Two SSH sessions used admin/letmein and admin1/123 via SSH-2.0-Go. The actor uploaded /home/honeypot ...
show moreTwo SSH sessions used admin/letmein and admin1/123 via SSH-2.0-Go. The actor uploaded /home/honeypot/.16 twice, then attempted to execute it, chmod +x it, and later delete it with rm -rf. They ran sudo commands with both passwords, including repeated attempts to invoke the uploaded file through sudo/sh -c. They also tried to wipe traces by clearing /var/log/wtmp, deleting .bash_history, and running history -c. Additional commands included checks like echo; echo 'check_698297d8443a5368e11840a65e720d87_transport_done' and echo; echo 'check_7aeed6a26a9aa9381a94ae2427418f0c_transport_done'. No lateral movement, port forwarding, or other downloads were observed.
show less
8 SSH sessions from SSH-2.0-Go in 14 minutes. Tried root logins with weak passwords: 1234, 12345, 12 ...
show more8 SSH sessions from SSH-2.0-Go in 14 minutes. Tried root logins with weak passwords: 1234, 12345, 123456, 1234567, 12345678, 123456789, 1234567890, 123qwe. After login attempts, ran sudo-based system discovery to get CPU count via nproc or /proc/cpuinfo, then issued many echo markers such as “check_02df17ea4a73adcef7b77d189f1ebf89_transport_done” and similar “transport_done” strings. 129 unique commands / 154 total were observed. Activity was focused on credential guessing and host reconnaissance; no downloads, payload execution, persistence, port forwarding, or lateral movement were observed.
show less
Multiple SSH logins from SSH-2.0-Go using root with passwords 1, 12, and 123. Activity focused on ho ...
show moreMultiple SSH logins from SSH-2.0-Go using root with passwords 1, 12, and 123. Activity focused on host profiling and execution checks: repeated sudo-wrapped nproc/CPU enumeration, PATH export, uname collection, and numerous echo markers such as check_*_transport_done. No file downloads, dropped files, persistence, port forwarding, or lateral movement were observed. No payloads or malware artifacts were observed.
show less
Two SSH sessions used master/wasd and root/root via SSH-2.0-Go. After login, the actor uploaded /hom ...
show moreTwo SSH sessions used master/wasd and root/root via SSH-2.0-Go. After login, the actor uploaded /home/honeypot/.16 twice, then tried to execute it, make it executable with chmod +x, and remove it with rm -rf. Multiple sudo -S attempts were made with both passwords to run the file and to change its permissions, showing active privilege escalation attempts. The session also issued check_a3954ac1f5a53cda681c4b3449cb44dc_transport_done and check_b6cacc0d859b0968109c758403b37d5d_transport_done markers. No successful payload execution, persistence creation, port forwarding, lateral movement, or additional downloads were observed.
show less
37 SSH sessions over ~5 hours used admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root ...
show more37 SSH sessions over ~5 hours used admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root. The attacker dropped a hidden executable named .16 (1.6 MB, sha256:9775d376f5e5b3ed0d79d1179abf0f1e6b699e71e8171b354bb063ed166e5aa0), tried to run it from /home/<user>/.16, made it executable with chmod +x, and later removed it with rm -rf. Multiple sudo -S attempts were issued with guessed passwords, and one command sequence cleared logs/history: echo -n '' > /var/log/wtmp; cd $HOME; rm -rf .bash_history; history -c. No port forwarding or lateral movement was observed.
show less
Two SSH sessions using master/wasd and root/root from SSH-2.0-Go. Attacker uploaded /home/honeypot/. ...
show moreTwo SSH sessions using master/wasd and root/root from SSH-2.0-Go. Attacker uploaded /home/honeypot/.16 twice, set it executable, and attempted to run it repeatedly. They used sudo with both credentials to execute the file, then removed it with rm -rf. One command chain also tried to clear evidence by truncating /var/log/wtmp, deleting .bash_history, and running history -c. No successful login shell activity beyond these execution attempts was observed. Several transport marker strings were issued, including check_128e833b7973f5aebde581ae59d700b4_transport_done and check_9766adf28c4b89911fac64fa317b9875_transport_done. The main activity was payload staging, execution, and log cleanup.
