sshoney · ssh honeypot telemetry

Session
supple-wistful-martin
Source
220.123.222.114
Protocol
ssh/exec
User
root
Auth attempts
2
Commands
9
Transcript
6.3 K

Client

SSH-2.0-libssh2_1.11.1
exec: /ip cloud print

Credentials attempted

usernamepasswordmethodtier result
rootrootpasswordcommonrejected
rootadminpasswordcommonaccepted

Transcript

12:28:17 $ /ip cloud print
         -bash: /ip: No such file or directory  (1857ms)
12:28:19 $ ifconfig
         eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
                 inet 203.0.113.1  netmask 255.255.255.0  broadcast 45.33.68.255
                 inet6 2001:db8::1  prefixlen 64  scopeid 0x0<global>
                 ether f2:3c:91:65:96:d6  txqueuelen 1000  (Ethernet)
                 RX packets 184392  bytes 21847392 (21.8 MB)
                 TX packets 92831  bytes 14203918 (14.2 MB)
         
         lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
                 inet 127.0.0.1  netmask 255.0.0.0
                 inet6 ::1  prefixlen 128  scopeid 0x10<host>
                 loop  txqueuelen 1000  (Local Loopback)
12:28:20 $ uname -a
         Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
12:28:20 $ cat /proc/cpuinfo
         processor	: 0
         vendor_id	: AuthenticAMD
         cpu family	: 25
         model		: 33
         model name	: AMD EPYC 7713 64-Core Processor
         stepping	: 2
         microcode	: 0xa0011a9
         cpu MHz		: 2000.000
         cache size	: 512 KB
         physical id	: 0
         siblings	: 1
         core id		: 0
         cpu cores	: 64
         apicid		: 0
         initial apicid	: 0
         fpu		: yes
         fpu_exception	: yes
         cpuid level	: 25
         wp		: yes
         flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx mmxext fxsr_opt rdtscp lm constant_tsc rep_good nopl cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx avx2 f16c rdrand hypervisor lahf_lm cmp_legacy svm cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw perfctr_core ssbd ibrs ibpb stibp vmmcall fsgsbase bmi1 bmi2 erms invpcid rdseed adx smap clflushopt clwb sha_ni xsaveopt xsavec xgetbv1 xsaves clzero wbnoinvd
         vmx flags	: 
         bugs		: spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs taa itlb_multihit mmio_stale_data bhi
         bogomips	: 4000.00
         TLB size	: 4096 4K pages
         clflush size	: 64
         cache_alignment	: 64
         address sizes	: 40 bits physical, 48 bits virtual
         power management:  svm cstate
         processor	: 1
         vendor_id	: AuthenticAMD
         cpu family	: 25
         model		: 33
         model name	: AMD EPYC 7713 64-Core Processor
         stepping	: 2
         microcode	: 0xa0011a9
         cpu MHz		: 2000.000
         cache size	: 512 KB
         physical id	: 0
         siblings	: 1
         core id		: 1
         cpu cores	: 64
         apicid		: 1
         initial apicid	: 1
         fpu		: yes
         fpu_exception	: yes
         cpuid level	: 25
         wp		: yes
         flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx mmxext fxsr_opt rdtscp lm constant_tsc rep_good nopl cpuid extd_apicid aperfmperf pni pcl  (6941ms)
12:28:28 $ ps | grep '[Mm]iner'
         root        1264  0.0  0.1   9480  3248 ?        S    03:10   0:00 /usr/bin/cron -f
         root        1272  0.0  0.4  24120  8644 ?        Ss   03:10   0:00 /usr/sbin/sshd -D
         postgres    1318  0.0  0.7 215632 15120 ?        Ss   03:10   0:02 postgres: 14/main: checkpointer
         postgres    1319  0.0  0.7 215632 15120 ?        Ss   03:10   0:01 postgres: 14/main: background writer
         postgres    1320  0.0  0.7 215632 15120 ?        Ss   03:10   0:01 postgres: 14/main: walwriter
