:32461/s/aarch64 to /tmp/aarch64. The file was then made executable with chmod 777 /tmp/aarch64 and a 4.9 MB binary named "aarch64" was recovered from the session (sha256: 0ed1b127a19c6ddf304bdb75707ae45c06cb4c994456c6c665ceb360d80bf1d0). No persistence, port forwarding, or lateral movement observed.
show less
Observed 3 SSH sessions using root/!root and root/111111 from an SSH-2.0-Go client. After login, the ...
show moreObserved 3 SSH sessions using root/!root and root/111111 from an SSH-2.0-Go client. After login, the actor ran host-enumeration commands to check system architecture and CPU count: uname -s -v -n -m and nproc via sudo fallback chains. Also modified PATH with export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH. No downloads, file writes, persistence, port forwarding, lateral movement, or malware artifacts were observed. Activity focused on basic environment recon and privilege-context checks after successful credential use.
show less
SSH login with ec2-user/123456 from SSH-2.0-Go. After access, attacker uploaded file /home/honeypot/ ...
show moreSSH login with ec2-user/123456 from SSH-2.0-Go. After access, attacker uploaded file /home/honeypot/.16, then attempted to execute it via sudo as /home/<user>/.16, set it executable with chmod +x, and removed it with rm -rf. Commands also set PATH, ran uname for host profiling, and executed shell/tests for command parsing and variable handling (check_7023c338fcaa406407407892913ce566, begin_1a117d6504affed3ba6ca1a9ef35a3d4, begin_64ea3345783f18a7145ef91da0b32f8e, begin_6b52a6f68d388675ec849905db990710, begin_6c9e2b35e3fea708f648001c1dfe5f8e). No port forwards or lateral movement observed. Uploaded artifact filename .16, size and SHA-256 not provided in input.
show less
Tried 3 weak credentials: 345gs5662d34/345gs5662d34, michelle/3245gs5662d34, and michelle/abc123. SS ...
show moreTried 3 weak credentials: 345gs5662d34/345gs5662d34, michelle/3245gs5662d34, and michelle/abc123. SSH client identified as SSH-2.0-libssh_0.9.6. After access, the actor ran cd ~ && rm -rf .ssh && mkdir .ssh and began writing an ssh-rsa public key into the .ssh directory, indicating attempted SSH key-based persistence. A second command ran chattr -ia .ssh; lockr -ia .ssh to remove immutable/append-only protections before modifying that directory. No downloads, malware payloads, lateral movement, or additional commands were observed.
show less
SSH login attempts used admin/, ec2-user/123456, and root/ over 4 sessions from SSH-2.0-Go and SSH-2 ...
show moreSSH login attempts used admin/, ec2-user/123456, and root/ over 4 sessions from SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 clients. After login, the actor uploaded /home/honeypot/.16 and ran it via sudo with password 123456, then chmod +x /home/honeypot/.16 and removed it with rm -rf /home/honeypot/.16. Additional commands were PATH setup, uname collection, and several shell/probe statements printing markers and exit-status checks. No lateral movement, port forwarding, or additional downloads were observed. Observed activity shows credential guessing, privilege escalation attempts, execution of an uploaded file, and cleanup of the dropped artifact.
show less
Single SSH session from SSH-2.0-Go using root/123. After login, the actor set PATH to include standa ...
show moreSingle SSH session from SSH-2.0-Go using root/123. After login, the actor set PATH to include standard system directories, then ran a sudo-wrapped CPU-count check: nproc via multiple fallbacks and /proc/cpuinfo, using the supplied password with sudo -S. No file downloads, no dropped artifacts, no persistence, no port forwards, no lateral movement, and no additional commands beyond basic host/CPU enumeration.
show less
3 SSH sessions using SSH-2.0-Go attempted weak root logins: root/111111 and root/123. After login, t ...
show more3 SSH sessions using SSH-2.0-Go attempted weak root logins: root/111111 and root/123. After login, the actor ran sudo-wrapped shell commands to enumerate system capability and environment: nproc via multiple fallbacks, uname -s -v -n -m via multiple fallbacks, and PATH was reset to a standard value. No downloads, file drops, persistence, port forwarding, lateral movement, or additional commands were observed. Activity shows basic post-auth host reconnaissance and CPU/system profiling only.
show less
SSH session used admin/letmein and root/root from an SSH-2.0-Go client. The actor uploaded /home/hon ...
show moreSSH session used admin/letmein and root/root from an SSH-2.0-Go client. The actor uploaded /home/honeypot/.16 twice, then attempted to execute it directly and via sudo. They ran chmod +x on /home/honeypot/.16 and repeatedly retried execution with shell fallbacks. They then attempted cleanup and anti-forensics: rm -rf /home/honeypot/.16, echo -n '' > /var/log/wtmp, rm -rf .bash_history, and history -c. Additional commands set PATH and ran uname for host reconnaissance. No lateral movement, port forwarding, or other downloads were observed. File artifact observed: .16, 2 uploads, filename only; no hash provided.
