sshoney · ssh honeypot telemetry

Client

Credentials attempted

Transcript

13:53:29 $ /ip cloud print
         bash: /ip: No such file or directory  (2086ms)
13:53:31 $ ifconfig
         eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
                 inet 203.0.113.1  netmask 255.255.255.0  broadcast 45.33.68.255
                 inet6 2001:db8::1  prefixlen 64  scopeid 0x0<global>
                 ether f2:3c:91:65:96:d6  txqueuelen 1000  (Ethernet)
                 RX packets 184392  bytes 21847392 (21.8 MB)
                 TX packets 92831  bytes 14203918 (14.2 MB)
         
         lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
                 inet 127.0.0.1  netmask 255.0.0.0
                 inet6 ::1  prefixlen 128  scopeid 0x10<host>
                 loop  txqueuelen 1000  (Local Loopback)
13:53:32 $ uname -a
         Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
13:53:32 $ cat /proc/cpuinfo
         processor	: 0
         vendor_id	: AuthenticAMD
         cpu family	: 25
         model		: 1
         model name	: AMD EPYC 7713 64-Core Processor
         stepping	: 1
         microcode	: 0x0a201013
         cpu MHz		: 2245.000
         cache size	: 512 KB
         physical id	: 0
         siblings	: 1
         core id		: 0
         cpu cores	: 64
         apicid		: 0
         initial apicid	: 0
         fpu		: yes
         fpu_exception	: yes
         cpuid level	: 33
         wp		: yes
         flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx lm constant_tsc rep_good nopl xtopology cpuid tsc_known_freq pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch invpcid_single ssbd ibrs ibpb stibp
         bugs		: spectre_v1 spectre_v2 spec_store_bypass
         bogomips	: 4490.00
         TLB size	: 2560 4K pages
         clflush size	: 64
         cache_alignment	: 64
         address sizes	: 48 bits physical, 48 bits virtual
         power management:  (4447ms)
13:53:37 $ ps | grep '[Mm]iner'
         root         1  0.0  0.2  22564  4568 ?        Ss   Aug20   0:03 /sbin/init
         root       418  0.0  0.4  67244  8460 ?        Ss   Aug20   0:12 /lib/systemd/systemd-journald
         root       501  0.0  0.3  41124  6120 ?        Ss   Aug20   0:01 /lib/systemd/systemd-udevd
         root       732  0.0  0.5  84220 10124 ?        Ss   Aug20   0:00 /usr/sbin/cron -f
         postgres   845  0.1  1.8 210344 18324 ?        Ss   Aug20   0:44 /usr/lib/postgresql/15/bin/postgres -D /var/lib/postgresql/15/main
         www-data   913  0.0  0.4  17428  4880 ?        S    Aug20   0:00 nginx: worker process
         www-data   914  0.0  0.4  17428  4880 ?        S    Aug20   0:00 nginx: worker process
         root      1024  0.0  0.6  30488  6124 ?        Ss   Aug20   0:00 /usr/sbin/sshd -D
         root      1188  0.0  0.7  49872  7320 ?        Ss   Aug20   0:02 node /opt/stable/src/server.js
         root      1679  0.0  0.1   9876  2320 pts/0    Ss   07:52   0:00 bash
         root      1844  0.0  0.0  10888   980 pts/0    S+   07:53   0:00 grep --color=auto [Mm]iner  (3906ms)
13:53:42 $ ps -ef | grep '[Mm]iner'
         root         1     0  0 Aug20 ?        00:03:12 /sbin/init
         root       418     1  0 Aug20 ?        00:00:21 /lib/systemd/systemd-journald
         root       501     1  0 Aug20 ?        00:00:03 /lib/systemd/systemd-udevd
         root       732     1  0 Aug20 ?        00:00:01 /usr/sbin/cron -f
         postgres   845     1  0 Aug20 ?        00:00:44 /usr/lib/postgresql/15/bin/postgres -D /var/lib/postgresql/15/main
         www-data   913     1  0 Aug20 ?        00:00:00 nginx: worker process
         www-data   914     1  0 Aug20 ?        00:00:00 nginx: worker process
         root      1024     1  0 Aug20 ?        00:00:00 /usr/sbin/sshd -D
         root      1188     1  0 Aug20 ?        00:00:02 node /opt/stable/src/server.js
         root      1679  1602  0 07:52 pts/0    00:00:00 bash
         root      1851  1679  0 07:53 pts/0    00:00:00 grep --color=auto [Mm]iner  (2308ms)
13:53:44 $ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
         ls: cannot access '/root/.local/share/TelegramDesktop/tdata': No such file or directory
         ls: cannot access '/home/*/.local/share/TelegramDesktop/tdata': No such file or directory
         ls: cannot access '/dev/ttyGSM*': No such file or directory
         ls: cannot access '/dev/ttyUSB-mod*': No such file or directory
         ls: cannot access '/var/spool/sms/*': No such file or directory
         ls: cannot access '/var/log/smsd.log': No such file or directory
         ls: cannot access '/etc/smsd.conf*': No such file or directory
         ls: cannot access '/usr/bin/qmuxd': No such file or directory
         ls: cannot access '/var/qmux_connect_socket': No such file or directory
         ls: cannot access '/etc/config/simman': No such file or directory
         ls: cannot access '/dev/modem*': No such file or directory
         ls: cannot access '/var/config/sms/*': No such file or directory  (1581ms)
13:53:46 $ locate D877F783D5D3EF8Cs
         bash: locate: command not found  (742ms)
13:53:48 $ echo Hi | cat -n
              1	Hi  (602ms)