sshoney · ssh honeypot telemetry

Session
mindful-nameless-wigeon
Source
81.181.129.252
Protocol
ssh/exec
User
root
Auth attempts
2
Commands
9
Transcript
5.0 K

Client

SSH-2.0-libssh2_1.11.0
exec: /ip cloud print

Credentials attempted

usernamepasswordmethodtier result
rootrootpasswordcommonrejected
rootadminpasswordcommonaccepted

Transcript

13:27:47 $ /ip cloud print
         -bash: /ip: No such file or directory  (2901ms)
13:27:50 $ ifconfig
         eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
                 inet 203.0.113.1  netmask 255.255.255.0  broadcast 45.33.68.255
                 inet6 2001:db8::1  prefixlen 64  scopeid 0x0<global>
                 ether f2:3c:91:65:96:d6  txqueuelen 1000  (Ethernet)
                 RX packets 184392  bytes 21847392 (21.8 MB)
                 TX packets 92831  bytes 14203918 (14.2 MB)
         
         lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
                 inet 127.0.0.1  netmask 255.0.0.0
                 inet6 ::1  prefixlen 128  scopeid 0x10<host>
                 loop  txqueuelen 1000  (Local Loopback)
13:27:50 $ uname -a
         Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
13:27:51 $ cat /proc/cpuinfo
         processor	: 0
         vendor_id	: AuthenticAMD
         cpu family	: 25
         model		: 1
         model name	: AMD EPYC 7713 64-Core Processor
         stepping	: 1
         microcode	: 0x0a500018
         cpu MHz		: 1995.313
         cache size	: 512 KB
         physical id	: 0
         siblings	: 128
         core id		: 0
         cpu cores	: 64
         apicid		: 0
         initial apicid	: 0
         fpu		: yes
         fpu_exception	: yes
         cpuid level	: 16
         wp		: yes
         flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx mmxext fxsr_opt rdtscp lm 3dnowext 3dnow rep_good nopl cpuid extd_apicid perfctr_core cqm lm perfctr_nb bpext cat_l3 cdp_l3 invpcid_single hw_pstate tsc_scale bmi1 avx2 smep bmi2 erms invpcid xsaveopt arat umip pku ospke vaes vpclmulqdq rdpid overflow_recov succor smca
         bugs		: spectre_v1 spectre_v2 spec_store_bypass swapgs itlb_multihit l1tf mds
         bogomips	: 3990.62
         TLB size	: 3584 4K pages
         clflush size	: 64
         cache_alignment	: 64
         address sizes	: 52 bits physical, 57 bits virtual
         power management:  (4854ms)
13:27:56 $ ps | grep '[Mm]iner'
         root         612  0.0  0.1   9124  2480 ?        Ss   03:10   0:00 /usr/sbin/sshd -D
         root         644  0.0  1.2  20484 12340 ?        Ss   03:10   0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
         www-data     645  0.0  0.6  21244  6428 ?        S    03:10   0:00 nginx: worker process
         postgres     668  0.0  0.9 213548  9380 ?        Ss   03:10   0:00 /usr/lib/postgresql/16/bin/postgres -D /var/lib/postgresql/16/main
         postgres     669  0.0  0.1 213548  1496 ?        Ss   03:10   0:00 postgres: 16/main: checkpointer 
         postgres     670  0.0  0.1 213548  1496 ?        Ss   03:10   0:00 postgres: 16/main: background writer 
         postgres     671  0.0  0.1 213548  1496 ?        Ss   03:10   0:00 postgres: 16/main: walwriter 
         postgres     672  0.0  0.1 214372  2384 ?        Ss   03:10   0:00 postgres: 16/main: autovacuum launcher 
         postgres     673  0.0  0.1 214220  2368 ?        Ss   03:10   0:00 postgres: 16/main: logical replication launcher 
         root         711  0.0  0.7  75444  7288 ?        Ss   03:10   0:00 node /opt/stable/src/server.js
         root         834  0.0  0.0  10240   964 pts/0    S+   03:10   0:00 grep --color=auto [Mm]iner  (3848ms)
13:28:01 $ ps -ef | grep '[Mm]iner'
         root         612       1  0 03:10 ?        00:00:00 /usr/sbin/sshd -D
         root         644       1  0 03:10 ?        00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
         www-data     645     644  0 03:10 ?        00:00:00 nginx: worker process
         postgres     668       1  0 03:10 ?        00:00:00 /usr/lib/postgresql/16/bin/postgres -D /var/lib/postgresql/16/main
         postgres     669     668  0 03:10 ?        00:00:00 postgres: 16/main: checkpointer 
         postgres     670     668  0 03:10 ?        00:00:00 postgres: 16/main: background writer 
         postgres     671     668  0 03:10 ?        00:00:00 postgres: 16/main: walwriter 
         postgres     672     668  0 03:10 ?        00:00:00 postgres: 16/main: autovacuum launcher 
         postgres     673     668  0 03:10 ?        00:00:00 postgres: 16/main: logical replication launcher 
         root         711       1  0 03:10 ?        00:00:00 node /opt/stable/src/server.js
         root         847     828  0 03:10 pts/0    00:00:00 grep --color=auto [Mm]iner  (2158ms)
13:28:03 $ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
         ls: cannot access '/root/.local/share/TelegramDesktop/tdata': No such file or directory
         ls: cannot access '/home/*/.local/share/TelegramDesktop/tdata': No such file or directory
         ls: cannot access '/dev/ttyGSM*': No such file or directory
         ls: cannot access '/dev/ttyUSB-mod*': No such file or directory
         ls: cannot access '/var/spool/sms/*': No such file or directory
         ls: cannot access '/var/log/smsd.log': No such file or directory
         ls: cannot access '/etc/smsd.conf*': No such file or directory
         ls: cannot access '/usr/bin/qmuxd': No such file or directory
         ls: cannot access '/var/qmux_connect_socket': No such file or directory
         ls: cannot access '/etc/config/simman': No such file or directory
         ls: cannot access '/dev/modem*': No such file or directory
         ls: cannot access '/var/config/sms/*': No such file or directory  (1381ms)
13:28:05 $ locate D877F783D5D3EF8Cs
         -bash: locate: command not found  (759ms)
13:28:07 $ echo Hi | cat -n
              1	Hi  (645ms)