show less
3 SSH sessions in 11s using SSH-2.0-libssh_0.9.6 with brute-force logins: 345gs5662d34/345gs5662d34, ...
show more3 SSH sessions in 11s using SSH-2.0-libssh_0.9.6 with brute-force logins: 345gs5662d34/345gs5662d34, root/3245gs5662d34, and root/jp123456. After login, attacker targeted SSH access persistence by removing and recreating ~/.ssh, then echoing an ssh-rsa public key into authorized access, and ran chattr -ia .ssh; lockr -ia .ssh to alter attributes and block changes. No downloads, malware execution, port forwarding, or lateral movement were observed.
show less
SSH brute-force activity with 3 sessions in 2 minutes using 345gs5662d34/345gs5662d34 and root/odroi ...
show moreSSH brute-force activity with 3 sessions in 2 minutes using 345gs5662d34/345gs5662d34 and root/odroid from SSH-2.0-libssh_0.9.6. After access, the actor attempted to replace and protect SSH access by deleting the existing ~/.ssh directory, recreating it, and echoing an ssh-rsa public key into place. A second command removed immutable attributes from ~/.ssh with chattr -ia .ssh and then referenced lockr -ia .ssh. No downloads, port forwards, lateral movement, or dropped artifacts were observed in this window. The observable behavior focused on unauthorized SSH key installation and persistence via the .ssh directory.
show less
3 SSH sessions in 18s from SSH-2.0-libssh_0.9.6. Login attempts used 3 credential pairs: 345gs5662d3 ...
show more3 SSH sessions in 18s from SSH-2.0-libssh_0.9.6. Login attempts used 3 credential pairs: 345gs5662d34/345gs5662d34, webmaster/123, and webmaster/3245gs5662d34. After access, the actor ran commands to remove and recreate the .ssh directory and began writing an SSH public key: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx. A second command attempted to clear attributes and lock the directory: cd ~; chattr -ia .ssh; lockr -ia .ssh. Observed activity shows credential stuffing followed by SSH key setup/persistence attempts.
show less
Two SSH sessions used admin/letmein and root/root via SSH-2.0-Go. The actor uploaded /home/honeypot/ ...
show moreTwo SSH sessions used admin/letmein and root/root via SSH-2.0-Go. The actor uploaded /home/honeypot/.16 twice, made it executable with chmod +x, then attempted to run it from /home/honeypot/.16. They repeatedly removed the file with rm -rf /home/honeypot/.16. They also executed cleanup commands: echo -n '' > /var/log/wtmp, rm -rf .bash_history, and history -c. Additional commands set PATH, ran uname for host enumeration, and executed shell test/function stubs. No lateral movement, port forwarding, or additional downloads were observed.
show less
Single SSH session logged in as root/root using SSH-2.0-OpenSSH_10.6. The actor checked OS/environme ...
show moreSingle SSH session logged in as root/root using SSH-2.0-OpenSSH_10.6. The actor checked OS/environment with echo $OSTYPE and getprop, enumerated processes with ps and ps -ef, then used SCP to stage a file at /sbin/apcid via scp -t /sbin/apcid. They wrote a file to /sbin/apcid with cat >/sbin/apcid, attempted to remove /dev/.f, and killed processes named .f with killall -9 .f. Observed activity shows file deployment to a system binary path and cleanup of a hidden process/file name. No downloads, port forwards, additional credentials, or lateral movement were observed.
show less
Observed 4 SSH sessions using admin/letmein and root/root with SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 ...
show moreObserved 4 SSH sessions using admin/letmein and root/root with SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. Attacker uploaded /home/honeypot/.16 twice, made it executable with chmod +x, and tried to run it from /home/<user>/.16. They then attempted cleanup with rm -rf /home/<user>/.16 and a log/history wipe: echo -n '' > /var/log/wtmp; cd $HOME; rm -rf .bash_history; history -c. Additional commands set PATH, collected uname output, and ran shell function checks plus basic environment probes. No successful lateral movement or outbound download was observed in the session.
show less
3 SSH login attempts used the credentials 345gs5662d34/345gs5662d34, sonu/3245gs5662d34, and sonu/so ...
show more3 SSH login attempts used the credentials 345gs5662d34/345gs5662d34, sonu/3245gs5662d34, and sonu/sonu123 from SSH-2.0-libssh_0.9.6. After login, the actor attempted to remove and recreate the .ssh directory, then write an ssh-rsa public key into authorized_keys, indicating persistence via SSH key injection. A second command disabled immutable/append attributes on .ssh with chattr -ia and then ran lockr -ia .ssh. No file downloads, malware drops, port forwarding, lateral movement, or other commands were observed.