show less
Brute-force SSH login attempts against root used weak passwords 000000, 111111, and 123 from SSH-2.0 ...
show moreBrute-force SSH login attempts against root used weak passwords 000000, 111111, and 123 from SSH-2.0-Go. After access, the actor ran system discovery and environment checks: nproc via sudo, uname, PATH export, and repeated check_*_transport_done probes. No file downloads, dropped artifacts, persistence actions, lateral movement, or port forwarding were observed in this session. Activity was limited to reconnaissance and host capability checks across 4 sessions and 56 total commands.
show less
Multiple SSH login attempts over 11s using libssh_0.11.1 with credentials 345gs5662d34/345gs5662d34, ...
show moreMultiple SSH login attempts over 11s using libssh_0.11.1 with credentials 345gs5662d34/345gs5662d34, ubuntu/3245gs5662d34, and ubuntu/rootroot. After access, the actor tried to alter SSH access and disable protections: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx and cd ~; chattr -ia .ssh; lockr -ia .ssh. No downloads, dropped files, persistence beyond .ssh tampering, lateral movement, or additional recon observed.
show less
Multiple SSH login attempts used weak credentials: admin/letmein, admin1/123, ec2-user/123456, maste ...
show moreMultiple SSH login attempts used weak credentials: admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root via SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 clients. After login, the session uploaded a file named .16 twice to /home/honeypot/.16, then ran it, made it executable with chmod +x, and removed it with rm -rf. Commands also show sudo execution attempts using the supplied passwords, including direct invocation of /home/<user>/.16 under sudo. Additional output included check_0c906691b08b75e7147ec3c791684230_transport_done and check_b67d819be2fc1a7a364c1be69fc88e72_transport_done. No persistence, port forwarding, lateral movement, or other dropped artifacts were observed beyond the uploaded .16 file.
show less
2 SSH sessions over SSH-2.0-Go used credentials master/wasd and root/root. Activity focused on a dro ...
show more2 SSH sessions over SSH-2.0-Go used credentials master/wasd and root/root. Activity focused on a dropped payload named .16 (uploaded twice to /home/honeypot/.16). The actor attempted to run it, then used sudo with both passwords to chmod +x and later rm -rf the same file. Commands also included bare execution attempts and repeated sudo shell invocations. No additional uploads, downloads, port forwarding, or lateral movement were observed. The session included multiple check_*_transport_done markers and other command probes, but no successful interactive output was observed.
show less
Multiple SSH login attempts using root with weak passwords: root/root3245gs5662d34111111111, root/te ...
show moreMultiple SSH login attempts using root with weak passwords: root/root3245gs5662d34111111111, root/templeton1, and rootssssss23424123123/rootssssss23424123123. Client identified as SSH-2.0-libssh_0.9.6. After access, the session attempted to alter persistence by removing and recreating ~/.ssh, then writing an SSH public key into authorized access via an echo command beginning with “ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx”. A second command attempted to disable protection on the .ssh directory with “chattr -ia .ssh; lockr -ia .ssh”. No downloads, lateral movement, or additional payload execution were observed.
show less
Observed SSH brute-force login attempts using root with multiple passwords: Yy123456., root3245gs566 ...
show moreObserved SSH brute-force login attempts using root with multiple passwords: Yy123456., root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. SSH client identified as SSH-2.0-libssh_0.9.6. After access, attacker issued 2 unique commands: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx and cd ~; chattr -ia .ssh; lockr -ia .ssh. Activity shows attempts to remove or alter the .ssh directory and change file attributes, indicating SSH key persistence setup. No downloads, file drops, port forwarding, or lateral movement were observed.
show less
3 SSH sessions in 3.62s from SSH-2.0-libssh_0.9.6. Login attempts used 345gs5662d34/345gs5662d34, dj ...
show more3 SSH sessions in 3.62s from SSH-2.0-libssh_0.9.6. Login attempts used 345gs5662d34/345gs5662d34, django/3245gs5662d34, and django/django. After access, attacker reset the SSH directory with cd ~ && rm -rf .ssh && mkdir .ssh and began writing an ssh-rsa public key into ~/.ssh, indicating attempted persistence via authorized key placement. Second observed command was cd ~; chattr -ia .ssh; lockr -ia .ssh, which attempts to remove immutable attributes and lock protections before modifying the SSH directory. No downloads, malware files, lateral movement, or additional commands were observed.