         postgres    1321  0.0  0.7 215632 15120 ?        Ss   03:10   0:03 postgres: 14/main: autovacuum launcher
         root        1330  0.0  0.2  12320  4480 ?        Ss   03:10   0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
         www-data    1331  0.0  0.5  13084  5840 ?        S    03:10   0:00 nginx: worker process
         root        1338  0.0  0.3  14572  5964 ?        Ss   03:10   0:00 /usr/bin/node /opt/stable/src/server.js
         root        1342  0.0  0.1   9480  3248 ?        S    03:10   0:00 /opt/stable/bin/hoofcheck.sh
         root        1347  0.0  0.1   9480  3248 ?        S    03:10   0:00 /usr/bin/python3 /opt/stable/bin/muck-out.sh
         root        1351  0.0  0.1   9480  3248 ?        S    03:10   0:00 /usr/bin/bash /opt/stable/bin/gallop-backup.sh
         root        1356  0.0  0.1   9480  3248 ?        S    03:10   0:00 /usr/bin/bash /opt/stable/bin/canter-deploy.sh
         root        1360  0.0  0.1   9480  3248 ?        S    03:10   0:00 /usr/bin/systemd-resolved  (4646ms)
12:28:33 $ ps -ef | grep '[Mm]iner'
         root        1264       1  0 03:10 ?        00:00:00 /usr/bin/cron -f
         root        1272       1  0 03:10 ?        00:00:00 /usr/sbin/sshd -D
         postgres    1318       1  0 03:10 ?        00:00:02 postgres: 14/main: checkpointer
         postgres    1319       1  0 03:10 ?        00:00:01 postgres: 14/main: background writer
         postgres    1320       1  0 03:10 ?        00:00:01 postgres: 14/main: walwriter
         postgres    1321       1  0 03:10 ?        00:00:03 postgres: 14/main: autovacuum launcher
         root        1330       1  0 03:10 ?        00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
         www-data    1331    1330  0 03:10 ?        00:00:00 nginx: worker process
         root        1338       1  0 03:10 ?        00:00:00 /usr/bin/node /opt/stable/src/server.js
         root        1342    1338  0 03:10 ?        00:00:00 /opt/stable/bin/hoofcheck.sh
         root        1347    1338  0 03:10 ?        00:00:00 /usr/bin/python3 /opt/stable/bin/muck-out.sh
         root        1351    1338  0 03:10 ?        00:00:00 /usr/bin/bash /opt/stable/bin/gallop-backup.sh
         root        1356    1338  0 03:10 ?        00:00:00 /usr/bin/bash /opt/stable/bin/canter-deploy.sh
         root        1360       1  0 03:10 ?        00:00:00 /usr/bin/systemd-resolved
         root        1622    1619  0 03:11 pts/0    00:00:00 grep --color=auto '[Mm]iner'  (3296ms)
12:28:37 $ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
         ls: cannot access '/home/*/.local/share/TelegramDesktop/tdata': No such file or directory
         ls: cannot access '/dev/ttyGSM*': No such file or directory
         ls: cannot access '/dev/ttyUSB-mod*': No such file or directory
         ls: cannot access '/var/spool/sms/*': No such file or directory
         ls: cannot access '/var/log/smsd.log': No such file or directory
         ls: cannot access '/etc/smsd.conf*': No such file or directory
         ls: cannot access '/usr/bin/qmuxd': No such file or directory
         ls: cannot access '/var/qmux_connect_socket': No such file or directory
         ls: cannot access '/etc/config/simman': No such file or directory
         ls: cannot access '/dev/modem*': No such file or directory
         ls: cannot access '/var/config/sms/*': No such file or directory
         /root/.local/share/TelegramDesktop/tdata:
         ls: cannot access '/root/.local/share/TelegramDesktop/tdata': No such file or directory  (1504ms)
12:28:39 $ locate D877F783D5D3EF8Cs
         bash: locate: command not found  (889ms)
12:28:41 $ echo Hi | cat -n
              1	Hi  (459ms)