show less
SSH login attempts used admin/letmein and ec2-user/123456 over SSH-2.0-Go. After access, the actor s ...
show moreSSH login attempts used admin/letmein and ec2-user/123456 over SSH-2.0-Go. After access, the actor set PATH, queried system info with uname, ran shell wrapper functions, and checked arguments/counts. They attempted to execute /home/<user>/.16 with sudo using both passwords, then changed its mode with chmod +x and removed it with rm -rf. File uploads: /home/honeypot/.16 uploaded twice. No lateral movement, port forwarding, or additional downloads were observed. The main observed activity was staged file execution followed by permission change and deletion attempts, plus credential testing against sudo.
show less
Single SSH session with no successful credential disclosure. The only observed activity was a privil ...
show moreSingle SSH session with no successful credential disclosure. The only observed activity was a privilege-escalation check using sudo: echo 'welcome' | sudo -S sh -c 'nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null' || echo 'welcome' | sudo -S nproc. No downloads, file writes, persistence, port forwards, lateral movement, or other commands were observed.
show less
Single SSH session from SSH-2.0-Go using root/------fuck------. Attacker checked uname -m and uname ...
show moreSingle SSH session from SSH-2.0-Go using root/------fuck------. Attacker checked uname -m and uname -s, then downloaded hxxp://31[.]56[.]209[.]73:32461/s/aarch64 to /tmp/aarch64 via wget -t 1, removed any existing copy, and set chmod 777 /tmp/aarch64. The file was then executed from /tmp/aarch64. No additional commands, persistence, lateral movement, or other artifacts were observed.
show less
Two SSH sessions from SSH-2.0-Go used root/------fuck------ against the honeypot within 9 seconds. T ...
show moreTwo SSH sessions from SSH-2.0-Go used root/------fuck------ against the honeypot within 9 seconds. The only observed command was uname -s -m, which queried the system OS and architecture. No file transfer, download, persistence, port forwarding, lateral movement, or other post-login activity was observed. The activity was limited to credential guessing and basic host reconnaissance.
show less
Single SSH session from root/root using SSH-2.0-libssh2_1.8.2. After login, the actor ran host and d ...
show moreSingle SSH session from root/root using SSH-2.0-libssh2_1.8.2. After login, the actor ran host and device recon: uname -a, cat /proc/cpuinfo, ifconfig, and /ip cloud print. They searched for SMS/modem components and artifacts with ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*, then checked for miner processes with ps -ef | grep '[Mm]iner' and ps | grep '[Mm]iner'. No downloads, file drops, persistence changes, port forwards, or lateral movement were observed.
show less
Two SSH sessions over SSH-2.0-Go used admin/letmein and root/root. The actor uploaded /home/honeypot ...
show moreTwo SSH sessions over SSH-2.0-Go used admin/letmein and root/root. The actor uploaded /home/honeypot/.16 twice, then attempted to execute it with sudo and directly, made it executable with chmod +x, and tried to remove it with rm -rf. Commands also attempted to clear traces by deleting /home/<user>/.bash_history, running history -c, and truncating /var/log/wtmp. Additional activity included PATH setting, uname-based host discovery, and function/printf checks. No port forwarding, lateral movement, or successful command output was observed.
show less
Multiple SSH login attempts with root credentials were tried in 9 sessions over ~14 minutes: root/ro ...
show moreMultiple SSH login attempts with root credentials were tried in 9 sessions over ~14 minutes: root/root1234, root/root2024, root/root2222, root/root321, root/root4444, root/root5555, root/root5678, root/root6666, and root/root9999. SSH client identified as SSH-2.0-Go. After login attempts, the actor ran host discovery commands to find the CPU count and system info, using nproc via sudo fallback paths and uname with multiple binary locations. Also set PATH explicitly to common system directories. No payload download, file drop, persistence, port forwarding, lateral movement, or other post-exploitation actions were observed in this capture.
show less
SSH brute-force/login activity across 7 sessions using SSH-2.0-Go. Tried multiple weak credentials: ...
show moreSSH brute-force/login activity across 7 sessions using SSH-2.0-Go. Tried multiple weak credentials: a/123, a/123456, chen/12345678, chen/chen123, chengwei/123456, chengwei/12345678, chengwei/chengwei123. After login, ran host and GPU reconnaissance only: /bin/./uname -s -v -n -r -m, uptime -p, lspci queries for VGA/3D controller, and nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'. No file downloads, no dropped artifacts, no persistence, and no lateral movement were observed.
show less
Brute-ForceSSH
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.