show less
Observed 3 SSH sessions from SSH-2.0-libssh_0.9.6 in a 3-second window. Login attempts used 3 creden ...
show moreObserved 3 SSH sessions from SSH-2.0-libssh_0.9.6 in a 3-second window. Login attempts used 3 credential pairs: 345gs5662d34/345gs5662d34, ftpuser1/123456, and ftpuser1/3245gs5662d34. After access, the actor ran two commands focused on SSH persistence: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... and cd ~; chattr -ia .ssh; lockr -ia .ssh. This shows directory removal/recreation, attempted immutable-attribute removal, and a truncated SSH public key being written into ~/.ssh for persistence. No downloads, malware artifacts, lateral movement, or port forwarding were observed.
show less
SSH brute-force attempts used 3 logins in 7 seconds: 345gs5662d34/345gs5662d34, root/3245gs5662d34, ...
show moreSSH brute-force attempts used 3 logins in 7 seconds: 345gs5662d34/345gs5662d34, root/3245gs5662d34, and root/PASSWORD. Client banner was SSH-2.0-libssh_0.9.6. After login, the attacker ran commands to modify the home directory SSH config: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx and cd ~; chattr -ia .ssh; lockr -ia .ssh. Observed activity targeted SSH persistence by removing and recreating .ssh, then attempting to add an SSH key and alter file attributes. No downloads, malware files, port forwarding, or lateral movement were observed.
show less
Multiple SSH logins in 7 sessions using weak credentials: admin/letmein, admin1/123, ec2-user/123456 ...
show moreMultiple SSH logins in 7 sessions using weak credentials: admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root. Client strings were SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. The attacker uploaded a file named .16 twice, then repeatedly tried to execute it from /home/<user>/.16, made it executable with chmod +x, and deleted it with rm -rf. They also ran sudo via echoed passwords for root and wasd, and issued “check_*_transport_done” probe commands. No lateral movement, port forwarding, or additional downloads were observed. The main activity was credential guessing followed by upload, execution attempt, and cleanup of the dropped payload.
show less
SSH brute-force activity using SSH-2.0-libssh_0.9.6 with 6 sessions in 21 seconds. Tried credentials ...
show moreSSH brute-force activity using SSH-2.0-libssh_0.9.6 with 6 sessions in 21 seconds. Tried credentials: alice/123, alice/root3245gs5662d34111111111, rootssssss23424123123/rootssssss23424123123. After login, attacker ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx to replace SSH keys in the home directory, then cd ~; chattr -ia .ssh; lockr -ia .ssh to remove immutable/append-only attributes and continue modifying .ssh. No downloads, port forwards, lateral movement, or dropped artifacts observed.
show less
3 SSH sessions in 2.5s from SSH-2.0-libssh_0.9.6. Tried weak creds: 345gs5662d34/345gs5662d34, root/ ...
show more3 SSH sessions in 2.5s from SSH-2.0-libssh_0.9.6. Tried weak creds: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/hik12345+. After login, attacker removed and recreated ~/.ssh, then wrote an SSH public key beginning with ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... to enable key-based access. Second command attempted to clear file protections with chattr -ia .ssh and lockr -ia .ssh. No downloads, no malware artifacts, no lateral movement, and no port forwards observed.
show less
Attempted SSH login with 2 credential pairs: 345gs5662d34/345gs5662d34 and root/14881488, using SSH- ...
show moreAttempted SSH login with 2 credential pairs: 345gs5662d34/345gs5662d34 and root/14881488, using SSH-2.0-libssh_0.11.1. After access, the actor ran `cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx...` to replace the SSH authorized keys directory with attacker-controlled key material, indicating persistence via SSH key installation. A second command, `cd ~; chattr -ia .ssh; lockr -ia .ssh`, attempted to remove immutable/append-only attributes and then lock the `.ssh` directory to prevent changes. No downloads, malware drop, port forwarding, lateral movement, or additional artifacts were observed.
show less
SSH login attempts used rootssssss23424123123/rootssssss23424123123, shiny/root3245gs5662d3411111111 ...
show moreSSH login attempts used rootssssss23424123123/rootssssss23424123123, shiny/root3245gs5662d34111111111, and shiny/shiny with SSH-2.0-libssh_0.9.6. After access, the actor removed and recreated ~/.ssh, then wrote an SSH public key beginning ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... into authorized_keys. A second command cleared file immutability on ~/.ssh using chattr -ia .ssh and lockr -ia .ssh. No downloads, file drops, port forwarding, lateral movement, or additional commands were observed.
show less
Attempted SSH login with 3 credential pairs: 345gs5662d34/345gs5662d34, root/3245gs5662d34, and root ...
show moreAttempted SSH login with 3 credential pairs: 345gs5662d34/345gs5662d34, root/3245gs5662d34, and root/Q1w2e3r4t5y6u7i8 using SSH-2.0-libssh_0.11.1. After access, the actor ran 2 commands to alter the home SSH directory: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... and cd ~; chattr -ia .ssh; lockr -ia .ssh. Observed behavior shows SSH key staging/remediation of .ssh permissions and immutability settings. No downloads, file writes beyond the .ssh manipulation, persistence beyond .ssh changes, port forwarding, lateral movement, or artifacts were observed.
show less
Observed 9 SSH sessions from SSH-2.0-Go using repeated root login attempts with weak passwords: 1234 ...
show moreObserved 9 SSH sessions from SSH-2.0-Go using repeated root login attempts with weak passwords: 123456789, 1234567890, 123456a, 123456b, 123abc, 123qwe, 1q2w3e4r, 555555. After login, the host ran sudo-wrapped checks to discover CPU count (nproc, /usr/bin/nproc, busybox nproc, /proc/cpuinfo) and executed numerous marker/heartbeat commands such as echoing check_*_transport_done values. No file downloads, dropped artifacts, persistence, port forwarding, or lateral movement were observed. The activity is consistent with automated SSH brute forcing followed by environment reconnaissance and command execution.
show less
Two SSH sessions with SSH-2.0-Go used credentials ec2-user/123456 and master/wasd. The actor uploade ...
show moreTwo SSH sessions with SSH-2.0-Go used credentials ec2-user/123456 and master/wasd. The actor uploaded a file named .16 twice, then tried to run it from /home/<user>/.16, mark it executable with chmod +x, and remove it with rm -rf. Commands also show sudo attempts using both passwords, with empty sh -c invocations and repeated execution/removal cycles. Additional commands printed transport markers including check_0d25d2e4008781b48b90f2ff2a7de94e_transport_done and check_ad85e75f0f7b6ada6ca3f8e9f73fa451_transport_done. No successful login shell, persistence, port forwarding, lateral movement, or other downloaded payloads were observed beyond the uploaded .16 file.
show less
SSH login attempts used root with passwords 000000 and 111111 over 3 sessions from SSH-2.0-Go. After ...
show moreSSH login attempts used root with passwords 000000 and 111111 over 3 sessions from SSH-2.0-Go. After access, the host ran environment and system discovery commands: nproc via sudo, uname, export PATH, and several shell function/probe strings like check_262bb39c229a854ee1666be043d2090d_transport_done and similar. No payload download, file drop, persistence setup, port forwarding, credential harvesting, or lateral movement was observed. Activity was limited to recon and command probing.
show less
Two SSH sessions used SSH-2.0-Go with credentials admin/letmein and master/wasd. After login, the ac ...
show moreTwo SSH sessions used SSH-2.0-Go with credentials admin/letmein and master/wasd. After login, the actor uploaded a file named .16 twice to /home/honeypot/.16, made it executable, and attempted to run it. The session shows repeated sudo use with both passwords, indicating privilege escalation attempts. After execution attempts, the actor issued cleanup commands to delete /home/<user>/.16, clear command history, and wipe /var/log/wtmp: rm -rf, history -c, and echo -n '' > /var/log/wtmp. Additional commands were limited to status checks such as "check_65aee90d9403e7f2afe48c795d01e7e6_transport_done" and "check_ac2f8e3627adce1b875d4b4b1018818c_transport_done". No lateral movement or port forwards were observed.
show less
Brute-ForceSSHHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.